Fix metadata corruption

[sayamindu]

(Originally titled: Call fsync() for metadata writes)

While the ds index is force flushed every 60 seconds, the metadata files can often be in a non-flushed state for an undefined time interval. A force power off in such a situation makes the Journal bring up odd looking entries.

[sayamindu]

Proposed patch

[sascha_silbe]

While I can see some merit in this patch, I'm worried about performance on XO-1 and XO-1.5. It would be nice if you could provide some data points (i.e. how long it takes to save an entry a) with and b) without syncing).
fdatasync() should be enough, BTW, we don't rely on file system level metadata (mtime, atime, etc.) in any way.

[erikos]

Any progress on this one?

[martin.langhoff]

Re-titling to reflect the problem instead of a diagnosis that was likely premature/faulty.

After working on this codebase on the patchseries addressing #2317 and related dataloss/datacorruption issues with the datastore, my tendency is to NAK the proposed patch and the whole logic behind it.

The original report talks about "the Journal bringing up odd-looking entries", I take it to mean that we are working on corrupt/mismatched metadata between index and metadatastore.

A likely root cause for this is the implementation of propery storage in metadatastore.py ; a patch addressing this is at ​http://lists.sugarlabs.org/archive/sugar-devel/2012-September/039729.html , and commentary on the erroneous use of try/except/finally at ​http://lists.sugarlabs.org/archive/sugar-devel/2012-September/039746.html . The metadatastore implementation is rather prone to data corruption / loss.

Once the writes to metadatastore are done defensively (atomically, in the patch linked), it is valid to ask whether it is worth calling fsync() to keep in rough sync with the index. The answer is no: all the filesystems used in Linux today have fsync() on a per-filesystem basis. All "dirty" buffers for the relevant filesystem are written out, not just the filehandle you passed.

So if the metadata changes are pending to be flushed when the index is flush()ed, the fsync() that Xapian invokes will _also_ flush metadata changes to disk.

I'll also note that currently we flush the Xapian db to disk every 5s, much lower than the 60s in use when originally reported.

[dnarvaez]

It sounds like we are doing the best we can do these days.