Agent Wranglers

Recommended

Turn on checksums and check for corruption

Let the database detect damaged pages, and run its full integrity check on every restored backup. A silent disk error otherwise spreads into every new backup.

How to do it

In PostgreSQL 18, initdb turns data checksums on by default. Older clusters can turn them on with pg_checksums --enable, which needs the server shut down cleanly. Alert when checksum_failures in pg_stat_database is above zero. Run pg_amcheck --all --heapallindexed on a restored copy, which checks tables and B-tree indexes. In SQLite, PRAGMA integrity_check returns one row, ok, when it finds no errors. It skips foreign keys, so run PRAGMA foreign_key_check too. Run these checks inside Prove restores work, so they never slow production.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

SQL example

-- PostgreSQL: expect on, and no rows from the second query
SHOW data_checksums;
SELECT datname, checksum_failures, checksum_last_failure FROM pg_stat_database WHERE checksum_failures > 0;
-- SQLite: expect ok, then no rows
PRAGMA integrity_check;
PRAGMA foreign_key_check;

Shell example

# On the restored copy, as part of the restore test
pg_amcheck --all --heapallindexed

How to check

SHOW data_checksums returns on in PostgreSQL. The last restore test log shows pg_amcheck reporting no corruption, or PRAGMA integrity_check returning ok and PRAGMA foreign_key_check returning no rows.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/data/operations/corruption-checks">Agent Wranglers data playbook</a>. In code you write, add a comment next to it with the same link.