Command Reference
Introduction
Commands are used to execute the various
pgBackRest
functions. Here the command options are listed exhaustively, that is, each option applicable to a command is listed with that command even if it applies to one or more other commands. This includes all the options that may also be configured in
pgbackrest.conf
.
Non-boolean options configured in
pgbackrest.conf
can be reset to default on the command-line by using the
reset-
prefix. This feature may be used to restore a backup directly on a repository host. Normally,
pgBackRest
will error because it can see that the database host is remote and restores cannot be done remotely. By adding
--reset-pg1-host
on the command-line,
pgBackRest
will ignore the remote database host and restore locally. It may be necessary to pass a new
--pg1-path
to force the restore to happen in a specific path, i.e. not the path used on the database host.
The
no-
prefix may be used to set a boolean option to false on the command-line.
Any option may be set in an environment variable using the
PGBACKREST_
prefix and the option name in all caps replacing
-
with
_
, e.g.
pg1-path
becomes
PGBACKREST_PG1_PATH
and
stanza
becomes
PGBACKREST_STANZA
. Boolean options are represented as they would be in a configuration file, e.g.
PGBACKREST_COMPRESS="n"
, and
reset-*
variants are not allowed. Options that can be specified multiple times on the command-line or in a config file can be represented by separating the values with colons, e.g.
PGBACKREST_DB_INCLUDE="db1:db2"
.
Command-line options override environment options which override config file options.
See
Configuration Introduction
for information on option types
Annotate Command ( annotate )
Annotations included with the
backup
command can be added, modified, or removed afterwards using the
annotate
command.
Command Options
Backup Annotation Option ( --annotation )
Annotate backup with user-defined key/value pairs.
Users can attach informative key/value pairs to the backup. This option may be used multiple times to attach multiple annotations.
Annotations are output by the
info
command text output when a backup is specified with
--set
and always appear in the JSON output.
example: --annotation=source="Sunday backup for website database"
General Options
Buffer Size Option ( --buffer-size )
Buffer size for I/O operations.
Buffer size used for copy, compress, encrypt, and other operations. The number of buffers used depends on options and each operation may use additional memory, e.g.
gz
compression may use an additional 256KiB of memory.
Allowed values are
16KiB
,
32KiB
,
64KiB
,
128KiB
,
256KiB
,
512KiB
,
1MiB
,
2MiB
,
4MiB
,
8MiB
, and
16MiB
.
default: 1MiB example: --buffer-size=2MiB
Network Compress Level Option ( --compress-level-network )
Network compression level.
Sets the network compression level when
compress-type=none
and the command is not run on the same host as the repository. Compression is used to reduce network traffic but can be disabled by setting
compress-level-network=0
. When
compress-type
does not equal
none
the
compress-level-network
setting is ignored and
compress-level
is used instead so that the file is only compressed once.
default: 3 allowed: 0-9 example: --compress-level-network=1
Config Option ( --config )
pgBackRest
configuration file.
Use this option to specify a different configuration file than the default.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_FILE example: --config=/conf/pgbackrest/pgbackrest.conf
Config Include Path Option ( --config-include-path )
Path to additional
pgBackRest
configuration files.
Configuration files existing in the specified location with extension
.conf
will be concatenated with the
pgBackRest
configuration file, resulting in one configuration file.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_INCLUDE_PATH example: --config-include-path=/conf/pgbackrest/conf.d
Config Path Option ( --config-path )
Base path of
pgBackRest
configuration files.
This setting is used to override the default base path setting for the
--config
and
--config-include-path
options unless they are explicitly set on the command-line.
For example, passing only
--config-path=/conf/pgbackrest
results in the
--config
default being set to
/conf/pgbackrest/pgbackrest.conf
and the
--config-include-path
default being set to
/conf/pgbackrest/conf.d
.
default: CFGOPTDEF_CONFIG_PATH example: --config-path=/conf/pgbackrest
I/O Timeout Option ( --io-timeout )
I/O timeout.
Timeout, in seconds, used for connections and read/write operations.
Note that the entire read/write operation does not need to complete within this timeout but
some
progress must be made, even if it is only a single byte.
default: 1m allowed: 100ms-1h example: --io-timeout=120
Lock Path Option ( --lock-path )
Path where lock files are stored.
The lock path provides a location for
pgBackRest
to create lock files to prevent conflicting operations from being run concurrently.
default: /tmp/pgbackrest example: --lock-path=/backup/db/lock
Neutral Umask Option ( --neutral-umask )
Use a neutral umask.
Sets the umask to 0000 so modes in the repository are created in a sensible way. The default directory mode is 0750 and default file mode is 0640. The lock and log directories set the directory and file mode to 0770 and 0660 respectively.
To use the executing user's umask instead specify
neutral-umask=n
in the config file or
--no-neutral-umask
on the command line.
default: y example: --no-neutral-umask
Protocol Timeout Option ( --protocol-timeout )
Protocol timeout.
Sets the timeout, in seconds, that the local or remote process will wait for a new message to be received on the protocol layer. This prevents processes from waiting indefinitely for a message.
NOTE:
The
protocol-timeout
option must be greater than the
db-timeout
option.
default: 31m allowed: 100ms-7d example: --protocol-timeout=630
Keep Alive Option ( --sck-keep-alive )
Keep-alive enable.
Enables keep-alive messages on socket connections.
default: y example: --no-sck-keep-alive
Stanza Option ( --stanza )
Defines the stanza.
A stanza is the configuration for a
PostgreSQL
database cluster that defines where it is located, how it will be backed up, archiving options, etc. Most db servers will only have one
PostgreSQL
database cluster and therefore one stanza, whereas backup servers will have a stanza for every database cluster that needs to be backed up.
It is tempting to name the stanza after the primary cluster but a better name describes the databases contained in the cluster. Because the stanza name will be used for the primary and all replicas it is more appropriate to choose a name that describes the actual function of the cluster, such as app or dw, rather than the local cluster name, such as main or prod.
example: --stanza=main
Keep Alive Count Option ( --tcp-keep-alive-count )
Keep-alive count.
Specifies the number of TCP keep-alive messages that can be lost before the connection is considered dead.
This option is available on systems that support the
TCP_KEEPCNT
socket option.
allowed: 1-32 example: --tcp-keep-alive-count=3
Keep Alive Idle Option ( --tcp-keep-alive-idle )
Keep-alive idle time.
Specifies the amount of time (in seconds) with no network activity after which the operating system should send a TCP keep-alive message.
This option is available on systems that support the
TCP_KEEPIDLE
socket option.
allowed: 1-3600 example: --tcp-keep-alive-idle=60
Keep Alive Interval Option ( --tcp-keep-alive-interval )
Keep-alive interval time.
Specifies the amount of time (in seconds) after which a TCP keep-alive message that has not been acknowledged should be retransmitted.
This option is available on systems that support the
TCP_KEEPINTVL
socket option.
allowed: 1-900 example: --tcp-keep-alive-interval=30
Log Options
Console Log Level Option ( --log-level-console )
Level for console logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: warn example: --log-level-console=error
File Log Level Option ( --log-level-file )
Level for file logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: info example: --log-level-file=debug
Std Error Log Level Option ( --log-level-stderr )
Level for stderr logging.
Specifies which log levels will output to
stderr
rather than
stdout
(specified by
log-level-console
). The timestamp and process will not be output to
stderr
.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: off example: --log-level-stderr=error
Log Path Option ( --log-path )
Path where log files are stored.
The log path provides a location for
pgBackRest
to store log files. Note that if
log-level-file=off
then no log path is required.
default: /var/log/pgbackrest example: --log-path=/backup/db/log
Repository Options
Set Repository Option ( --repo )
Set repository.
Set the repository for a command to operate on.
For example, this option may be used to perform a restore from a specific repository, rather than letting
pgBackRest
choose.
allowed: 1-256 example: --repo=1
Azure Repository Container Option ( --repo-azure-container )
Azure repository container.
Azure container used to store the repository.
pgBackRest
repositories can be stored in the container root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other Azure-generated content can also be stored in the container.
example: --repo1-azure-container=pg-backup
Azure Repository Key Type Option ( --repo-azure-key-type )
Azure repository key type.
The following types are supported for authorization:
- shared - Shared key
- sas - Shared access signature
default: shared example: --repo1-azure-key-type=sas
Azure Repository URI Style Option ( --repo-azure-uri-style )
Azure URI Style.
The following URI styles are supported:
- host - Connect to account.endpoint host.
- path - Connect to endpoint host and prepend account to URIs.
default: host example: --repo1-azure-uri-style=path
Repository Cipher Type Option ( --repo-cipher-type )
Cipher used to encrypt the repository.
The following cipher types are supported:
- none - The repository is not encrypted
- aes-256-cbc - Advanced Encryption Standard with 256 bit key length
Note that encryption is always performed client-side even if the repository type (e.g. S3) supports encryption.
default: none example: --repo1-cipher-type=aes-256-cbc
GCS Repository Bucket Option ( --repo-gcs-bucket )
GCS repository bucket.
GCS bucket used to store the repository.
pgBackRest
repositories can be stored in the bucket root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other GCS-generated content can also be stored in the bucket.
example: --repo1-gcs-bucket=/pg-backup
GCS Repository Endpoint Option ( --repo-gcs-endpoint )
GCS repository endpoint.
Endpoint used to connect to the storage service. May be updated to use a local GCS server or alternate endpoint.
default: storage.googleapis.com example: --repo1-gcs-endpoint=localhost
GCS Repository Key Type Option ( --repo-gcs-key-type )
GCS repository key type.
The following types are supported for authorization:
- auto - Authorize using the instance service account.
- service - Service account from locally stored key.
- token - For local testing, e.g. fakegcs .
When
repo-gcs-key-type=service
the credentials will be reloaded when the authentication token is renewed.
default: service example: --repo1-gcs-key-type=auto
Repository Host Option ( --repo-host )
Repository host when operating remotely.
When backing up and archiving to a locally mounted filesystem this setting is not required.
example: --repo1-host=repo1.domain.com
Deprecated Name: backup-host
Repository Host Certificate Authority File Option ( --repo-host-ca-file )
Repository host certificate authority file.
Use a CA file other than the system default for connecting to the repository host.
example: --repo1-host-ca-file=/etc/pki/tls/certs/ca-bundle.crt
Repository Host Certificate Authority Path Option ( --repo-host-ca-path )
Repository host certificate authority path.
Use a CA path other than the system default for connecting to the repository host.
example: --repo1-host-ca-path=/etc/pki/tls/certs
Repository Host Certificate File Option ( --repo-host-cert-file )
Repository host certificate file.
Sent to repository host to prove client identity.
example: --repo1-host-cert-file=/path/to/client.crt
Repository Host Command Option ( --repo-host-cmd )
Repository host
pgBackRest
command.
Required only if the path to the
pgBackRest
command is different on the local and repository hosts. If not defined, the repository host command will be set the same as the local command.
example: --repo1-host-cmd=/usr/lib/backrest/bin/pgbackrest
Deprecated Name: backup-cmd
Repository Host Configuration Option ( --repo-host-config )
pgBackRest
repository host configuration file.
Sets the location of the configuration file on the repository host. This is only required if the repository host configuration file is in a different location than the local configuration file.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_FILE example: --repo1-host-config=/conf/pgbackrest/pgbackrest.conf
Deprecated Name: backup-config
Repository Host Configuration Include Path Option ( --repo-host-config-include-path )
pgBackRest
repository host configuration include path.
Sets the location of the configuration include path on the repository host. This is only required if the repository host configuration include path is in a different location than the local configuration include path.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_INCLUDE_PATH example: --repo1-host-config-include-path=/conf/pgbackrest/conf.d
Repository Host Configuration Path Option ( --repo-host-config-path )
pgBackRest
repository host configuration path.
Sets the location of the configuration path on the repository host. This is only required if the repository host configuration path is in a different location than the local configuration path.
default: CFGOPTDEF_CONFIG_PATH example: --repo1-host-config-path=/conf/pgbackrest
Repository Host Key File Option ( --repo-host-key-file )
Repository host key file.
Proves client certificate was sent by owner.
example: --repo1-host-key-file=/path/to/client.key
Repository Host Port Option ( --repo-host-port )
Repository host port when
repo-host
is set.
Use this option to specify a non-default port for the repository host protocol.
allowed: 0-65535 example: --repo1-host-port=25
Deprecated Name: backup-ssh-port
Repository Host Protocol Type Option ( --repo-host-type )
Repository host protocol type.
The following protocol types are supported:
- ssh - Secure Shell.
- tls - pgBackRest TLS server.
default: ssh example: --repo1-host-type=tls
Repository Host User Option ( --repo-host-user )
Repository host user when
repo-host
is set.
Defines the user that will be used for operations on the repository host. Preferably this is not the
postgres
user but rather some other user like
pgbackrest
. If
PostgreSQL
runs on the repository host the
postgres
user can be placed in the
pgbackrest
group so it has read permissions on the repository without being able to damage the contents accidentally.
default: pgbackrest example: --repo1-host-user=repo-user
Deprecated Name: backup-user
Repository Path Option ( --repo-path )
Path where backups and archive are stored.
The repository is where
pgBackRest
stores backups and archives WAL segments.
It may be difficult to estimate in advance how much space you'll need. The best thing to do is take some backups then record the size of different types of backups (full/incr/diff) and measure the amount of WAL generated per day. This will give you a general idea of how much space you'll need, though of course requirements will likely change over time as your database evolves.
default: /var/lib/pgbackrest example: --repo1-path=/backup/db/backrest
S3 Repository Bucket Option ( --repo-s3-bucket )
S3 repository bucket.
S3 bucket used to store the repository.
pgBackRest
repositories can be stored in the bucket root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other AWS generated content can also be stored in the bucket.
example: --repo1-s3-bucket=pg-backup
S3 Repository Endpoint Option ( --repo-s3-endpoint )
S3 repository endpoint.
The AWS endpoint should be valid for the selected region.
For custom/test configurations the
repo-storage-ca-file
,
repo-storage-ca-path
,
repo-storage-host
,
repo-storage-port
, and
repo-storage-verify-tls
options may be useful.
example: --repo1-s3-endpoint=s3.amazonaws.com
S3 Repository Key Type Option ( --repo-s3-key-type )
S3 repository key type.
The following types are supported:
- shared - Shared keys
- auto - Automatically retrieve temporary credentials
- web-id - Automatically retrieve web identity credentials
default: shared example: --repo1-s3-key-type=auto
S3 Repository KMS Key ID Option ( --repo-s3-kms-key-id )
S3 repository KMS key.
Setting this option enables S3 server-side encryption using the specified AWS key management service key.
example: --repo1-s3-kms-key-id=bceb4f13-6939-4be3-910d-df54dee817b7
S3 Repository Region Option ( --repo-s3-region )
S3 repository region.
The AWS region where the bucket was created.
example: --repo1-s3-region=us-east-1
S3 Repository Role Option ( --repo-s3-role )
S3 repository role.
The AWS role name (not the full ARN) used to retrieve temporary credentials when
repo-s3-key-type=auto
.
example: --repo1-s3-role=authrole
S3 Repository URI Style Option ( --repo-s3-uri-style )
S3 URI Style.
The following URI styles are supported:
- host - Connect to bucket.endpoint host.
- path - Connect to endpoint host and prepend bucket to URIs.
default: host example: --repo1-s3-uri-style=path
SFTP Repository Host Option ( --repo-sftp-host )
SFTP repository host.
The SFTP host containing the repository.
example: --repo1-sftp-host=sftprepo.domain
SFTP Repository Host Fingerprint Option ( --repo-sftp-host-fingerprint )
SFTP repository host fingerprint.
SFTP repository host fingerprint generation should match the
repo-sftp-host-key-hash-type
. Generate the fingerprint via
awk '{print $2}' ssh_host_xxx_key.pub | base64 -d | (md5sum or sha1sum) -b
. The ssh host keys are normally found in the
/etc/ssh
directory.
example: --repo1-sftp-host-fingerprint=f84e172dfead7aeeeae6c1fdfb5aa8cf
SFTP Host Key Check Type Option ( --repo-sftp-host-key-check-type )
SFTP host key check type.
The following SFTP host key check types are supported:
- strict - pgBackRest will never automatically add host keys to the ~/.ssh/known_hosts file, and refuses to connect to hosts whose host key has changed or is not found in the known hosts files. This option forces the user to manually add all new hosts.
- accept-new - pgBackRest will automatically add new host keys to the user's known hosts file, but will not permit connections to hosts with changed host keys.
- fingerprint - pgBackRest will check the host key against the fingerprint specified by the repo-sftp-host-fingerprint option.
- none - no host key checking will be performed.
default: strict example: --repo1-sftp-host-key-check-type=accept-new
SFTP Repository Host Key Hash Type Option ( --repo-sftp-host-key-hash-type )
SFTP repository host key hash type.
SFTP repository host key hash type. Declares the hash type to be used to compute the digest of the remote system's host key on SSH startup. Newer versions of
libssh2
support
sha256
in addition to md5 and sha1.
example: --repo1-sftp-host-key-hash-type=sha256
SFTP Repository Host Port Option ( --repo-sftp-host-port )
SFTP repository host port.
SFTP repository host port.
default: 22 allowed: 1-65535 example: --repo1-sftp-host-port=22
SFTP Repository Host User Option ( --repo-sftp-host-user )
SFTP repository host user.
User on the host used to store the repository.
example: --repo1-sftp-host-user=pg-backup
SFTP Known Hosts File Option ( --repo-sftp-known-host )
SFTP known hosts file.
A known hosts file to search for an SFTP host match during authentication. When unspecified,
pgBackRest
will default to searching
~/.ssh/known_hosts
,
~/.ssh/known_hosts2
,
/etc/ssh/ssh_known_hosts
, and
/etc/ssh/ssh_known_hosts2
. If configured with one or more file paths,
pgBackRest
will search those for a match. File paths must be full or leading tilde paths. The
repo-sftp-known-host
option can be passed multiple times to specify more than one known hosts file to search. To utilize known hosts file checking
repo-sftp-host-fingerprint
must not be specified. See also
repo-sftp-host-check-type
option.
example: --repo1-sftp-known-host=/home/postgres/.ssh/known_hosts
SFTP Repository Private Key File Option ( --repo-sftp-private-key-file )
SFTP private key file.
SFTP private key file used for authentication.
example: --repo1-sftp-private-key-file=~/.ssh/id_ed25519
SFTP Repository Public Key File Option ( --repo-sftp-public-key-file )
SFTP public key file.
SFTP public key file used for authentication. Optional if compiled against OpenSSL, required if compiled against a different library.
example: --repo1-sftp-public-key-file=~/.ssh/id_ed25519.pub
Repository Storage CA File Option ( --repo-storage-ca-file )
Repository storage CA file.
Use a CA file other than the system default for storage (e.g. S3, Azure) certificates.
example: --repo1-storage-ca-file=/etc/pki/tls/certs/ca-bundle.crt
Deprecated Names: repo-azure-ca-file, repo-s3-ca-file
Repository Storage TLS CA Path Option ( --repo-storage-ca-path )
Repository storage CA path.
Use a CA path other than the system default for storage (e.g. S3, Azure) certificates.
example: --repo1-storage-ca-path=/etc/pki/tls/certs
Deprecated Names: repo-azure-ca-path, repo-s3-ca-path
Repository Storage Host Option ( --repo-storage-host )
Repository storage host.
Connect to a host other than the storage (e.g. S3, Azure) endpoint. This is typically used for testing.
example: --repo1-storage-host=127.0.0.1
Deprecated Names: repo-azure-host, repo-s3-host
Repository Storage Port Option ( --repo-storage-port )
Repository storage port.
Port to use when connecting to the storage (e.g. S3, Azure) endpoint (or host if specified).
default: 443 allowed: 1-65535 example: --repo1-storage-port=9000
Deprecated Names: repo-azure-port, repo-s3-port
Repository Storage Tag Option ( --repo-storage-tag )
Repository storage tag(s).
Specify tags that will be added to objects when the repository is an object store (e.g. S3). The option can be repeated to add multiple tags.
There is no provision in
pgBackRest
to modify these tags so be sure to set them correctly before running
stanza-create
to ensure uniform tags across the entire repository.
example: --repo1-storage-tag=key1=value1
Repository Storage Upload Chunk Size Option ( --repo-storage-upload-chunk-size )
Repository storage upload chunk size.
Object stores such as S3 allow files to be uploaded in chunks when the file is too large to be stored in memory. Even if the file can be stored in memory, it is more memory efficient to limit the amount of memory used for uploads.
A larger chunk size will generally lead to better performance because it will minimize upload requests and allow more files to be uploaded in a single request rather than in chunks. The disadvantage is that memory usage will be higher and because the chunk buffer must be allocated per process, larger
process-max
values will lead to more memory being consumed overall.
Default chunk sizes by repo type:
- azure - 4MiB
- gcs - 4MiB
- s3 - 5MiB
Note that valid chunk sizes vary by storage type and by platform. For example,
AWS S3
has a minimum chunk size of 5MiB but
S3
clones may accept lower values. Terminology for chunk size varies by storage type, so when searching min/max values use
part sizefor AWS S3 ,
chunk sizefor GCS , and
block sizefor Azure . No attempt is made to validate configured chunk sizes so selecting an invalid value will lead to errors from the storage service or undefined behavior.
allowed: 64KiB-1TiB example: --repo1-storage-upload-chunk-size=16MiB
Repository Storage Certificate Verify Option ( --repo-storage-verify-tls )
Repository storage certificate verify.
This option provides the ability to enable/disable verification of the storage (e.g. S3, Azure) server TLS certificate. Disabling should only be used for testing or other scenarios where a certificate has been self-signed.
default: y example: --no-repo1-storage-verify-tls
Deprecated Names: repo-azure-verify-tls, repo-s3-verify-ssl, repo-s3-verify-tls
Repository Type Option ( --repo-type )
Type of storage used for the repository.
The following repository types are supported:
- azure - Azure Blob Storage Service
- cifs - Like posix , but disables links and directory fsyncs
- gcs - Google Cloud Storage
- posix - Posix-compliant file systems
- s3 - AWS Simple Storage Service
- sftp - Secure File Transfer Protocol
When an
NFS
mount is used as a
posix
repository, the same rules apply to
pgBackRest
as described in the
PostgreSQL
documentation:
Creating a Database Cluster - File Systems
.
default: posix example: --repo1-type=cifs
Archive Get Command ( archive-get )
This command is used by
PostgreSQL
to restore a backup, perform PITR, or as an alternative to streaming for keeping a replica up to date. WAL segments are required for
PostgreSQL
recovery or to maintain a replica.
When multiple repositories are configured, WAL will be fetched from the repositories in priority order (e.g.
repo1
,
repo2
, etc.). In general it is better if faster/cheaper storage has higher priority. If a repository is specified with the
--repo
option then only that repository will be searched.
The
archive-get
command is configured and generated by
pgBackRest
during a restore for use by
PostgreSQL
. See
Point-in-Time Recovery
for an example.
Command Options
Asynchronous Archiving Option ( --archive-async )
Push/get WAL segments asynchronously.
Enables asynchronous operation for the
archive-push
and
archive-get
commands.
Asynchronous operation is more efficient because it can reuse connections and take advantage of parallelism. See the
spool-path
,
archive-get-queue-max
, and
archive-push-queue-max
options for more information.
default: n example: --archive-async
Maximum Archive Get Queue Size Option ( --archive-get-queue-max )
Maximum size of the
pgBackRest
archive-get queue.
Specifies the maximum size of the
archive-get
queue when
archive-async
is enabled. The queue is stored in the
spool-path
and is used to speed providing WAL to
PostgreSQL
.
default: 128MiB allowed: 0B-4PiB example: --archive-get-queue-max=1GiB
Retry Missing WAL Segment Option ( --archive-missing-retry )
Retry missing WAL segment
Retry a WAL segment that was previously reported as missing by the
archive-get
command when in asynchronous mode. This prevents notifications in the spool path from a prior restore from being used and possibly causing a recovery failure if consistency has not been reached.
Disabling this option allows
PostgreSQL
to more reliably recognize when the end of the WAL in the archive has been reached, which permits it to switch over to streaming from the primary. With retries enabled, a steady stream of WAL being archived will cause
PostgreSQL
to continue getting WAL from the archive rather than switch to streaming.
When disabling this option it is important to ensure that the spool path for the stanza is empty. The
restore
command does this automatically if the spool path is configured at restore time. Otherwise, it is up to the user to ensure the spool path is empty.
default: y example: --no-archive-missing-retry
Archive Timeout Option ( --archive-timeout )
Archive timeout.
Set maximum time, in seconds, to wait for each WAL segment to reach the
pgBackRest
archive repository. The timeout applies to the
check
and
backup
commands when waiting for WAL segments required for backup consistency to be archived.
default: 1m allowed: 100ms-1d example: --archive-timeout=30
General Options
Buffer Size Option ( --buffer-size )
Buffer size for I/O operations.
Buffer size used for copy, compress, encrypt, and other operations. The number of buffers used depends on options and each operation may use additional memory, e.g.
gz
compression may use an additional 256KiB of memory.
Allowed values are
16KiB
,
32KiB
,
64KiB
,
128KiB
,
256KiB
,
512KiB
,
1MiB
,
2MiB
,
4MiB
,
8MiB
, and
16MiB
.
default: 1MiB example: --buffer-size=2MiB
pgBackRest Command Option ( --cmd )
pgBackRest
command.
pgBackRest
may generate a command string, e.g. when the
restore
command generates the
restore_command
setting. The command used to run the
pgBackRest
process will be used in this case unless the
cmd
option is provided.
CAUTION:
Wrapping the
pgBackRest
command may cause unpredictable behavior and is not recommended.
example: --cmd=/var/lib/pgsql/bin/pgbackrest_wrapper.sh
SSH Client Command Option ( --cmd-ssh )
SSH client command.
Use a specific SSH client command when an alternate is desired or the
ssh
command is not in $PATH.
default: ssh example: --cmd-ssh=/usr/bin/ssh
Network Compress Level Option ( --compress-level-network )
Network compression level.
Sets the network compression level when
compress-type=none
and the command is not run on the same host as the repository. Compression is used to reduce network traffic but can be disabled by setting
compress-level-network=0
. When
compress-type
does not equal
none
the
compress-level-network
setting is ignored and
compress-level
is used instead so that the file is only compressed once.
default: 3 allowed: 0-9 example: --compress-level-network=1
Config Option ( --config )
pgBackRest
configuration file.
Use this option to specify a different configuration file than the default.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_FILE example: --config=/conf/pgbackrest/pgbackrest.conf
Config Include Path Option ( --config-include-path )
Path to additional
pgBackRest
configuration files.
Configuration files existing in the specified location with extension
.conf
will be concatenated with the
pgBackRest
configuration file, resulting in one configuration file.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_INCLUDE_PATH example: --config-include-path=/conf/pgbackrest/conf.d
Config Path Option ( --config-path )
Base path of
pgBackRest
configuration files.
This setting is used to override the default base path setting for the
--config
and
--config-include-path
options unless they are explicitly set on the command-line.
For example, passing only
--config-path=/conf/pgbackrest
results in the
--config
default being set to
/conf/pgbackrest/pgbackrest.conf
and the
--config-include-path
default being set to
/conf/pgbackrest/conf.d
.
default: CFGOPTDEF_CONFIG_PATH example: --config-path=/conf/pgbackrest
Database Timeout Option ( --db-timeout )
Database query timeout.
Sets the timeout, in seconds, for queries against the database. This includes the backup start/stop functions which can each take a substantial amount of time. Because of this the timeout should be kept high unless you know that these functions will return quickly (i.e. if you have set
start-fast=y
and you know that the database cluster will not generate many WAL segments during the backup).
NOTE:
The
db-timeout
option must be less than the
protocol-timeout
option.
default: 30m allowed: 100ms-7d example: --db-timeout=600
I/O Timeout Option ( --io-timeout )
I/O timeout.
Timeout, in seconds, used for connections and read/write operations.
Note that the entire read/write operation does not need to complete within this timeout but
some
progress must be made, even if it is only a single byte.
default: 1m allowed: 100ms-1h example: --io-timeout=120
Lock Path Option ( --lock-path )
Path where lock files are stored.
The lock path provides a location for
pgBackRest
to create lock files to prevent conflicting operations from being run concurrently.
default: /tmp/pgbackrest example: --lock-path=/backup/db/lock
Neutral Umask Option ( --neutral-umask )
Use a neutral umask.
Sets the umask to 0000 so modes in the repository are created in a sensible way. The default directory mode is 0750 and default file mode is 0640. The lock and log directories set the directory and file mode to 0770 and 0660 respectively.
To use the executing user's umask instead specify
neutral-umask=n
in the config file or
--no-neutral-umask
on the command line.
default: y example: --no-neutral-umask
Process Maximum Option ( --process-max )
Max processes to use for compress/transfer.
Each process will perform compression and transfer to make the command run faster, but don't set
process-max
so high that it impacts database performance.
default: 1 allowed: 1-999 example: --process-max=4
Protocol Timeout Option ( --protocol-timeout )
Protocol timeout.
Sets the timeout, in seconds, that the local or remote process will wait for a new message to be received on the protocol layer. This prevents processes from waiting indefinitely for a message.
NOTE:
The
protocol-timeout
option must be greater than the
db-timeout
option.
default: 31m allowed: 100ms-7d example: --protocol-timeout=630
Keep Alive Option ( --sck-keep-alive )
Keep-alive enable.
Enables keep-alive messages on socket connections.
default: y example: --no-sck-keep-alive
Spool Path Option ( --spool-path )
Path where transient data is stored.
This path is used to store data for the asynchronous
archive-push
and
archive-get
command.
The asynchronous
archive-push
command writes acknowledgements into the spool path when it has successfully stored WAL in the archive (and errors on failure) so the foreground process can quickly notify
PostgreSQL
. Acknowledgement files are very small (zero on success and a few hundred bytes on error).
The asynchronous
archive-get
command queues WAL in the spool path so it can be provided very quickly when
PostgreSQL
requests it. Moving files to
PostgreSQL
is most efficient when the spool path is on the same filesystem as
pg_xlog
/
pg_wal
.
The data stored in the spool path is not strictly temporary since it can and should survive a reboot. However, loss of the data in the spool path is not a problem.
pgBackRest
will simply recheck each WAL segment to ensure it is safely archived for
archive-push
and rebuild the queue for
archive-get
.
The spool path is intended to be located on a local Posix-compatible filesystem, not a remote filesystem such as
NFS
or
CIFS
.
default: /var/spool/pgbackrest example: --spool-path=/backup/db/spool
Stanza Option ( --stanza )
Defines the stanza.
A stanza is the configuration for a
PostgreSQL
database cluster that defines where it is located, how it will be backed up, archiving options, etc. Most db servers will only have one
PostgreSQL
database cluster and therefore one stanza, whereas backup servers will have a stanza for every database cluster that needs to be backed up.
It is tempting to name the stanza after the primary cluster but a better name describes the databases contained in the cluster. Because the stanza name will be used for the primary and all replicas it is more appropriate to choose a name that describes the actual function of the cluster, such as app or dw, rather than the local cluster name, such as main or prod.
example: --stanza=main
Keep Alive Count Option ( --tcp-keep-alive-count )
Keep-alive count.
Specifies the number of TCP keep-alive messages that can be lost before the connection is considered dead.
This option is available on systems that support the
TCP_KEEPCNT
socket option.
allowed: 1-32 example: --tcp-keep-alive-count=3
Keep Alive Idle Option ( --tcp-keep-alive-idle )
Keep-alive idle time.
Specifies the amount of time (in seconds) with no network activity after which the operating system should send a TCP keep-alive message.
This option is available on systems that support the
TCP_KEEPIDLE
socket option.
allowed: 1-3600 example: --tcp-keep-alive-idle=60
Keep Alive Interval Option ( --tcp-keep-alive-interval )
Keep-alive interval time.
Specifies the amount of time (in seconds) after which a TCP keep-alive message that has not been acknowledged should be retransmitted.
This option is available on systems that support the
TCP_KEEPINTVL
socket option.
allowed: 1-900 example: --tcp-keep-alive-interval=30
Log Options
Console Log Level Option ( --log-level-console )
Level for console logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: warn example: --log-level-console=error
File Log Level Option ( --log-level-file )
Level for file logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: info example: --log-level-file=debug
Std Error Log Level Option ( --log-level-stderr )
Level for stderr logging.
Specifies which log levels will output to
stderr
rather than
stdout
(specified by
log-level-console
). The timestamp and process will not be output to
stderr
.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: off example: --log-level-stderr=error
Log Path Option ( --log-path )
Path where log files are stored.
The log path provides a location for
pgBackRest
to store log files. Note that if
log-level-file=off
then no log path is required.
default: /var/log/pgbackrest example: --log-path=/backup/db/log
Maintainer Options
Force PostgreSQL Version Option ( --pg-version-force )
Force
PostgreSQL
version.
The specified
PostgreSQL
version will be used instead of the version automatically detected by reading
pg_control
or WAL headers. This is mainly useful for
PostgreSQL
forks or development versions where those values are different from the release version. The version reported by
PostgreSQL
via `server_version_num` must match the forced version.
WARNING:
Be cautious when using this option because
pg_control
and WAL headers will still be read with the expected format for the specified version, i.e. the format from the official open-source version of
PostgreSQL
. If the fork or development version changes the format of the fields that
pgBackRest
depends on it will lead to unexpected behavior. In general, this option will only work as expected if the fork adds all custom struct members
after
the standard
PostgreSQL
members.
example: --pg-version-force=15
Repository Options
Set Repository Option ( --repo )
Set repository.
Set the repository for a command to operate on.
For example, this option may be used to perform a restore from a specific repository, rather than letting
pgBackRest
choose.
allowed: 1-256 example: --repo=1
Azure Repository Container Option ( --repo-azure-container )
Azure repository container.
Azure container used to store the repository.
pgBackRest
repositories can be stored in the container root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other Azure-generated content can also be stored in the container.
example: --repo1-azure-container=pg-backup
Azure Repository Key Type Option ( --repo-azure-key-type )
Azure repository key type.
The following types are supported for authorization:
- shared - Shared key
- sas - Shared access signature
default: shared example: --repo1-azure-key-type=sas
Azure Repository URI Style Option ( --repo-azure-uri-style )
Azure URI Style.
The following URI styles are supported:
- host - Connect to account.endpoint host.
- path - Connect to endpoint host and prepend account to URIs.
default: host example: --repo1-azure-uri-style=path
Repository Cipher Type Option ( --repo-cipher-type )
Cipher used to encrypt the repository.
The following cipher types are supported:
- none - The repository is not encrypted
- aes-256-cbc - Advanced Encryption Standard with 256 bit key length
Note that encryption is always performed client-side even if the repository type (e.g. S3) supports encryption.
default: none example: --repo1-cipher-type=aes-256-cbc
GCS Repository Bucket Option ( --repo-gcs-bucket )
GCS repository bucket.
GCS bucket used to store the repository.
pgBackRest
repositories can be stored in the bucket root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other GCS-generated content can also be stored in the bucket.
example: --repo1-gcs-bucket=/pg-backup
GCS Repository Endpoint Option ( --repo-gcs-endpoint )
GCS repository endpoint.
Endpoint used to connect to the storage service. May be updated to use a local GCS server or alternate endpoint.
default: storage.googleapis.com example: --repo1-gcs-endpoint=localhost
GCS Repository Key Type Option ( --repo-gcs-key-type )
GCS repository key type.
The following types are supported for authorization:
- auto - Authorize using the instance service account.
- service - Service account from locally stored key.
- token - For local testing, e.g. fakegcs .
When
repo-gcs-key-type=service
the credentials will be reloaded when the authentication token is renewed.
default: service example: --repo1-gcs-key-type=auto
Repository Host Option ( --repo-host )
Repository host when operating remotely.
When backing up and archiving to a locally mounted filesystem this setting is not required.
example: --repo1-host=repo1.domain.com
Deprecated Name: backup-host
Repository Host Certificate Authority File Option ( --repo-host-ca-file )
Repository host certificate authority file.
Use a CA file other than the system default for connecting to the repository host.
example: --repo1-host-ca-file=/etc/pki/tls/certs/ca-bundle.crt
Repository Host Certificate Authority Path Option ( --repo-host-ca-path )
Repository host certificate authority path.
Use a CA path other than the system default for connecting to the repository host.
example: --repo1-host-ca-path=/etc/pki/tls/certs
Repository Host Certificate File Option ( --repo-host-cert-file )
Repository host certificate file.
Sent to repository host to prove client identity.
example: --repo1-host-cert-file=/path/to/client.crt
Repository Host Command Option ( --repo-host-cmd )
Repository host
pgBackRest
command.
Required only if the path to the
pgBackRest
command is different on the local and repository hosts. If not defined, the repository host command will be set the same as the local command.
example: --repo1-host-cmd=/usr/lib/backrest/bin/pgbackrest
Deprecated Name: backup-cmd
Repository Host Configuration Option ( --repo-host-config )
pgBackRest
repository host configuration file.
Sets the location of the configuration file on the repository host. This is only required if the repository host configuration file is in a different location than the local configuration file.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_FILE example: --repo1-host-config=/conf/pgbackrest/pgbackrest.conf
Deprecated Name: backup-config
Repository Host Configuration Include Path Option ( --repo-host-config-include-path )
pgBackRest
repository host configuration include path.
Sets the location of the configuration include path on the repository host. This is only required if the repository host configuration include path is in a different location than the local configuration include path.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_INCLUDE_PATH example: --repo1-host-config-include-path=/conf/pgbackrest/conf.d
Repository Host Configuration Path Option ( --repo-host-config-path )
pgBackRest
repository host configuration path.
Sets the location of the configuration path on the repository host. This is only required if the repository host configuration path is in a different location than the local configuration path.
default: CFGOPTDEF_CONFIG_PATH example: --repo1-host-config-path=/conf/pgbackrest
Repository Host Key File Option ( --repo-host-key-file )
Repository host key file.
Proves client certificate was sent by owner.
example: --repo1-host-key-file=/path/to/client.key
Repository Host Port Option ( --repo-host-port )
Repository host port when
repo-host
is set.
Use this option to specify a non-default port for the repository host protocol.
allowed: 0-65535 example: --repo1-host-port=25
Deprecated Name: backup-ssh-port
Repository Host Protocol Type Option ( --repo-host-type )
Repository host protocol type.
The following protocol types are supported:
- ssh - Secure Shell.
- tls - pgBackRest TLS server.
default: ssh example: --repo1-host-type=tls
Repository Host User Option ( --repo-host-user )
Repository host user when
repo-host
is set.
Defines the user that will be used for operations on the repository host. Preferably this is not the
postgres
user but rather some other user like
pgbackrest
. If
PostgreSQL
runs on the repository host the
postgres
user can be placed in the
pgbackrest
group so it has read permissions on the repository without being able to damage the contents accidentally.
default: pgbackrest example: --repo1-host-user=repo-user
Deprecated Name: backup-user
Repository Path Option ( --repo-path )
Path where backups and archive are stored.
The repository is where
pgBackRest
stores backups and archives WAL segments.
It may be difficult to estimate in advance how much space you'll need. The best thing to do is take some backups then record the size of different types of backups (full/incr/diff) and measure the amount of WAL generated per day. This will give you a general idea of how much space you'll need, though of course requirements will likely change over time as your database evolves.
default: /var/lib/pgbackrest example: --repo1-path=/backup/db/backrest
S3 Repository Bucket Option ( --repo-s3-bucket )
S3 repository bucket.
S3 bucket used to store the repository.
pgBackRest
repositories can be stored in the bucket root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other AWS generated content can also be stored in the bucket.
example: --repo1-s3-bucket=pg-backup
S3 Repository Endpoint Option ( --repo-s3-endpoint )
S3 repository endpoint.
The AWS endpoint should be valid for the selected region.
For custom/test configurations the
repo-storage-ca-file
,
repo-storage-ca-path
,
repo-storage-host
,
repo-storage-port
, and
repo-storage-verify-tls
options may be useful.
example: --repo1-s3-endpoint=s3.amazonaws.com
S3 Repository Key Type Option ( --repo-s3-key-type )
S3 repository key type.
The following types are supported:
- shared - Shared keys
- auto - Automatically retrieve temporary credentials
- web-id - Automatically retrieve web identity credentials
default: shared example: --repo1-s3-key-type=auto
S3 Repository KMS Key ID Option ( --repo-s3-kms-key-id )
S3 repository KMS key.
Setting this option enables S3 server-side encryption using the specified AWS key management service key.
example: --repo1-s3-kms-key-id=bceb4f13-6939-4be3-910d-df54dee817b7
S3 Repository Region Option ( --repo-s3-region )
S3 repository region.
The AWS region where the bucket was created.
example: --repo1-s3-region=us-east-1
S3 Repository Role Option ( --repo-s3-role )
S3 repository role.
The AWS role name (not the full ARN) used to retrieve temporary credentials when
repo-s3-key-type=auto
.
example: --repo1-s3-role=authrole
S3 Repository URI Style Option ( --repo-s3-uri-style )
S3 URI Style.
The following URI styles are supported:
- host - Connect to bucket.endpoint host.
- path - Connect to endpoint host and prepend bucket to URIs.
default: host example: --repo1-s3-uri-style=path
SFTP Repository Host Option ( --repo-sftp-host )
SFTP repository host.
The SFTP host containing the repository.
example: --repo1-sftp-host=sftprepo.domain
SFTP Repository Host Fingerprint Option ( --repo-sftp-host-fingerprint )
SFTP repository host fingerprint.
SFTP repository host fingerprint generation should match the
repo-sftp-host-key-hash-type
. Generate the fingerprint via
awk '{print $2}' ssh_host_xxx_key.pub | base64 -d | (md5sum or sha1sum) -b
. The ssh host keys are normally found in the
/etc/ssh
directory.
example: --repo1-sftp-host-fingerprint=f84e172dfead7aeeeae6c1fdfb5aa8cf
SFTP Host Key Check Type Option ( --repo-sftp-host-key-check-type )
SFTP host key check type.
The following SFTP host key check types are supported:
- strict - pgBackRest will never automatically add host keys to the ~/.ssh/known_hosts file, and refuses to connect to hosts whose host key has changed or is not found in the known hosts files. This option forces the user to manually add all new hosts.
- accept-new - pgBackRest will automatically add new host keys to the user's known hosts file, but will not permit connections to hosts with changed host keys.
- fingerprint - pgBackRest will check the host key against the fingerprint specified by the repo-sftp-host-fingerprint option.
- none - no host key checking will be performed.
default: strict example: --repo1-sftp-host-key-check-type=accept-new
SFTP Repository Host Key Hash Type Option ( --repo-sftp-host-key-hash-type )
SFTP repository host key hash type.
SFTP repository host key hash type. Declares the hash type to be used to compute the digest of the remote system's host key on SSH startup. Newer versions of
libssh2
support
sha256
in addition to md5 and sha1.
example: --repo1-sftp-host-key-hash-type=sha256
SFTP Repository Host Port Option ( --repo-sftp-host-port )
SFTP repository host port.
SFTP repository host port.
default: 22 allowed: 1-65535 example: --repo1-sftp-host-port=22
SFTP Repository Host User Option ( --repo-sftp-host-user )
SFTP repository host user.
User on the host used to store the repository.
example: --repo1-sftp-host-user=pg-backup
SFTP Known Hosts File Option ( --repo-sftp-known-host )
SFTP known hosts file.
A known hosts file to search for an SFTP host match during authentication. When unspecified,
pgBackRest
will default to searching
~/.ssh/known_hosts
,
~/.ssh/known_hosts2
,
/etc/ssh/ssh_known_hosts
, and
/etc/ssh/ssh_known_hosts2
. If configured with one or more file paths,
pgBackRest
will search those for a match. File paths must be full or leading tilde paths. The
repo-sftp-known-host
option can be passed multiple times to specify more than one known hosts file to search. To utilize known hosts file checking
repo-sftp-host-fingerprint
must not be specified. See also
repo-sftp-host-check-type
option.
example: --repo1-sftp-known-host=/home/postgres/.ssh/known_hosts
SFTP Repository Private Key File Option ( --repo-sftp-private-key-file )
SFTP private key file.
SFTP private key file used for authentication.
example: --repo1-sftp-private-key-file=~/.ssh/id_ed25519
SFTP Repository Public Key File Option ( --repo-sftp-public-key-file )
SFTP public key file.
SFTP public key file used for authentication. Optional if compiled against OpenSSL, required if compiled against a different library.
example: --repo1-sftp-public-key-file=~/.ssh/id_ed25519.pub
Repository Storage CA File Option ( --repo-storage-ca-file )
Repository storage CA file.
Use a CA file other than the system default for storage (e.g. S3, Azure) certificates.
example: --repo1-storage-ca-file=/etc/pki/tls/certs/ca-bundle.crt
Deprecated Names: repo-azure-ca-file, repo-s3-ca-file
Repository Storage TLS CA Path Option ( --repo-storage-ca-path )
Repository storage CA path.
Use a CA path other than the system default for storage (e.g. S3, Azure) certificates.
example: --repo1-storage-ca-path=/etc/pki/tls/certs
Deprecated Names: repo-azure-ca-path, repo-s3-ca-path
Repository Storage Host Option ( --repo-storage-host )
Repository storage host.
Connect to a host other than the storage (e.g. S3, Azure) endpoint. This is typically used for testing.
example: --repo1-storage-host=127.0.0.1
Deprecated Names: repo-azure-host, repo-s3-host
Repository Storage Port Option ( --repo-storage-port )
Repository storage port.
Port to use when connecting to the storage (e.g. S3, Azure) endpoint (or host if specified).
default: 443 allowed: 1-65535 example: --repo1-storage-port=9000
Deprecated Names: repo-azure-port, repo-s3-port
Repository Storage Tag Option ( --repo-storage-tag )
Repository storage tag(s).
Specify tags that will be added to objects when the repository is an object store (e.g. S3). The option can be repeated to add multiple tags.
There is no provision in
pgBackRest
to modify these tags so be sure to set them correctly before running
stanza-create
to ensure uniform tags across the entire repository.
example: --repo1-storage-tag=key1=value1
Repository Storage Upload Chunk Size Option ( --repo-storage-upload-chunk-size )
Repository storage upload chunk size.
Object stores such as S3 allow files to be uploaded in chunks when the file is too large to be stored in memory. Even if the file can be stored in memory, it is more memory efficient to limit the amount of memory used for uploads.
A larger chunk size will generally lead to better performance because it will minimize upload requests and allow more files to be uploaded in a single request rather than in chunks. The disadvantage is that memory usage will be higher and because the chunk buffer must be allocated per process, larger
process-max
values will lead to more memory being consumed overall.
Default chunk sizes by repo type:
- azure - 4MiB
- gcs - 4MiB
- s3 - 5MiB
Note that valid chunk sizes vary by storage type and by platform. For example,
AWS S3
has a minimum chunk size of 5MiB but
S3
clones may accept lower values. Terminology for chunk size varies by storage type, so when searching min/max values use
part sizefor AWS S3 ,
chunk sizefor GCS , and
block sizefor Azure . No attempt is made to validate configured chunk sizes so selecting an invalid value will lead to errors from the storage service or undefined behavior.
allowed: 64KiB-1TiB example: --repo1-storage-upload-chunk-size=16MiB
Repository Storage Certificate Verify Option ( --repo-storage-verify-tls )
Repository storage certificate verify.
This option provides the ability to enable/disable verification of the storage (e.g. S3, Azure) server TLS certificate. Disabling should only be used for testing or other scenarios where a certificate has been self-signed.
default: y example: --no-repo1-storage-verify-tls
Deprecated Names: repo-azure-verify-tls, repo-s3-verify-ssl, repo-s3-verify-tls
Repository Type Option ( --repo-type )
Type of storage used for the repository.
The following repository types are supported:
- azure - Azure Blob Storage Service
- cifs - Like posix , but disables links and directory fsyncs
- gcs - Google Cloud Storage
- posix - Posix-compliant file systems
- s3 - AWS Simple Storage Service
- sftp - Secure File Transfer Protocol
When an
NFS
mount is used as a
posix
repository, the same rules apply to
pgBackRest
as described in the
PostgreSQL
documentation:
Creating a Database Cluster - File Systems
.
default: posix example: --repo1-type=cifs
Stanza Options
PostgreSQL Path Option ( --pg-path )
PostgreSQL
data directory.
This should be the same as the
data_directory
setting in
postgresql.conf
. Even though this value can be read from
postgresql.conf
or
PostgreSQL
it is prudent to set it in case those resources are not available during a restore or offline backup scenario.
The
pg-path
option is tested against the value reported by
PostgreSQL
on every online backup so it should always be current.
example: --pg1-path=/data/db
Deprecated Name: db-path
Archive Push Command ( archive-push )
Accepts a WAL segment from
PostgreSQL
and archives it in each repository defined by the indexed
repo-path
option (see the
Repository
section for information on configuring repositories). The WAL segment may be pushed immediately to the archive or stored locally depending on the value of
archive-async
. With multiple repositories configured,
archive-push
will attempt to push to as many repositories as possible.
The
archive-push
is intended to be configured and called by
PostgreSQL
. See
Configure Archiving
for an example.
Command Options
Asynchronous Archiving Option ( --archive-async )
Push/get WAL segments asynchronously.
Enables asynchronous operation for the
archive-push
and
archive-get
commands.
Asynchronous operation is more efficient because it can reuse connections and take advantage of parallelism. See the
spool-path
,
archive-get-queue-max
, and
archive-push-queue-max
options for more information.
default: n example: --archive-async
Check Archive Option ( --archive-check )
Check that WAL segments are in the archive before backup completes.
Checks that all WAL segments required to make the backup consistent are present in the WAL archive. It's a good idea to leave this as the default unless you are using another method for archiving.
This option must be enabled if
archive-copy
is enabled.
default: y example: --no-archive-check
Check Archive Mode Option ( --archive-mode-check )
Check the
PostgreSQL
archive_mode
setting.
Enabled by default, this option disallows
PostgreSQL
archive_mode=always
.
WAL segments pushed from a standby server might be logically the same as WAL segments pushed from the primary but have different checksums. Disabling archiving from multiple sources is recommended to avoid conflicts.
CAUTION:
If this option is disabled then it is critical to ensure that only one archiver is writing to the repository via the
archive-push
command.
default: y example: --no-archive-mode-check
Maximum Archive Push Queue Size Option ( --archive-push-queue-max )
Maximum size of the
PostgreSQL
archive queue.
After the limit is reached, the following will happen:
- pgBackRest will notify PostgreSQL that the WAL was successfully archived, then DROP IT .
- A warning will be output to the PostgreSQL log.
If this occurs then the archive log stream will be interrupted and PITR will not be possible past that point. A new backup will be required to regain full restore capability.
In asynchronous mode the entire queue will be dropped to prevent spurts of WAL getting through before the queue limit is exceeded again.
The purpose of this feature is to prevent the log volume from filling up at which point
PostgreSQL
will stop completely. Better to lose the backup than have
PostgreSQL
go down.
allowed: 0B-4PiB example: --archive-push-queue-max=1TiB
Deprecated Name: archive-queue-max
Archive Timeout Option ( --archive-timeout )
Archive timeout.
Set maximum time, in seconds, to wait for each WAL segment to reach the
pgBackRest
archive repository. The timeout applies to the
check
and
backup
commands when waiting for WAL segments required for backup consistency to be archived.
default: 1m allowed: 100ms-1d example: --archive-timeout=30
General Options
Buffer Size Option ( --buffer-size )
Buffer size for I/O operations.
Buffer size used for copy, compress, encrypt, and other operations. The number of buffers used depends on options and each operation may use additional memory, e.g.
gz
compression may use an additional 256KiB of memory.
Allowed values are
16KiB
,
32KiB
,
64KiB
,
128KiB
,
256KiB
,
512KiB
,
1MiB
,
2MiB
,
4MiB
,
8MiB
, and
16MiB
.
default: 1MiB example: --buffer-size=2MiB
pgBackRest Command Option ( --cmd )
pgBackRest
command.
pgBackRest
may generate a command string, e.g. when the
restore
command generates the
restore_command
setting. The command used to run the
pgBackRest
process will be used in this case unless the
cmd
option is provided.
CAUTION:
Wrapping the
pgBackRest
command may cause unpredictable behavior and is not recommended.
example: --cmd=/var/lib/pgsql/bin/pgbackrest_wrapper.sh
SSH Client Command Option ( --cmd-ssh )
SSH client command.
Use a specific SSH client command when an alternate is desired or the
ssh
command is not in $PATH.
default: ssh example: --cmd-ssh=/usr/bin/ssh
Compress Option ( --compress )
Use file compression.
Backup files are compatible with command-line compression tools.
This option is now deprecated. The
compress-type
option should be used instead.
default: y example: --no-compress
Compress Level Option ( --compress-level )
File compression level.
Sets the level to be used for file compression when
compress-type
does not equal
none
or
compress=y
(deprecated).
The following are the defaults levels based on
compress-type
when
compress-level
is not specified:
- bz2 - 9
- gz - 6
- lz4 - 1
- zst - 3
example: --compress-level=9
Network Compress Level Option ( --compress-level-network )
Network compression level.
Sets the network compression level when
compress-type=none
and the command is not run on the same host as the repository. Compression is used to reduce network traffic but can be disabled by setting
compress-level-network=0
. When
compress-type
does not equal
none
the
compress-level-network
setting is ignored and
compress-level
is used instead so that the file is only compressed once.
default: 3 allowed: 0-9 example: --compress-level-network=1
Compress Type Option ( --compress-type )
File compression type.
The following compression types are supported:
- none - no compression
- bz2 - bzip2 compression format
- gz - gzip compression format
- lz4 - lz4 compression format (not available on all platforms)
- zst - Zstandard compression format (not available on all platforms)
default: gz example: --compress-type=none
Config Option ( --config )
pgBackRest
configuration file.
Use this option to specify a different configuration file than the default.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_FILE example: --config=/conf/pgbackrest/pgbackrest.conf
Config Include Path Option ( --config-include-path )
Path to additional
pgBackRest
configuration files.
Configuration files existing in the specified location with extension
.conf
will be concatenated with the
pgBackRest
configuration file, resulting in one configuration file.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_INCLUDE_PATH example: --config-include-path=/conf/pgbackrest/conf.d
Config Path Option ( --config-path )
Base path of
pgBackRest
configuration files.
This setting is used to override the default base path setting for the
--config
and
--config-include-path
options unless they are explicitly set on the command-line.
For example, passing only
--config-path=/conf/pgbackrest
results in the
--config
default being set to
/conf/pgbackrest/pgbackrest.conf
and the
--config-include-path
default being set to
/conf/pgbackrest/conf.d
.
default: CFGOPTDEF_CONFIG_PATH example: --config-path=/conf/pgbackrest
Database Timeout Option ( --db-timeout )
Database query timeout.
Sets the timeout, in seconds, for queries against the database. This includes the backup start/stop functions which can each take a substantial amount of time. Because of this the timeout should be kept high unless you know that these functions will return quickly (i.e. if you have set
start-fast=y
and you know that the database cluster will not generate many WAL segments during the backup).
NOTE:
The
db-timeout
option must be less than the
protocol-timeout
option.
default: 30m allowed: 100ms-7d example: --db-timeout=600
I/O Timeout Option ( --io-timeout )
I/O timeout.
Timeout, in seconds, used for connections and read/write operations.
Note that the entire read/write operation does not need to complete within this timeout but
some
progress must be made, even if it is only a single byte.
default: 1m allowed: 100ms-1h example: --io-timeout=120
Lock Path Option ( --lock-path )
Path where lock files are stored.
The lock path provides a location for
pgBackRest
to create lock files to prevent conflicting operations from being run concurrently.
default: /tmp/pgbackrest example: --lock-path=/backup/db/lock
Neutral Umask Option ( --neutral-umask )
Use a neutral umask.
Sets the umask to 0000 so modes in the repository are created in a sensible way. The default directory mode is 0750 and default file mode is 0640. The lock and log directories set the directory and file mode to 0770 and 0660 respectively.
To use the executing user's umask instead specify
neutral-umask=n
in the config file or
--no-neutral-umask
on the command line.
default: y example: --no-neutral-umask
Process Maximum Option ( --process-max )
Max processes to use for compress/transfer.
Each process will perform compression and transfer to make the command run faster, but don't set
process-max
so high that it impacts database performance.
default: 1 allowed: 1-999 example: --process-max=4
Protocol Timeout Option ( --protocol-timeout )
Protocol timeout.
Sets the timeout, in seconds, that the local or remote process will wait for a new message to be received on the protocol layer. This prevents processes from waiting indefinitely for a message.
NOTE:
The
protocol-timeout
option must be greater than the
db-timeout
option.
default: 31m allowed: 100ms-7d example: --protocol-timeout=630
Keep Alive Option ( --sck-keep-alive )
Keep-alive enable.
Enables keep-alive messages on socket connections.
default: y example: --no-sck-keep-alive
Spool Path Option ( --spool-path )
Path where transient data is stored.
This path is used to store data for the asynchronous
archive-push
and
archive-get
command.
The asynchronous
archive-push
command writes acknowledgements into the spool path when it has successfully stored WAL in the archive (and errors on failure) so the foreground process can quickly notify
PostgreSQL
. Acknowledgement files are very small (zero on success and a few hundred bytes on error).
The asynchronous
archive-get
command queues WAL in the spool path so it can be provided very quickly when
PostgreSQL
requests it. Moving files to
PostgreSQL
is most efficient when the spool path is on the same filesystem as
pg_xlog
/
pg_wal
.
The data stored in the spool path is not strictly temporary since it can and should survive a reboot. However, loss of the data in the spool path is not a problem.
pgBackRest
will simply recheck each WAL segment to ensure it is safely archived for
archive-push
and rebuild the queue for
archive-get
.
The spool path is intended to be located on a local Posix-compatible filesystem, not a remote filesystem such as
NFS
or
CIFS
.
default: /var/spool/pgbackrest example: --spool-path=/backup/db/spool
Stanza Option ( --stanza )
Defines the stanza.
A stanza is the configuration for a
PostgreSQL
database cluster that defines where it is located, how it will be backed up, archiving options, etc. Most db servers will only have one
PostgreSQL
database cluster and therefore one stanza, whereas backup servers will have a stanza for every database cluster that needs to be backed up.
It is tempting to name the stanza after the primary cluster but a better name describes the databases contained in the cluster. Because the stanza name will be used for the primary and all replicas it is more appropriate to choose a name that describes the actual function of the cluster, such as app or dw, rather than the local cluster name, such as main or prod.
example: --stanza=main
Keep Alive Count Option ( --tcp-keep-alive-count )
Keep-alive count.
Specifies the number of TCP keep-alive messages that can be lost before the connection is considered dead.
This option is available on systems that support the
TCP_KEEPCNT
socket option.
allowed: 1-32 example: --tcp-keep-alive-count=3
Keep Alive Idle Option ( --tcp-keep-alive-idle )
Keep-alive idle time.
Specifies the amount of time (in seconds) with no network activity after which the operating system should send a TCP keep-alive message.
This option is available on systems that support the
TCP_KEEPIDLE
socket option.
allowed: 1-3600 example: --tcp-keep-alive-idle=60
Keep Alive Interval Option ( --tcp-keep-alive-interval )
Keep-alive interval time.
Specifies the amount of time (in seconds) after which a TCP keep-alive message that has not been acknowledged should be retransmitted.
This option is available on systems that support the
TCP_KEEPINTVL
socket option.
allowed: 1-900 example: --tcp-keep-alive-interval=30
Log Options
Console Log Level Option ( --log-level-console )
Level for console logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: warn example: --log-level-console=error
File Log Level Option ( --log-level-file )
Level for file logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: info example: --log-level-file=debug
Std Error Log Level Option ( --log-level-stderr )
Level for stderr logging.
Specifies which log levels will output to
stderr
rather than
stdout
(specified by
log-level-console
). The timestamp and process will not be output to
stderr
.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: off example: --log-level-stderr=error
Log Path Option ( --log-path )
Path where log files are stored.
The log path provides a location for
pgBackRest
to store log files. Note that if
log-level-file=off
then no log path is required.
default: /var/log/pgbackrest example: --log-path=/backup/db/log
Maintainer Options
Check WAL Headers Option ( --archive-header-check )
Check PostgreSQL version/id in WAL headers.
Enabled by default, this option checks the WAL header against the
PostgreSQL
version and system identifier to ensure that the WAL is being copied to the correct stanza. This is in addition to checking
pg_control
against the stanza and verifying that WAL is being copied from the same
PostgreSQL
data directory where
pg_control
is located.
Therefore, disabling this check is fairly safe but should only be done when needed, e.g. if the WAL is encrypted.
default: y example: --no-archive-header-check
Force PostgreSQL Version Option ( --pg-version-force )
Force
PostgreSQL
version.
The specified
PostgreSQL
version will be used instead of the version automatically detected by reading
pg_control
or WAL headers. This is mainly useful for
PostgreSQL
forks or development versions where those values are different from the release version. The version reported by
PostgreSQL
via `server_version_num` must match the forced version.
WARNING:
Be cautious when using this option because
pg_control
and WAL headers will still be read with the expected format for the specified version, i.e. the format from the official open-source version of
PostgreSQL
. If the fork or development version changes the format of the fields that
pgBackRest
depends on it will lead to unexpected behavior. In general, this option will only work as expected if the fork adds all custom struct members
after
the standard
PostgreSQL
members.
example: --pg-version-force=15
Repository Options
Azure Repository Container Option ( --repo-azure-container )
Azure repository container.
Azure container used to store the repository.
pgBackRest
repositories can be stored in the container root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other Azure-generated content can also be stored in the container.
example: --repo1-azure-container=pg-backup
Azure Repository Key Type Option ( --repo-azure-key-type )
Azure repository key type.
The following types are supported for authorization:
- shared - Shared key
- sas - Shared access signature
default: shared example: --repo1-azure-key-type=sas
Azure Repository URI Style Option ( --repo-azure-uri-style )
Azure URI Style.
The following URI styles are supported:
- host - Connect to account.endpoint host.
- path - Connect to endpoint host and prepend account to URIs.
default: host example: --repo1-azure-uri-style=path
Repository Cipher Type Option ( --repo-cipher-type )
Cipher used to encrypt the repository.
The following cipher types are supported:
- none - The repository is not encrypted
- aes-256-cbc - Advanced Encryption Standard with 256 bit key length
Note that encryption is always performed client-side even if the repository type (e.g. S3) supports encryption.
default: none example: --repo1-cipher-type=aes-256-cbc
GCS Repository Bucket Option ( --repo-gcs-bucket )
GCS repository bucket.
GCS bucket used to store the repository.
pgBackRest
repositories can be stored in the bucket root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other GCS-generated content can also be stored in the bucket.
example: --repo1-gcs-bucket=/pg-backup
GCS Repository Endpoint Option ( --repo-gcs-endpoint )
GCS repository endpoint.
Endpoint used to connect to the storage service. May be updated to use a local GCS server or alternate endpoint.
default: storage.googleapis.com example: --repo1-gcs-endpoint=localhost
GCS Repository Key Type Option ( --repo-gcs-key-type )
GCS repository key type.
The following types are supported for authorization:
- auto - Authorize using the instance service account.
- service - Service account from locally stored key.
- token - For local testing, e.g. fakegcs .
When
repo-gcs-key-type=service
the credentials will be reloaded when the authentication token is renewed.
default: service example: --repo1-gcs-key-type=auto
Repository Host Option ( --repo-host )
Repository host when operating remotely.
When backing up and archiving to a locally mounted filesystem this setting is not required.
example: --repo1-host=repo1.domain.com
Deprecated Name: backup-host
Repository Host Certificate Authority File Option ( --repo-host-ca-file )
Repository host certificate authority file.
Use a CA file other than the system default for connecting to the repository host.
example: --repo1-host-ca-file=/etc/pki/tls/certs/ca-bundle.crt
Repository Host Certificate Authority Path Option ( --repo-host-ca-path )
Repository host certificate authority path.
Use a CA path other than the system default for connecting to the repository host.
example: --repo1-host-ca-path=/etc/pki/tls/certs
Repository Host Certificate File Option ( --repo-host-cert-file )
Repository host certificate file.
Sent to repository host to prove client identity.
example: --repo1-host-cert-file=/path/to/client.crt
Repository Host Command Option ( --repo-host-cmd )
Repository host
pgBackRest
command.
Required only if the path to the
pgBackRest
command is different on the local and repository hosts. If not defined, the repository host command will be set the same as the local command.
example: --repo1-host-cmd=/usr/lib/backrest/bin/pgbackrest
Deprecated Name: backup-cmd
Repository Host Configuration Option ( --repo-host-config )
pgBackRest
repository host configuration file.
Sets the location of the configuration file on the repository host. This is only required if the repository host configuration file is in a different location than the local configuration file.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_FILE example: --repo1-host-config=/conf/pgbackrest/pgbackrest.conf
Deprecated Name: backup-config
Repository Host Configuration Include Path Option ( --repo-host-config-include-path )
pgBackRest
repository host configuration include path.
Sets the location of the configuration include path on the repository host. This is only required if the repository host configuration include path is in a different location than the local configuration include path.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_INCLUDE_PATH example: --repo1-host-config-include-path=/conf/pgbackrest/conf.d
Repository Host Configuration Path Option ( --repo-host-config-path )
pgBackRest
repository host configuration path.
Sets the location of the configuration path on the repository host. This is only required if the repository host configuration path is in a different location than the local configuration path.
default: CFGOPTDEF_CONFIG_PATH example: --repo1-host-config-path=/conf/pgbackrest
Repository Host Key File Option ( --repo-host-key-file )
Repository host key file.
Proves client certificate was sent by owner.
example: --repo1-host-key-file=/path/to/client.key
Repository Host Port Option ( --repo-host-port )
Repository host port when
repo-host
is set.
Use this option to specify a non-default port for the repository host protocol.
allowed: 0-65535 example: --repo1-host-port=25
Deprecated Name: backup-ssh-port
Repository Host Protocol Type Option ( --repo-host-type )
Repository host protocol type.
The following protocol types are supported:
- ssh - Secure Shell.
- tls - pgBackRest TLS server.
default: ssh example: --repo1-host-type=tls
Repository Host User Option ( --repo-host-user )
Repository host user when
repo-host
is set.
Defines the user that will be used for operations on the repository host. Preferably this is not the
postgres
user but rather some other user like
pgbackrest
. If
PostgreSQL
runs on the repository host the
postgres
user can be placed in the
pgbackrest
group so it has read permissions on the repository without being able to damage the contents accidentally.
default: pgbackrest example: --repo1-host-user=repo-user
Deprecated Name: backup-user
Repository Path Option ( --repo-path )
Path where backups and archive are stored.
The repository is where
pgBackRest
stores backups and archives WAL segments.
It may be difficult to estimate in advance how much space you'll need. The best thing to do is take some backups then record the size of different types of backups (full/incr/diff) and measure the amount of WAL generated per day. This will give you a general idea of how much space you'll need, though of course requirements will likely change over time as your database evolves.
default: /var/lib/pgbackrest example: --repo1-path=/backup/db/backrest
S3 Repository Bucket Option ( --repo-s3-bucket )
S3 repository bucket.
S3 bucket used to store the repository.
pgBackRest
repositories can be stored in the bucket root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other AWS generated content can also be stored in the bucket.
example: --repo1-s3-bucket=pg-backup
S3 Repository Endpoint Option ( --repo-s3-endpoint )
S3 repository endpoint.
The AWS endpoint should be valid for the selected region.
For custom/test configurations the
repo-storage-ca-file
,
repo-storage-ca-path
,
repo-storage-host
,
repo-storage-port
, and
repo-storage-verify-tls
options may be useful.
example: --repo1-s3-endpoint=s3.amazonaws.com
S3 Repository Key Type Option ( --repo-s3-key-type )
S3 repository key type.
The following types are supported:
- shared - Shared keys
- auto - Automatically retrieve temporary credentials
- web-id - Automatically retrieve web identity credentials
default: shared example: --repo1-s3-key-type=auto
S3 Repository KMS Key ID Option ( --repo-s3-kms-key-id )
S3 repository KMS key.
Setting this option enables S3 server-side encryption using the specified AWS key management service key.
example: --repo1-s3-kms-key-id=bceb4f13-6939-4be3-910d-df54dee817b7
S3 Repository Region Option ( --repo-s3-region )
S3 repository region.
The AWS region where the bucket was created.
example: --repo1-s3-region=us-east-1
S3 Repository Role Option ( --repo-s3-role )
S3 repository role.
The AWS role name (not the full ARN) used to retrieve temporary credentials when
repo-s3-key-type=auto
.
example: --repo1-s3-role=authrole
S3 Repository URI Style Option ( --repo-s3-uri-style )
S3 URI Style.
The following URI styles are supported:
- host - Connect to bucket.endpoint host.
- path - Connect to endpoint host and prepend bucket to URIs.
default: host example: --repo1-s3-uri-style=path
SFTP Repository Host Option ( --repo-sftp-host )
SFTP repository host.
The SFTP host containing the repository.
example: --repo1-sftp-host=sftprepo.domain
SFTP Repository Host Fingerprint Option ( --repo-sftp-host-fingerprint )
SFTP repository host fingerprint.
SFTP repository host fingerprint generation should match the
repo-sftp-host-key-hash-type
. Generate the fingerprint via
awk '{print $2}' ssh_host_xxx_key.pub | base64 -d | (md5sum or sha1sum) -b
. The ssh host keys are normally found in the
/etc/ssh
directory.
example: --repo1-sftp-host-fingerprint=f84e172dfead7aeeeae6c1fdfb5aa8cf
SFTP Host Key Check Type Option ( --repo-sftp-host-key-check-type )
SFTP host key check type.
The following SFTP host key check types are supported:
- strict - pgBackRest will never automatically add host keys to the ~/.ssh/known_hosts file, and refuses to connect to hosts whose host key has changed or is not found in the known hosts files. This option forces the user to manually add all new hosts.
- accept-new - pgBackRest will automatically add new host keys to the user's known hosts file, but will not permit connections to hosts with changed host keys.
- fingerprint - pgBackRest will check the host key against the fingerprint specified by the repo-sftp-host-fingerprint option.
- none - no host key checking will be performed.
default: strict example: --repo1-sftp-host-key-check-type=accept-new
SFTP Repository Host Key Hash Type Option ( --repo-sftp-host-key-hash-type )
SFTP repository host key hash type.
SFTP repository host key hash type. Declares the hash type to be used to compute the digest of the remote system's host key on SSH startup. Newer versions of
libssh2
support
sha256
in addition to md5 and sha1.
example: --repo1-sftp-host-key-hash-type=sha256
SFTP Repository Host Port Option ( --repo-sftp-host-port )
SFTP repository host port.
SFTP repository host port.
default: 22 allowed: 1-65535 example: --repo1-sftp-host-port=22
SFTP Repository Host User Option ( --repo-sftp-host-user )
SFTP repository host user.
User on the host used to store the repository.
example: --repo1-sftp-host-user=pg-backup
SFTP Known Hosts File Option ( --repo-sftp-known-host )
SFTP known hosts file.
A known hosts file to search for an SFTP host match during authentication. When unspecified,
pgBackRest
will default to searching
~/.ssh/known_hosts
,
~/.ssh/known_hosts2
,
/etc/ssh/ssh_known_hosts
, and
/etc/ssh/ssh_known_hosts2
. If configured with one or more file paths,
pgBackRest
will search those for a match. File paths must be full or leading tilde paths. The
repo-sftp-known-host
option can be passed multiple times to specify more than one known hosts file to search. To utilize known hosts file checking
repo-sftp-host-fingerprint
must not be specified. See also
repo-sftp-host-check-type
option.
example: --repo1-sftp-known-host=/home/postgres/.ssh/known_hosts
SFTP Repository Private Key File Option ( --repo-sftp-private-key-file )
SFTP private key file.
SFTP private key file used for authentication.
example: --repo1-sftp-private-key-file=~/.ssh/id_ed25519
SFTP Repository Public Key File Option ( --repo-sftp-public-key-file )
SFTP public key file.
SFTP public key file used for authentication. Optional if compiled against OpenSSL, required if compiled against a different library.
example: --repo1-sftp-public-key-file=~/.ssh/id_ed25519.pub
Repository Storage CA File Option ( --repo-storage-ca-file )
Repository storage CA file.
Use a CA file other than the system default for storage (e.g. S3, Azure) certificates.
example: --repo1-storage-ca-file=/etc/pki/tls/certs/ca-bundle.crt
Deprecated Names: repo-azure-ca-file, repo-s3-ca-file
Repository Storage TLS CA Path Option ( --repo-storage-ca-path )
Repository storage CA path.
Use a CA path other than the system default for storage (e.g. S3, Azure) certificates.
example: --repo1-storage-ca-path=/etc/pki/tls/certs
Deprecated Names: repo-azure-ca-path, repo-s3-ca-path
Repository Storage Host Option ( --repo-storage-host )
Repository storage host.
Connect to a host other than the storage (e.g. S3, Azure) endpoint. This is typically used for testing.
example: --repo1-storage-host=127.0.0.1
Deprecated Names: repo-azure-host, repo-s3-host
Repository Storage Port Option ( --repo-storage-port )
Repository storage port.
Port to use when connecting to the storage (e.g. S3, Azure) endpoint (or host if specified).
default: 443 allowed: 1-65535 example: --repo1-storage-port=9000
Deprecated Names: repo-azure-port, repo-s3-port
Repository Storage Tag Option ( --repo-storage-tag )
Repository storage tag(s).
Specify tags that will be added to objects when the repository is an object store (e.g. S3). The option can be repeated to add multiple tags.
There is no provision in
pgBackRest
to modify these tags so be sure to set them correctly before running
stanza-create
to ensure uniform tags across the entire repository.
example: --repo1-storage-tag=key1=value1
Repository Storage Upload Chunk Size Option ( --repo-storage-upload-chunk-size )
Repository storage upload chunk size.
Object stores such as S3 allow files to be uploaded in chunks when the file is too large to be stored in memory. Even if the file can be stored in memory, it is more memory efficient to limit the amount of memory used for uploads.
A larger chunk size will generally lead to better performance because it will minimize upload requests and allow more files to be uploaded in a single request rather than in chunks. The disadvantage is that memory usage will be higher and because the chunk buffer must be allocated per process, larger
process-max
values will lead to more memory being consumed overall.
Default chunk sizes by repo type:
- azure - 4MiB
- gcs - 4MiB
- s3 - 5MiB
Note that valid chunk sizes vary by storage type and by platform. For example,
AWS S3
has a minimum chunk size of 5MiB but
S3
clones may accept lower values. Terminology for chunk size varies by storage type, so when searching min/max values use
part sizefor AWS S3 ,
chunk sizefor GCS , and
block sizefor Azure . No attempt is made to validate configured chunk sizes so selecting an invalid value will lead to errors from the storage service or undefined behavior.
allowed: 64KiB-1TiB example: --repo1-storage-upload-chunk-size=16MiB
Repository Storage Certificate Verify Option ( --repo-storage-verify-tls )
Repository storage certificate verify.
This option provides the ability to enable/disable verification of the storage (e.g. S3, Azure) server TLS certificate. Disabling should only be used for testing or other scenarios where a certificate has been self-signed.
default: y example: --no-repo1-storage-verify-tls
Deprecated Names: repo-azure-verify-tls, repo-s3-verify-ssl, repo-s3-verify-tls
Repository Type Option ( --repo-type )
Type of storage used for the repository.
The following repository types are supported:
- azure - Azure Blob Storage Service
- cifs - Like posix , but disables links and directory fsyncs
- gcs - Google Cloud Storage
- posix - Posix-compliant file systems
- s3 - AWS Simple Storage Service
- sftp - Secure File Transfer Protocol
When an
NFS
mount is used as a
posix
repository, the same rules apply to
pgBackRest
as described in the
PostgreSQL
documentation:
Creating a Database Cluster - File Systems
.
default: posix example: --repo1-type=cifs
Stanza Options
PostgreSQL Path Option ( --pg-path )
PostgreSQL
data directory.
This should be the same as the
data_directory
setting in
postgresql.conf
. Even though this value can be read from
postgresql.conf
or
PostgreSQL
it is prudent to set it in case those resources are not available during a restore or offline backup scenario.
The
pg-path
option is tested against the value reported by
PostgreSQL
on every online backup so it should always be current.
example: --pg1-path=/data/db
Deprecated Name: db-path
Backup Command ( backup )
When multiple repositories are configured,
pgBackRest
will backup to the highest priority repository (e.g.
repo1
) unless the
--repo
option is specified.
pgBackRest
does not have a built-in scheduler so it's best to run it from cron or some other scheduling mechanism.
See
Perform a Backup
for more details and examples.
Command Options
Backup Annotation Option ( --annotation )
Annotate backup with user-defined key/value pairs.
Users can attach informative key/value pairs to the backup. This option may be used multiple times to attach multiple annotations.
Annotations are output by the
info
command text output when a backup is specified with
--set
and always appear in the JSON output.
example: --annotation=source="Sunday backup for website database"
Check Archive Option ( --archive-check )
Check that WAL segments are in the archive before backup completes.
Checks that all WAL segments required to make the backup consistent are present in the WAL archive. It's a good idea to leave this as the default unless you are using another method for archiving.
This option must be enabled if
archive-copy
is enabled.
default: y example: --no-archive-check
Copy Archive Option ( --archive-copy )
Copy WAL segments needed for consistency to the backup.
This slightly paranoid option protects against corruption in the WAL segment archive by storing the WAL segments required for consistency directly in the backup. WAL segments are still stored in the archive so this option will use additional space.
It is best if the
archive-push
and
backup
commands have the same
compress-type
(e.g.
lz4
) when using this option. Otherwise, the WAL segments will need to be recompressed with the
compress-type
used by the backup, which can be fairly expensive depending on how much WAL was generated during the backup.
On restore, the WAL segments will be present in
pg_xlog/pg_wal
and
PostgreSQL
will use them in preference to calling the
restore_command
.
The
archive-check
option must be enabled if
archive-copy
is enabled.
default: n example: --archive-copy
Check Archive Mode Option ( --archive-mode-check )
Check the
PostgreSQL
archive_mode
setting.
Enabled by default, this option disallows
PostgreSQL
archive_mode=always
.
WAL segments pushed from a standby server might be logically the same as WAL segments pushed from the primary but have different checksums. Disabling archiving from multiple sources is recommended to avoid conflicts.
CAUTION:
If this option is disabled then it is critical to ensure that only one archiver is writing to the repository via the
archive-push
command.
default: y example: --no-archive-mode-check
Archive Timeout Option ( --archive-timeout )
Archive timeout.
Set maximum time, in seconds, to wait for each WAL segment to reach the
pgBackRest
archive repository. The timeout applies to the
check
and
backup
commands when waiting for WAL segments required for backup consistency to be archived.
default: 1m allowed: 100ms-1d example: --archive-timeout=30
Backup from Standby Option ( --backup-standby )
Backup from the standby cluster.
Enable backup from standby to reduce load on the primary cluster. This option requires that both the
primary
and
standby
hosts be configured.
default: n example: --backup-standby
Page Checksums Option ( --checksum-page )
Validate data page checksums.
Directs
pgBackRest
to validate all data page checksums while backing up a cluster. This option is automatically enabled when data page checksums are enabled on the cluster.
Failures in checksum validation will not abort a backup. Rather, warnings will be emitted in the log (and to the console with default settings) and the list of invalid pages will be stored in the backup manifest.
example: --no-checksum-page
Path/File Exclusions Option ( --exclude )
Exclude paths/files from the backup.
All exclusions are relative to
$PGDATA
. If the exclusion ends with / then only files in the specified directory will be excluded, e.g.
--exclude=junk/
will exclude all files in the
$PGDATA/junk
directory but include the directory itself. If the exclusion does not end with / then the file may match the exclusion exactly or match with / appended to the exclusion, e.g.
--exclude=junk
will exclude the
$PGDATA/junk
directory and all the files it contains.
Be careful using this feature -- it is very easy to exclude something critical that will make the backup inconsistent. Be sure to test your restores!
All excluded files will be logged at
info
level along with the exclusion rule. Be sure to audit the list of excluded files to ensure nothing unexpected is being excluded.
NOTE:
Exclusions are not honored on delta restores. Any files/directories that were excluded by the backup will be
removed
on delta restore.
This option should not be used to exclude
PostgreSQL
logs from a backup. Logs can be moved out of the
PGDATA
directory using the
PostgreSQL
log_directory
setting, which has the benefit of allowing logs to be preserved after a restore.
Multiple exclusions may be specified on the command-line or in a configuration file.
example: --exclude=junk/
Expire Auto Option ( --expire-auto )
Automatically run the
expire
command after a successful backup.
The setting is enabled by default. Use caution when disabling this option as doing so will result in retaining all backups and archives indefinitely, which could cause your repository to run out of space. The
expire
command will need to be run regularly to prevent this from happening.
default: y example: --expire-auto
Force Option ( --force )
Force an offline backup.
When used with
--no-start-stop
a backup will be run even if
pgBackRest
thinks that
PostgreSQL
is running.
This option should be used with extreme care as it will likely result in a bad backup.
There are some scenarios where a backup might still be desirable under these conditions. For example, if a server crashes and the database cluster volume can only be mounted read-only, it would be a good idea to take a backup even if
postmaster.pid
is present. In this case it would be better to revert to the prior backup and replay WAL, but possibly there is a very important transaction in a WAL segment that did not get archived.
default: n example: --force
Manifest Save Threshold Option ( --manifest-save-threshold )
Manifest save threshold during backup.
Defines how often the manifest will be saved during a backup. Saving the manifest is important because it stores the checksums and allows the resume function to work efficiently. The actual threshold used is 1% of the backup size or
manifest-save-threshold
, whichever is greater.
default: 1GiB allowed: 1B-1TiB example: --manifest-save-threshold=8GiB
Online Option ( --online )
Perform an online backup.
Specifying --no-online prevents
pgBackRest
from running the backup start/stop functions on the database cluster. In order for this to work
PostgreSQL
should be shut down and
pgBackRest
will generate an error if it is not.
The purpose of this option is to allow offline backups. The
pg_xlog
/
pg_wal
directory is copied as-is and
archive-check
is automatically disabled for the backup.
default: y example: --no-online
Resume Option ( --resume )
Allow resume of failed backup.
Defines whether the resume feature is enabled. Resume can greatly reduce the amount of time required to run a backup after a previous backup of the same type has failed. It adds complexity, however, so it may be desirable to disable in environments that do not require the feature.
default: y example: --no-resume
Start Fast Option ( --start-fast )
Force a checkpoint to start backup quickly.
Forces a checkpoint (by passing
y
to the
fast
parameter of the backup start function) so the backup begins immediately. Otherwise the backup will start after the next regular checkpoint.
default: n example: --start-fast
Stop Auto Option ( --stop-auto )
Stop prior failed backup on new backup.
This will only be done if an exclusive advisory lock can be acquired to demonstrate that the prior failed backup process has really stopped.
This feature is not supported for
PostgreSQL
>=
9.6
since backups are run in non-exclusive mode.
The setting is disabled by default because it assumes that
pgBackRest
is the only process doing exclusive online backups. It depends on an advisory lock that only
pgBackRest
sets so it may abort other processes that do exclusive online backups. Note that
base_backup
and
pg_dump
are safe to use with this setting because they do not call
pg_start_backup()
so are not exclusive.
default: n example: --stop-auto
Type Option ( --type )
Backup type.
The following backup types are supported:
- full - all database cluster files will be copied and there will be no dependencies on previous backups.
- incr - incremental from the last successful backup.
- diff - like an incremental backup but always based on the last full backup.
default: incr example: --type=full
General Options
Buffer Size Option ( --buffer-size )
Buffer size for I/O operations.
Buffer size used for copy, compress, encrypt, and other operations. The number of buffers used depends on options and each operation may use additional memory, e.g.
gz
compression may use an additional 256KiB of memory.
Allowed values are
16KiB
,
32KiB
,
64KiB
,
128KiB
,
256KiB
,
512KiB
,
1MiB
,
2MiB
,
4MiB
,
8MiB
, and
16MiB
.
default: 1MiB example: --buffer-size=2MiB
pgBackRest Command Option ( --cmd )
pgBackRest
command.
pgBackRest
may generate a command string, e.g. when the
restore
command generates the
restore_command
setting. The command used to run the
pgBackRest
process will be used in this case unless the
cmd
option is provided.
CAUTION:
Wrapping the
pgBackRest
command may cause unpredictable behavior and is not recommended.
example: --cmd=/var/lib/pgsql/bin/pgbackrest_wrapper.sh
SSH Client Command Option ( --cmd-ssh )
SSH client command.
Use a specific SSH client command when an alternate is desired or the
ssh
command is not in $PATH.
default: ssh example: --cmd-ssh=/usr/bin/ssh
Compress Option ( --compress )
Use file compression.
Backup files are compatible with command-line compression tools.
This option is now deprecated. The
compress-type
option should be used instead.
default: y example: --no-compress
Compress Level Option ( --compress-level )
File compression level.
Sets the level to be used for file compression when
compress-type
does not equal
none
or
compress=y
(deprecated).
The following are the defaults levels based on
compress-type
when
compress-level
is not specified:
- bz2 - 9
- gz - 6
- lz4 - 1
- zst - 3
example: --compress-level=9
Network Compress Level Option ( --compress-level-network )
Network compression level.
Sets the network compression level when
compress-type=none
and the command is not run on the same host as the repository. Compression is used to reduce network traffic but can be disabled by setting
compress-level-network=0
. When
compress-type
does not equal
none
the
compress-level-network
setting is ignored and
compress-level
is used instead so that the file is only compressed once.
default: 3 allowed: 0-9 example: --compress-level-network=1
Compress Type Option ( --compress-type )
File compression type.
The following compression types are supported:
- none - no compression
- bz2 - bzip2 compression format
- gz - gzip compression format
- lz4 - lz4 compression format (not available on all platforms)
- zst - Zstandard compression format (not available on all platforms)
default: gz example: --compress-type=none
Config Option ( --config )
pgBackRest
configuration file.
Use this option to specify a different configuration file than the default.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_FILE example: --config=/conf/pgbackrest/pgbackrest.conf
Config Include Path Option ( --config-include-path )
Path to additional
pgBackRest
configuration files.
Configuration files existing in the specified location with extension
.conf
will be concatenated with the
pgBackRest
configuration file, resulting in one configuration file.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_INCLUDE_PATH example: --config-include-path=/conf/pgbackrest/conf.d
Config Path Option ( --config-path )
Base path of
pgBackRest
configuration files.
This setting is used to override the default base path setting for the
--config
and
--config-include-path
options unless they are explicitly set on the command-line.
For example, passing only
--config-path=/conf/pgbackrest
results in the
--config
default being set to
/conf/pgbackrest/pgbackrest.conf
and the
--config-include-path
default being set to
/conf/pgbackrest/conf.d
.
default: CFGOPTDEF_CONFIG_PATH example: --config-path=/conf/pgbackrest
Database Timeout Option ( --db-timeout )
Database query timeout.
Sets the timeout, in seconds, for queries against the database. This includes the backup start/stop functions which can each take a substantial amount of time. Because of this the timeout should be kept high unless you know that these functions will return quickly (i.e. if you have set
start-fast=y
and you know that the database cluster will not generate many WAL segments during the backup).
NOTE:
The
db-timeout
option must be less than the
protocol-timeout
option.
default: 30m allowed: 100ms-7d example: --db-timeout=600
Delta Option ( --delta )
Restore or backup using checksums.
During a restore, by default the
PostgreSQL
data and tablespace directories are expected to be present but empty. This option performs a delta restore using checksums.
During a backup, this option will use checksums instead of the timestamps to determine if files will be copied.
default: n example: --delta
I/O Timeout Option ( --io-timeout )
I/O timeout.
Timeout, in seconds, used for connections and read/write operations.
Note that the entire read/write operation does not need to complete within this timeout but
some
progress must be made, even if it is only a single byte.
default: 1m allowed: 100ms-1h example: --io-timeout=120
Lock Path Option ( --lock-path )
Path where lock files are stored.
The lock path provides a location for
pgBackRest
to create lock files to prevent conflicting operations from being run concurrently.
default: /tmp/pgbackrest example: --lock-path=/backup/db/lock
Neutral Umask Option ( --neutral-umask )
Use a neutral umask.
Sets the umask to 0000 so modes in the repository are created in a sensible way. The default directory mode is 0750 and default file mode is 0640. The lock and log directories set the directory and file mode to 0770 and 0660 respectively.
To use the executing user's umask instead specify
neutral-umask=n
in the config file or
--no-neutral-umask
on the command line.
default: y example: --no-neutral-umask
Process Maximum Option ( --process-max )
Max processes to use for compress/transfer.
Each process will perform compression and transfer to make the command run faster, but don't set
process-max
so high that it impacts database performance.
default: 1 allowed: 1-999 example: --process-max=4
Protocol Timeout Option ( --protocol-timeout )
Protocol timeout.
Sets the timeout, in seconds, that the local or remote process will wait for a new message to be received on the protocol layer. This prevents processes from waiting indefinitely for a message.
NOTE:
The
protocol-timeout
option must be greater than the
db-timeout
option.
default: 31m allowed: 100ms-7d example: --protocol-timeout=630
Keep Alive Option ( --sck-keep-alive )
Keep-alive enable.
Enables keep-alive messages on socket connections.
default: y example: --no-sck-keep-alive
Stanza Option ( --stanza )
Defines the stanza.
A stanza is the configuration for a
PostgreSQL
database cluster that defines where it is located, how it will be backed up, archiving options, etc. Most db servers will only have one
PostgreSQL
database cluster and therefore one stanza, whereas backup servers will have a stanza for every database cluster that needs to be backed up.
It is tempting to name the stanza after the primary cluster but a better name describes the databases contained in the cluster. Because the stanza name will be used for the primary and all replicas it is more appropriate to choose a name that describes the actual function of the cluster, such as app or dw, rather than the local cluster name, such as main or prod.
example: --stanza=main
Keep Alive Count Option ( --tcp-keep-alive-count )
Keep-alive count.
Specifies the number of TCP keep-alive messages that can be lost before the connection is considered dead.
This option is available on systems that support the
TCP_KEEPCNT
socket option.
allowed: 1-32 example: --tcp-keep-alive-count=3
Keep Alive Idle Option ( --tcp-keep-alive-idle )
Keep-alive idle time.
Specifies the amount of time (in seconds) with no network activity after which the operating system should send a TCP keep-alive message.
This option is available on systems that support the
TCP_KEEPIDLE
socket option.
allowed: 1-3600 example: --tcp-keep-alive-idle=60
Keep Alive Interval Option ( --tcp-keep-alive-interval )
Keep-alive interval time.
Specifies the amount of time (in seconds) after which a TCP keep-alive message that has not been acknowledged should be retransmitted.
This option is available on systems that support the
TCP_KEEPINTVL
socket option.
allowed: 1-900 example: --tcp-keep-alive-interval=30
Log Options
Console Log Level Option ( --log-level-console )
Level for console logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: warn example: --log-level-console=error
File Log Level Option ( --log-level-file )
Level for file logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: info example: --log-level-file=debug
Std Error Log Level Option ( --log-level-stderr )
Level for stderr logging.
Specifies which log levels will output to
stderr
rather than
stdout
(specified by
log-level-console
). The timestamp and process will not be output to
stderr
.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: off example: --log-level-stderr=error
Log Path Option ( --log-path )
Path where log files are stored.
The log path provides a location for
pgBackRest
to store log files. Note that if
log-level-file=off
then no log path is required.
default: /var/log/pgbackrest example: --log-path=/backup/db/log
Maintainer Options
Page Header Check Option ( --page-header-check )
Check PostgreSQL page headers.
Enabled by default, this option adds page header checks.
Disabling this option should be avoided except when necessary, e.g. if pages are encrypted.
default: y example: --no-page-header-check
Force PostgreSQL Version Option ( --pg-version-force )
Force
PostgreSQL
version.
The specified
PostgreSQL
version will be used instead of the version automatically detected by reading
pg_control
or WAL headers. This is mainly useful for
PostgreSQL
forks or development versions where those values are different from the release version. The version reported by
PostgreSQL
via `server_version_num` must match the forced version.
WARNING:
Be cautious when using this option because
pg_control
and WAL headers will still be read with the expected format for the specified version, i.e. the format from the official open-source version of
PostgreSQL
. If the fork or development version changes the format of the fields that
pgBackRest
depends on it will lead to unexpected behavior. In general, this option will only work as expected if the fork adds all custom struct members
after
the standard
PostgreSQL
members.
example: --pg-version-force=15
Repository Options
Set Repository Option ( --repo )
Set repository.
Set the repository for a command to operate on.
For example, this option may be used to perform a restore from a specific repository, rather than letting
pgBackRest
choose.
allowed: 1-256 example: --repo=1
Azure Repository Container Option ( --repo-azure-container )
Azure repository container.
Azure container used to store the repository.
pgBackRest
repositories can be stored in the container root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other Azure-generated content can also be stored in the container.
example: --repo1-azure-container=pg-backup
Azure Repository Key Type Option ( --repo-azure-key-type )
Azure repository key type.
The following types are supported for authorization:
- shared - Shared key
- sas - Shared access signature
default: shared example: --repo1-azure-key-type=sas
Azure Repository URI Style Option ( --repo-azure-uri-style )
Azure URI Style.
The following URI styles are supported:
- host - Connect to account.endpoint host.
- path - Connect to endpoint host and prepend account to URIs.
default: host example: --repo1-azure-uri-style=path
Block Incremental Backup Option ( --repo-block )
Enable block incremental backup.
Block incremental allows for more granular backups by splitting files into blocks that can be backed up independently. This saves space in the repository and can improve delta restore performance because individual blocks can be fetched without reading the entire file from the repository.
NOTE:
The
repo-bundle
option must be enabled before
repo-block
can be enabled.
The block size for a file is determined based on the file size and age. Generally, older/larger files will get larger block sizes. If a file is old enough, it will not be backed up using block incremental.
Block incremental is most efficient when enabled for all backup types, including full. This makes the full a bit larger but subsequent differential and incremental backups can make use of the block maps generated by the full backup to save space.
default: n example: --repo1-block
Repository Bundles Option ( --repo-bundle )
Bundle files in repository.
Bundle (combine) smaller files to reduce the total number of files written to the repository. Writing fewer files is generally more efficient, especially on object stores such as
S3
. In addition, zero-length files are not stored (except in the manifest), which saves time and space.
default: n example: --repo1-bundle
Repository Bundle Limit Option ( --repo-bundle-limit )
Limit for file bundles.
Size limit for files that will be included in bundles. Files larger than this size will be stored separately.
Bundled files cannot be reused when a backup is resumed, so this option controls the files that can be resumed, i.e. higher values result in fewer resumable files.
default: 2MiB allowed: 8KiB-1PiB example: --repo1-bundle-limit=10MiB
Repository Bundle Size Option ( --repo-bundle-size )
Target size for file bundles.
Defines the total size of files that will be added to a single bundle. Most bundles will be smaller than this size but it is possible that some will be slightly larger, so do not set this option to the maximum size that your file system allows.
In general, it is not a good idea to set this option too high because retries will need to redo the entire bundle.
default: 20MiB allowed: 1MiB-1PiB example: --repo1-bundle-size=10MiB
Repository Cipher Type Option ( --repo-cipher-type )
Cipher used to encrypt the repository.
The following cipher types are supported:
- none - The repository is not encrypted
- aes-256-cbc - Advanced Encryption Standard with 256 bit key length
Note that encryption is always performed client-side even if the repository type (e.g. S3) supports encryption.
default: none example: --repo1-cipher-type=aes-256-cbc
GCS Repository Bucket Option ( --repo-gcs-bucket )
GCS repository bucket.
GCS bucket used to store the repository.
pgBackRest
repositories can be stored in the bucket root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other GCS-generated content can also be stored in the bucket.
example: --repo1-gcs-bucket=/pg-backup
GCS Repository Endpoint Option ( --repo-gcs-endpoint )
GCS repository endpoint.
Endpoint used to connect to the storage service. May be updated to use a local GCS server or alternate endpoint.
default: storage.googleapis.com example: --repo1-gcs-endpoint=localhost
GCS Repository Key Type Option ( --repo-gcs-key-type )
GCS repository key type.
The following types are supported for authorization:
- auto - Authorize using the instance service account.
- service - Service account from locally stored key.
- token - For local testing, e.g. fakegcs .
When
repo-gcs-key-type=service
the credentials will be reloaded when the authentication token is renewed.
default: service example: --repo1-gcs-key-type=auto
Repository Hardlink Option ( --repo-hardlink )
Hardlink files between backups in the repository.
Enable hard-linking of files in differential and incremental backups to their full backups. This gives the appearance that each backup is a full backup at the file-system level. Be careful, though, because modifying files that are hard-linked can affect all the backups in the set.
default: n example: --repo1-hardlink
Deprecated Name: hardlink
Repository Path Option ( --repo-path )
Path where backups and archive are stored.
The repository is where
pgBackRest
stores backups and archives WAL segments.
It may be difficult to estimate in advance how much space you'll need. The best thing to do is take some backups then record the size of different types of backups (full/incr/diff) and measure the amount of WAL generated per day. This will give you a general idea of how much space you'll need, though of course requirements will likely change over time as your database evolves.
default: /var/lib/pgbackrest example: --repo1-path=/backup/db/backrest
Archive Retention Option ( --repo-retention-archive )
Number of backups worth of continuous WAL to retain.
NOTE:
WAL segments required to make a backup consistent are always retained until the backup is expired regardless of how this option is configured.
If this value is not set and
repo-retention-full-type
is
count
(default), then the archive to expire will default to the
repo-retention-full
(or
repo-retention-diff
) value corresponding to the
repo-retention-archive-type
if set to
full
(or
diff
). This will ensure that WAL is only expired for backups that are already expired. If
repo-retention-full-type
is
time
, then this value will default to removing archives that are earlier than the oldest full backup retained after satisfying the
repo-retention-full
setting.
This option must be set if
repo-retention-archive-type
is set to
incr
. If disk space is at a premium, then this setting, in conjunction with
repo-retention-archive-type
, can be used to aggressively expire WAL segments. However, doing so negates the ability to perform PITR from the backups with expired WAL and is therefore
not
recommended.
allowed: 1-9999999 example: --repo1-retention-archive=2
Deprecated Name: retention-archive
Archive Retention Type Option ( --repo-retention-archive-type )
Backup type for WAL retention.
If set to
full
pgBackRest
will keep archive logs for the number of full backups defined by
repo-retention-archive
. If set to
diff
(differential)
pgBackRest
will keep archive logs for the number of full and differential backups defined by
repo-retention-archive
, meaning if the last backup taken was a full backup, it will be counted as a differential for the purpose of repo-retention. If set to
incr
(incremental)
pgBackRest
will keep archive logs for the number of full, differential, and incremental backups defined by
repo-retention-archive
. It is recommended that this setting not be changed from the default which will only expire WAL in conjunction with expiring full backups.
default: full example: --repo1-retention-archive-type=diff
Deprecated Name: retention-archive-type
Differential Retention Option ( --repo-retention-diff )
Number of differential backups to retain.
When a differential backup expires, all incremental backups associated with the differential backup will also expire. When not defined all differential backups will be kept until the full backups they depend on expire.
allowed: 1-9999999 example: --repo1-retention-diff=3
Deprecated Name: retention-diff
Full Retention Option ( --repo-retention-full )
Full backup retention count/time.
When a full backup expires, all differential and incremental backups associated with the full backup will also expire. When the option is not defined a warning will be issued. If indefinite retention is desired then set the option to the max value.
allowed: 1-9999999 example: --repo1-retention-full=2
Deprecated Name: retention-full
Full Retention Type Option ( --repo-retention-full-type )
Retention type for full backups.
Determines whether the
repo-retention-full
setting represents a time period (days) or count of full backups to keep. If set to
time
then full backups older than
repo-retention-full
will be removed from the repository if there is at least one backup that is equal to or greater than the
repo-retention-full
setting. For example, if
repo-retention-full
is 30 (days) and there are 2 full backups: one 25 days old and one 35 days old, no full backups will be expired because expiring the 35 day old backup would leave only the 25 day old backup, which would violate the 30 day retention policy of having at least one backup 30 days old before an older one can be expired. Archived WAL older than the oldest full backup remaining will be automatically expired unless
repo-retention-archive-type
and
repo-retention-archive
are explicitly set.
default: count example: --repo1-retention-full-type=time
Backup History Retention Option ( --repo-retention-history )
Days of backup history manifests to retain.
A copy of the backup manifest is stored in the
backup.history
path when a backup completes. By default these files are never expired since they are useful for data mining, e.g. measuring backup and WAL growth over time.
Set
repo-retention-history
to define the number of days of backup history manifests to retain. Unexpired backups are always kept in the backup history. Specify
repo-retention-history=0
to retain the backup history only for unexpired backups.
When a full backup history manifest is expired, all differential and incremental backup history manifests associated with the full backup also expire.
allowed: 0-9999999 example: --repo1-retention-history=365
S3 Repository Bucket Option ( --repo-s3-bucket )
S3 repository bucket.
S3 bucket used to store the repository.
pgBackRest
repositories can be stored in the bucket root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other AWS generated content can also be stored in the bucket.
example: --repo1-s3-bucket=pg-backup
S3 Repository Endpoint Option ( --repo-s3-endpoint )
S3 repository endpoint.
The AWS endpoint should be valid for the selected region.
For custom/test configurations the
repo-storage-ca-file
,
repo-storage-ca-path
,
repo-storage-host
,
repo-storage-port
, and
repo-storage-verify-tls
options may be useful.
example: --repo1-s3-endpoint=s3.amazonaws.com
S3 Repository Key Type Option ( --repo-s3-key-type )
S3 repository key type.
The following types are supported:
- shared - Shared keys
- auto - Automatically retrieve temporary credentials
- web-id - Automatically retrieve web identity credentials
default: shared example: --repo1-s3-key-type=auto
S3 Repository KMS Key ID Option ( --repo-s3-kms-key-id )
S3 repository KMS key.
Setting this option enables S3 server-side encryption using the specified AWS key management service key.
example: --repo1-s3-kms-key-id=bceb4f13-6939-4be3-910d-df54dee817b7
S3 Repository Region Option ( --repo-s3-region )
S3 repository region.
The AWS region where the bucket was created.
example: --repo1-s3-region=us-east-1
S3 Repository Role Option ( --repo-s3-role )
S3 repository role.
The AWS role name (not the full ARN) used to retrieve temporary credentials when
repo-s3-key-type=auto
.
example: --repo1-s3-role=authrole
S3 Repository URI Style Option ( --repo-s3-uri-style )
S3 URI Style.
The following URI styles are supported:
- host - Connect to bucket.endpoint host.
- path - Connect to endpoint host and prepend bucket to URIs.
default: host example: --repo1-s3-uri-style=path
SFTP Repository Host Option ( --repo-sftp-host )
SFTP repository host.
The SFTP host containing the repository.
example: --repo1-sftp-host=sftprepo.domain
SFTP Repository Host Fingerprint Option ( --repo-sftp-host-fingerprint )
SFTP repository host fingerprint.
SFTP repository host fingerprint generation should match the
repo-sftp-host-key-hash-type
. Generate the fingerprint via
awk '{print $2}' ssh_host_xxx_key.pub | base64 -d | (md5sum or sha1sum) -b
. The ssh host keys are normally found in the
/etc/ssh
directory.
example: --repo1-sftp-host-fingerprint=f84e172dfead7aeeeae6c1fdfb5aa8cf
SFTP Host Key Check Type Option ( --repo-sftp-host-key-check-type )
SFTP host key check type.
The following SFTP host key check types are supported:
- strict - pgBackRest will never automatically add host keys to the ~/.ssh/known_hosts file, and refuses to connect to hosts whose host key has changed or is not found in the known hosts files. This option forces the user to manually add all new hosts.
- accept-new - pgBackRest will automatically add new host keys to the user's known hosts file, but will not permit connections to hosts with changed host keys.
- fingerprint - pgBackRest will check the host key against the fingerprint specified by the repo-sftp-host-fingerprint option.
- none - no host key checking will be performed.
default: strict example: --repo1-sftp-host-key-check-type=accept-new
SFTP Repository Host Key Hash Type Option ( --repo-sftp-host-key-hash-type )
SFTP repository host key hash type.
SFTP repository host key hash type. Declares the hash type to be used to compute the digest of the remote system's host key on SSH startup. Newer versions of
libssh2
support
sha256
in addition to md5 and sha1.
example: --repo1-sftp-host-key-hash-type=sha256
SFTP Repository Host Port Option ( --repo-sftp-host-port )
SFTP repository host port.
SFTP repository host port.
default: 22 allowed: 1-65535 example: --repo1-sftp-host-port=22
SFTP Repository Host User Option ( --repo-sftp-host-user )
SFTP repository host user.
User on the host used to store the repository.
example: --repo1-sftp-host-user=pg-backup
SFTP Known Hosts File Option ( --repo-sftp-known-host )
SFTP known hosts file.
A known hosts file to search for an SFTP host match during authentication. When unspecified,
pgBackRest
will default to searching
~/.ssh/known_hosts
,
~/.ssh/known_hosts2
,
/etc/ssh/ssh_known_hosts
, and
/etc/ssh/ssh_known_hosts2
. If configured with one or more file paths,
pgBackRest
will search those for a match. File paths must be full or leading tilde paths. The
repo-sftp-known-host
option can be passed multiple times to specify more than one known hosts file to search. To utilize known hosts file checking
repo-sftp-host-fingerprint
must not be specified. See also
repo-sftp-host-check-type
option.
example: --repo1-sftp-known-host=/home/postgres/.ssh/known_hosts
SFTP Repository Private Key File Option ( --repo-sftp-private-key-file )
SFTP private key file.
SFTP private key file used for authentication.
example: --repo1-sftp-private-key-file=~/.ssh/id_ed25519
SFTP Repository Public Key File Option ( --repo-sftp-public-key-file )
SFTP public key file.
SFTP public key file used for authentication. Optional if compiled against OpenSSL, required if compiled against a different library.
example: --repo1-sftp-public-key-file=~/.ssh/id_ed25519.pub
Repository Storage CA File Option ( --repo-storage-ca-file )
Repository storage CA file.
Use a CA file other than the system default for storage (e.g. S3, Azure) certificates.
example: --repo1-storage-ca-file=/etc/pki/tls/certs/ca-bundle.crt
Deprecated Names: repo-azure-ca-file, repo-s3-ca-file
Repository Storage TLS CA Path Option ( --repo-storage-ca-path )
Repository storage CA path.
Use a CA path other than the system default for storage (e.g. S3, Azure) certificates.
example: --repo1-storage-ca-path=/etc/pki/tls/certs
Deprecated Names: repo-azure-ca-path, repo-s3-ca-path
Repository Storage Host Option ( --repo-storage-host )
Repository storage host.
Connect to a host other than the storage (e.g. S3, Azure) endpoint. This is typically used for testing.
example: --repo1-storage-host=127.0.0.1
Deprecated Names: repo-azure-host, repo-s3-host
Repository Storage Port Option ( --repo-storage-port )
Repository storage port.
Port to use when connecting to the storage (e.g. S3, Azure) endpoint (or host if specified).
default: 443 allowed: 1-65535 example: --repo1-storage-port=9000
Deprecated Names: repo-azure-port, repo-s3-port
Repository Storage Tag Option ( --repo-storage-tag )
Repository storage tag(s).
Specify tags that will be added to objects when the repository is an object store (e.g. S3). The option can be repeated to add multiple tags.
There is no provision in
pgBackRest
to modify these tags so be sure to set them correctly before running
stanza-create
to ensure uniform tags across the entire repository.
example: --repo1-storage-tag=key1=value1
Repository Storage Upload Chunk Size Option ( --repo-storage-upload-chunk-size )
Repository storage upload chunk size.
Object stores such as S3 allow files to be uploaded in chunks when the file is too large to be stored in memory. Even if the file can be stored in memory, it is more memory efficient to limit the amount of memory used for uploads.
A larger chunk size will generally lead to better performance because it will minimize upload requests and allow more files to be uploaded in a single request rather than in chunks. The disadvantage is that memory usage will be higher and because the chunk buffer must be allocated per process, larger
process-max
values will lead to more memory being consumed overall.
Default chunk sizes by repo type:
- azure - 4MiB
- gcs - 4MiB
- s3 - 5MiB
Note that valid chunk sizes vary by storage type and by platform. For example,
AWS S3
has a minimum chunk size of 5MiB but
S3
clones may accept lower values. Terminology for chunk size varies by storage type, so when searching min/max values use
part sizefor AWS S3 ,
chunk sizefor GCS , and
block sizefor Azure . No attempt is made to validate configured chunk sizes so selecting an invalid value will lead to errors from the storage service or undefined behavior.
allowed: 64KiB-1TiB example: --repo1-storage-upload-chunk-size=16MiB
Repository Storage Certificate Verify Option ( --repo-storage-verify-tls )
Repository storage certificate verify.
This option provides the ability to enable/disable verification of the storage (e.g. S3, Azure) server TLS certificate. Disabling should only be used for testing or other scenarios where a certificate has been self-signed.
default: y example: --no-repo1-storage-verify-tls
Deprecated Names: repo-azure-verify-tls, repo-s3-verify-ssl, repo-s3-verify-tls
Repository Type Option ( --repo-type )
Type of storage used for the repository.
The following repository types are supported:
- azure - Azure Blob Storage Service
- cifs - Like posix , but disables links and directory fsyncs
- gcs - Google Cloud Storage
- posix - Posix-compliant file systems
- s3 - AWS Simple Storage Service
- sftp - Secure File Transfer Protocol
When an
NFS
mount is used as a
posix
repository, the same rules apply to
pgBackRest
as described in the
PostgreSQL
documentation:
Creating a Database Cluster - File Systems
.
default: posix example: --repo1-type=cifs
Stanza Options
PostgreSQL Database Option ( --pg-database )
PostgreSQL
database.
The database name used when connecting to
PostgreSQL
. The default is usually best but some installations may not contain this database.
Note that for legacy reasons the setting of the
PGDATABASE
environment variable will be ignored.
default: postgres example: --pg1-database=backupdb
PostgreSQL Host Option ( --pg-host )
PostgreSQL
host for operating remotely.
Used for backups where the
PostgreSQL
host is different from the repository host.
example: --pg1-host=db.domain.com
Deprecated Name: db-host
PostgreSQL Host Certificate Authority File Option ( --pg-host-ca-file )
PostgreSQL
host certificate authority file.
Use a CA file other than the system default for connecting to the
PostgreSQL
host.
example: --pg1-host-ca-file=/etc/pki/tls/certs/ca-bundle.crt
PostgreSQL Host Certificate Authority Path Option ( --pg-host-ca-path )
PostgreSQL
host certificate authority path.
Use a CA path other than the system default for connecting to the
PostgreSQL
host.
example: --pg1-host-ca-path=/etc/pki/tls/certs
PostgreSQL Host Certificate File Option ( --pg-host-cert-file )
PostgreSQL
host certificate file.
Sent to
PostgreSQL
host to prove client identity.
example: --pg1-host-cert-file=/path/to/client.crt
PostgreSQL Host Command Option ( --pg-host-cmd )
PostgreSQL
host
pgBackRest
command.
Required only if the path to the
pgBackRest
command is different on the local and
PostgreSQL
hosts. If not defined, the
PostgreSQL
host command will be set the same as the local command.
example: --pg1-host-cmd=/usr/lib/backrest/bin/pgbackrest
Deprecated Name: db-cmd
PostgreSQL Host Configuration Option ( --pg-host-config )
pgBackRest
database host configuration file.
Sets the location of the configuration file on the
PostgreSQL
host. This is only required if the
PostgreSQL
host configuration file is in a different location than the local configuration file.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_FILE example: --pg1-host-config=/conf/pgbackrest/pgbackrest.conf
Deprecated Name: db-config
PostgreSQL Host Configuration Include Path Option ( --pg-host-config-include-path )
pgBackRest
database host configuration include path.
Sets the location of the configuration include path on the
PostgreSQL
host. This is only required if the
PostgreSQL
host configuration include path is in a different location than the local configuration include path.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_INCLUDE_PATH example: --pg1-host-config-include-path=/conf/pgbackrest/conf.d
PostgreSQL Host Configuration Path Option ( --pg-host-config-path )
pgBackRest
database host configuration path.
Sets the location of the configuration path on the
PostgreSQL
host. This is only required if the
PostgreSQL
host configuration path is in a different location than the local configuration path.
default: CFGOPTDEF_CONFIG_PATH example: --pg1-host-config-path=/conf/pgbackrest
PostgreSQL Host Key File Option ( --pg-host-key-file )
PostgreSQL
host key file.
Proves client certificate was sent by owner.
example: --pg1-host-key-file=/path/to/client.key
PostgreSQL Host Port Option ( --pg-host-port )
PostgreSQL
host port when
pg-host
is set.
Use this option to specify a non-default port for the
PostgreSQL
host protocol.
allowed: 0-65535 example: --pg1-host-port=25
Deprecated Name: db-ssh-port
PostgreSQL Host Protocol Type Option ( --pg-host-type )
PostgreSQL
host protocol type.
The following protocol types are supported:
- ssh - Secure Shell.
- tls - pgBackRest TLS server.
default: ssh example: --pg1-host-type=tls
PostgreSQL Host User Option ( --pg-host-user )
PostgreSQL
host logon user when
pg-host
is set.
This user will also own the remote
pgBackRest
process and will initiate connections to
PostgreSQL
. For this to work correctly the user should be the
PostgreSQL
database cluster owner which is generally
postgres
, the default.
default: postgres example: --pg1-host-user=db_owner
Deprecated Name: db-user
PostgreSQL Path Option ( --pg-path )
PostgreSQL
data directory.
This should be the same as the
data_directory
setting in
postgresql.conf
. Even though this value can be read from
postgresql.conf
or
PostgreSQL
it is prudent to set it in case those resources are not available during a restore or offline backup scenario.
The
pg-path
option is tested against the value reported by
PostgreSQL
on every online backup so it should always be current.
example: --pg1-path=/data/db
Deprecated Name: db-path
PostgreSQL Port Option ( --pg-port )
PostgreSQL
port.
Port that
PostgreSQL
is running on. This usually does not need to be specified as most
PostgreSQL
clusters run on the default port.
default: 5432 allowed: 0-65535 example: --pg1-port=6543
Deprecated Name: db-port
PostgreSQL Socket Path Option ( --pg-socket-path )
PostgreSQL
unix socket path.
The unix socket directory that was specified when
PostgreSQL
was started.
pgBackRest
will automatically look in the standard location for your OS so there is usually no need to specify this setting unless the socket directory was explicitly modified with the
unix_socket_directory
setting in
postgresql.conf
.
example: --pg1-socket-path=/var/run/postgresql
Deprecated Name: db-socket-path
Check Command ( check )
The
check
command validates that
pgBackRest
and the
archive_command
setting are configured correctly for archiving and backups for the specified stanza. It will attempt to check all repositories and databases that are configured for the host on which the command is run. It detects misconfigurations, particularly in archiving, that result in incomplete backups because required WAL segments did not reach the archive. The command can be run on the
PostgreSQL
or repository host. The command may also be run on the standby host, however, since
pg_switch_xlog()
/
pg_switch_wal()
cannot be performed on the standby, the command will only test the repository configuration.
Note that
pg_create_restore_point('pgBackRest Archive Check')
and
pg_switch_xlog()
/
pg_switch_wal()
are called to force
PostgreSQL
to archive a WAL segment.
Command Options
Check Archive Option ( --archive-check )
Check that WAL segments are in the archive before backup completes.
Checks that all WAL segments required to make the backup consistent are present in the WAL archive. It's a good idea to leave this as the default unless you are using another method for archiving.
This option must be enabled if
archive-copy
is enabled.
default: y example: --no-archive-check
Check Archive Mode Option ( --archive-mode-check )
Check the
PostgreSQL
archive_mode
setting.
Enabled by default, this option disallows
PostgreSQL
archive_mode=always
.
WAL segments pushed from a standby server might be logically the same as WAL segments pushed from the primary but have different checksums. Disabling archiving from multiple sources is recommended to avoid conflicts.
CAUTION:
If this option is disabled then it is critical to ensure that only one archiver is writing to the repository via the
archive-push
command.
default: y example: --no-archive-mode-check
Archive Timeout Option ( --archive-timeout )
Archive timeout.
Set maximum time, in seconds, to wait for each WAL segment to reach the
pgBackRest
archive repository. The timeout applies to the
check
and
backup
commands when waiting for WAL segments required for backup consistency to be archived.
default: 1m allowed: 100ms-1d example: --archive-timeout=30
General Options
Buffer Size Option ( --buffer-size )
Buffer size for I/O operations.
Buffer size used for copy, compress, encrypt, and other operations. The number of buffers used depends on options and each operation may use additional memory, e.g.
gz
compression may use an additional 256KiB of memory.
Allowed values are
16KiB
,
32KiB
,
64KiB
,
128KiB
,
256KiB
,
512KiB
,
1MiB
,
2MiB
,
4MiB
,
8MiB
, and
16MiB
.
default: 1MiB example: --buffer-size=2MiB
pgBackRest Command Option ( --cmd )
pgBackRest
command.
pgBackRest
may generate a command string, e.g. when the
restore
command generates the
restore_command
setting. The command used to run the
pgBackRest
process will be used in this case unless the
cmd
option is provided.
CAUTION:
Wrapping the
pgBackRest
command may cause unpredictable behavior and is not recommended.
example: --cmd=/var/lib/pgsql/bin/pgbackrest_wrapper.sh
SSH Client Command Option ( --cmd-ssh )
SSH client command.
Use a specific SSH client command when an alternate is desired or the
ssh
command is not in $PATH.
default: ssh example: --cmd-ssh=/usr/bin/ssh
Network Compress Level Option ( --compress-level-network )
Network compression level.
Sets the network compression level when
compress-type=none
and the command is not run on the same host as the repository. Compression is used to reduce network traffic but can be disabled by setting
compress-level-network=0
. When
compress-type
does not equal
none
the
compress-level-network
setting is ignored and
compress-level
is used instead so that the file is only compressed once.
default: 3 allowed: 0-9 example: --compress-level-network=1
Config Option ( --config )
pgBackRest
configuration file.
Use this option to specify a different configuration file than the default.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_FILE example: --config=/conf/pgbackrest/pgbackrest.conf
Config Include Path Option ( --config-include-path )
Path to additional
pgBackRest
configuration files.
Configuration files existing in the specified location with extension
.conf
will be concatenated with the
pgBackRest
configuration file, resulting in one configuration file.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_INCLUDE_PATH example: --config-include-path=/conf/pgbackrest/conf.d
Config Path Option ( --config-path )
Base path of
pgBackRest
configuration files.
This setting is used to override the default base path setting for the
--config
and
--config-include-path
options unless they are explicitly set on the command-line.
For example, passing only
--config-path=/conf/pgbackrest
results in the
--config
default being set to
/conf/pgbackrest/pgbackrest.conf
and the
--config-include-path
default being set to
/conf/pgbackrest/conf.d
.
default: CFGOPTDEF_CONFIG_PATH example: --config-path=/conf/pgbackrest
Database Timeout Option ( --db-timeout )
Database query timeout.
Sets the timeout, in seconds, for queries against the database. This includes the backup start/stop functions which can each take a substantial amount of time. Because of this the timeout should be kept high unless you know that these functions will return quickly (i.e. if you have set
start-fast=y
and you know that the database cluster will not generate many WAL segments during the backup).
NOTE:
The
db-timeout
option must be less than the
protocol-timeout
option.
default: 30m allowed: 100ms-7d example: --db-timeout=600
I/O Timeout Option ( --io-timeout )
I/O timeout.
Timeout, in seconds, used for connections and read/write operations.
Note that the entire read/write operation does not need to complete within this timeout but
some
progress must be made, even if it is only a single byte.
default: 1m allowed: 100ms-1h example: --io-timeout=120
Neutral Umask Option ( --neutral-umask )
Use a neutral umask.
Sets the umask to 0000 so modes in the repository are created in a sensible way. The default directory mode is 0750 and default file mode is 0640. The lock and log directories set the directory and file mode to 0770 and 0660 respectively.
To use the executing user's umask instead specify
neutral-umask=n
in the config file or
--no-neutral-umask
on the command line.
default: y example: --no-neutral-umask
Protocol Timeout Option ( --protocol-timeout )
Protocol timeout.
Sets the timeout, in seconds, that the local or remote process will wait for a new message to be received on the protocol layer. This prevents processes from waiting indefinitely for a message.
NOTE:
The
protocol-timeout
option must be greater than the
db-timeout
option.
default: 31m allowed: 100ms-7d example: --protocol-timeout=630
Keep Alive Option ( --sck-keep-alive )
Keep-alive enable.
Enables keep-alive messages on socket connections.
default: y example: --no-sck-keep-alive
Stanza Option ( --stanza )
Defines the stanza.
A stanza is the configuration for a
PostgreSQL
database cluster that defines where it is located, how it will be backed up, archiving options, etc. Most db servers will only have one
PostgreSQL
database cluster and therefore one stanza, whereas backup servers will have a stanza for every database cluster that needs to be backed up.
It is tempting to name the stanza after the primary cluster but a better name describes the databases contained in the cluster. Because the stanza name will be used for the primary and all replicas it is more appropriate to choose a name that describes the actual function of the cluster, such as app or dw, rather than the local cluster name, such as main or prod.
example: --stanza=main
Keep Alive Count Option ( --tcp-keep-alive-count )
Keep-alive count.
Specifies the number of TCP keep-alive messages that can be lost before the connection is considered dead.
This option is available on systems that support the
TCP_KEEPCNT
socket option.
allowed: 1-32 example: --tcp-keep-alive-count=3
Keep Alive Idle Option ( --tcp-keep-alive-idle )
Keep-alive idle time.
Specifies the amount of time (in seconds) with no network activity after which the operating system should send a TCP keep-alive message.
This option is available on systems that support the
TCP_KEEPIDLE
socket option.
allowed: 1-3600 example: --tcp-keep-alive-idle=60
Keep Alive Interval Option ( --tcp-keep-alive-interval )
Keep-alive interval time.
Specifies the amount of time (in seconds) after which a TCP keep-alive message that has not been acknowledged should be retransmitted.
This option is available on systems that support the
TCP_KEEPINTVL
socket option.
allowed: 1-900 example: --tcp-keep-alive-interval=30
Log Options
Console Log Level Option ( --log-level-console )
Level for console logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: warn example: --log-level-console=error
File Log Level Option ( --log-level-file )
Level for file logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: info example: --log-level-file=debug
Std Error Log Level Option ( --log-level-stderr )
Level for stderr logging.
Specifies which log levels will output to
stderr
rather than
stdout
(specified by
log-level-console
). The timestamp and process will not be output to
stderr
.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: off example: --log-level-stderr=error
Log Path Option ( --log-path )
Path where log files are stored.
The log path provides a location for
pgBackRest
to store log files. Note that if
log-level-file=off
then no log path is required.
default: /var/log/pgbackrest example: --log-path=/backup/db/log
Maintainer Options
Force PostgreSQL Version Option ( --pg-version-force )
Force
PostgreSQL
version.
The specified
PostgreSQL
version will be used instead of the version automatically detected by reading
pg_control
or WAL headers. This is mainly useful for
PostgreSQL
forks or development versions where those values are different from the release version. The version reported by
PostgreSQL
via `server_version_num` must match the forced version.
WARNING:
Be cautious when using this option because
pg_control
and WAL headers will still be read with the expected format for the specified version, i.e. the format from the official open-source version of
PostgreSQL
. If the fork or development version changes the format of the fields that
pgBackRest
depends on it will lead to unexpected behavior. In general, this option will only work as expected if the fork adds all custom struct members
after
the standard
PostgreSQL
members.
example: --pg-version-force=15
Repository Options
Azure Repository Container Option ( --repo-azure-container )
Azure repository container.
Azure container used to store the repository.
pgBackRest
repositories can be stored in the container root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other Azure-generated content can also be stored in the container.
example: --repo1-azure-container=pg-backup
Azure Repository Key Type Option ( --repo-azure-key-type )
Azure repository key type.
The following types are supported for authorization:
- shared - Shared key
- sas - Shared access signature
default: shared example: --repo1-azure-key-type=sas
Azure Repository URI Style Option ( --repo-azure-uri-style )
Azure URI Style.
The following URI styles are supported:
- host - Connect to account.endpoint host.
- path - Connect to endpoint host and prepend account to URIs.
default: host example: --repo1-azure-uri-style=path
Repository Cipher Type Option ( --repo-cipher-type )
Cipher used to encrypt the repository.
The following cipher types are supported:
- none - The repository is not encrypted
- aes-256-cbc - Advanced Encryption Standard with 256 bit key length
Note that encryption is always performed client-side even if the repository type (e.g. S3) supports encryption.
default: none example: --repo1-cipher-type=aes-256-cbc
GCS Repository Bucket Option ( --repo-gcs-bucket )
GCS repository bucket.
GCS bucket used to store the repository.
pgBackRest
repositories can be stored in the bucket root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other GCS-generated content can also be stored in the bucket.
example: --repo1-gcs-bucket=/pg-backup
GCS Repository Endpoint Option ( --repo-gcs-endpoint )
GCS repository endpoint.
Endpoint used to connect to the storage service. May be updated to use a local GCS server or alternate endpoint.
default: storage.googleapis.com example: --repo1-gcs-endpoint=localhost
GCS Repository Key Type Option ( --repo-gcs-key-type )
GCS repository key type.
The following types are supported for authorization:
- auto - Authorize using the instance service account.
- service - Service account from locally stored key.
- token - For local testing, e.g. fakegcs .
When
repo-gcs-key-type=service
the credentials will be reloaded when the authentication token is renewed.
default: service example: --repo1-gcs-key-type=auto
Repository Host Option ( --repo-host )
Repository host when operating remotely.
When backing up and archiving to a locally mounted filesystem this setting is not required.
example: --repo1-host=repo1.domain.com
Deprecated Name: backup-host
Repository Host Certificate Authority File Option ( --repo-host-ca-file )
Repository host certificate authority file.
Use a CA file other than the system default for connecting to the repository host.
example: --repo1-host-ca-file=/etc/pki/tls/certs/ca-bundle.crt
Repository Host Certificate Authority Path Option ( --repo-host-ca-path )
Repository host certificate authority path.
Use a CA path other than the system default for connecting to the repository host.
example: --repo1-host-ca-path=/etc/pki/tls/certs
Repository Host Certificate File Option ( --repo-host-cert-file )
Repository host certificate file.
Sent to repository host to prove client identity.
example: --repo1-host-cert-file=/path/to/client.crt
Repository Host Command Option ( --repo-host-cmd )
Repository host
pgBackRest
command.
Required only if the path to the
pgBackRest
command is different on the local and repository hosts. If not defined, the repository host command will be set the same as the local command.
example: --repo1-host-cmd=/usr/lib/backrest/bin/pgbackrest
Deprecated Name: backup-cmd
Repository Host Configuration Option ( --repo-host-config )
pgBackRest
repository host configuration file.
Sets the location of the configuration file on the repository host. This is only required if the repository host configuration file is in a different location than the local configuration file.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_FILE example: --repo1-host-config=/conf/pgbackrest/pgbackrest.conf
Deprecated Name: backup-config
Repository Host Configuration Include Path Option ( --repo-host-config-include-path )
pgBackRest
repository host configuration include path.
Sets the location of the configuration include path on the repository host. This is only required if the repository host configuration include path is in a different location than the local configuration include path.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_INCLUDE_PATH example: --repo1-host-config-include-path=/conf/pgbackrest/conf.d
Repository Host Configuration Path Option ( --repo-host-config-path )
pgBackRest
repository host configuration path.
Sets the location of the configuration path on the repository host. This is only required if the repository host configuration path is in a different location than the local configuration path.
default: CFGOPTDEF_CONFIG_PATH example: --repo1-host-config-path=/conf/pgbackrest
Repository Host Key File Option ( --repo-host-key-file )
Repository host key file.
Proves client certificate was sent by owner.
example: --repo1-host-key-file=/path/to/client.key
Repository Host Port Option ( --repo-host-port )
Repository host port when
repo-host
is set.
Use this option to specify a non-default port for the repository host protocol.
allowed: 0-65535 example: --repo1-host-port=25
Deprecated Name: backup-ssh-port
Repository Host Protocol Type Option ( --repo-host-type )
Repository host protocol type.
The following protocol types are supported:
- ssh - Secure Shell.
- tls - pgBackRest TLS server.
default: ssh example: --repo1-host-type=tls
Repository Host User Option ( --repo-host-user )
Repository host user when
repo-host
is set.
Defines the user that will be used for operations on the repository host. Preferably this is not the
postgres
user but rather some other user like
pgbackrest
. If
PostgreSQL
runs on the repository host the
postgres
user can be placed in the
pgbackrest
group so it has read permissions on the repository without being able to damage the contents accidentally.
default: pgbackrest example: --repo1-host-user=repo-user
Deprecated Name: backup-user
Repository Path Option ( --repo-path )
Path where backups and archive are stored.
The repository is where
pgBackRest
stores backups and archives WAL segments.
It may be difficult to estimate in advance how much space you'll need. The best thing to do is take some backups then record the size of different types of backups (full/incr/diff) and measure the amount of WAL generated per day. This will give you a general idea of how much space you'll need, though of course requirements will likely change over time as your database evolves.
default: /var/lib/pgbackrest example: --repo1-path=/backup/db/backrest
S3 Repository Bucket Option ( --repo-s3-bucket )
S3 repository bucket.
S3 bucket used to store the repository.
pgBackRest
repositories can be stored in the bucket root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other AWS generated content can also be stored in the bucket.
example: --repo1-s3-bucket=pg-backup
S3 Repository Endpoint Option ( --repo-s3-endpoint )
S3 repository endpoint.
The AWS endpoint should be valid for the selected region.
For custom/test configurations the
repo-storage-ca-file
,
repo-storage-ca-path
,
repo-storage-host
,
repo-storage-port
, and
repo-storage-verify-tls
options may be useful.
example: --repo1-s3-endpoint=s3.amazonaws.com
S3 Repository Key Type Option ( --repo-s3-key-type )
S3 repository key type.
The following types are supported:
- shared - Shared keys
- auto - Automatically retrieve temporary credentials
- web-id - Automatically retrieve web identity credentials
default: shared example: --repo1-s3-key-type=auto
S3 Repository KMS Key ID Option ( --repo-s3-kms-key-id )
S3 repository KMS key.
Setting this option enables S3 server-side encryption using the specified AWS key management service key.
example: --repo1-s3-kms-key-id=bceb4f13-6939-4be3-910d-df54dee817b7
S3 Repository Region Option ( --repo-s3-region )
S3 repository region.
The AWS region where the bucket was created.
example: --repo1-s3-region=us-east-1
S3 Repository Role Option ( --repo-s3-role )
S3 repository role.
The AWS role name (not the full ARN) used to retrieve temporary credentials when
repo-s3-key-type=auto
.
example: --repo1-s3-role=authrole
S3 Repository URI Style Option ( --repo-s3-uri-style )
S3 URI Style.
The following URI styles are supported:
- host - Connect to bucket.endpoint host.
- path - Connect to endpoint host and prepend bucket to URIs.
default: host example: --repo1-s3-uri-style=path
SFTP Repository Host Option ( --repo-sftp-host )
SFTP repository host.
The SFTP host containing the repository.
example: --repo1-sftp-host=sftprepo.domain
SFTP Repository Host Fingerprint Option ( --repo-sftp-host-fingerprint )
SFTP repository host fingerprint.
SFTP repository host fingerprint generation should match the
repo-sftp-host-key-hash-type
. Generate the fingerprint via
awk '{print $2}' ssh_host_xxx_key.pub | base64 -d | (md5sum or sha1sum) -b
. The ssh host keys are normally found in the
/etc/ssh
directory.
example: --repo1-sftp-host-fingerprint=f84e172dfead7aeeeae6c1fdfb5aa8cf
SFTP Host Key Check Type Option ( --repo-sftp-host-key-check-type )
SFTP host key check type.
The following SFTP host key check types are supported:
- strict - pgBackRest will never automatically add host keys to the ~/.ssh/known_hosts file, and refuses to connect to hosts whose host key has changed or is not found in the known hosts files. This option forces the user to manually add all new hosts.
- accept-new - pgBackRest will automatically add new host keys to the user's known hosts file, but will not permit connections to hosts with changed host keys.
- fingerprint - pgBackRest will check the host key against the fingerprint specified by the repo-sftp-host-fingerprint option.
- none - no host key checking will be performed.
default: strict example: --repo1-sftp-host-key-check-type=accept-new
SFTP Repository Host Key Hash Type Option ( --repo-sftp-host-key-hash-type )
SFTP repository host key hash type.
SFTP repository host key hash type. Declares the hash type to be used to compute the digest of the remote system's host key on SSH startup. Newer versions of
libssh2
support
sha256
in addition to md5 and sha1.
example: --repo1-sftp-host-key-hash-type=sha256
SFTP Repository Host Port Option ( --repo-sftp-host-port )
SFTP repository host port.
SFTP repository host port.
default: 22 allowed: 1-65535 example: --repo1-sftp-host-port=22
SFTP Repository Host User Option ( --repo-sftp-host-user )
SFTP repository host user.
User on the host used to store the repository.
example: --repo1-sftp-host-user=pg-backup
SFTP Known Hosts File Option ( --repo-sftp-known-host )
SFTP known hosts file.
A known hosts file to search for an SFTP host match during authentication. When unspecified,
pgBackRest
will default to searching
~/.ssh/known_hosts
,
~/.ssh/known_hosts2
,
/etc/ssh/ssh_known_hosts
, and
/etc/ssh/ssh_known_hosts2
. If configured with one or more file paths,
pgBackRest
will search those for a match. File paths must be full or leading tilde paths. The
repo-sftp-known-host
option can be passed multiple times to specify more than one known hosts file to search. To utilize known hosts file checking
repo-sftp-host-fingerprint
must not be specified. See also
repo-sftp-host-check-type
option.
example: --repo1-sftp-known-host=/home/postgres/.ssh/known_hosts
SFTP Repository Private Key File Option ( --repo-sftp-private-key-file )
SFTP private key file.
SFTP private key file used for authentication.
example: --repo1-sftp-private-key-file=~/.ssh/id_ed25519
SFTP Repository Public Key File Option ( --repo-sftp-public-key-file )
SFTP public key file.
SFTP public key file used for authentication. Optional if compiled against OpenSSL, required if compiled against a different library.
example: --repo1-sftp-public-key-file=~/.ssh/id_ed25519.pub
Repository Storage CA File Option ( --repo-storage-ca-file )
Repository storage CA file.
Use a CA file other than the system default for storage (e.g. S3, Azure) certificates.
example: --repo1-storage-ca-file=/etc/pki/tls/certs/ca-bundle.crt
Deprecated Names: repo-azure-ca-file, repo-s3-ca-file
Repository Storage TLS CA Path Option ( --repo-storage-ca-path )
Repository storage CA path.
Use a CA path other than the system default for storage (e.g. S3, Azure) certificates.
example: --repo1-storage-ca-path=/etc/pki/tls/certs
Deprecated Names: repo-azure-ca-path, repo-s3-ca-path
Repository Storage Host Option ( --repo-storage-host )
Repository storage host.
Connect to a host other than the storage (e.g. S3, Azure) endpoint. This is typically used for testing.
example: --repo1-storage-host=127.0.0.1
Deprecated Names: repo-azure-host, repo-s3-host
Repository Storage Port Option ( --repo-storage-port )
Repository storage port.
Port to use when connecting to the storage (e.g. S3, Azure) endpoint (or host if specified).
default: 443 allowed: 1-65535 example: --repo1-storage-port=9000
Deprecated Names: repo-azure-port, repo-s3-port
Repository Storage Tag Option ( --repo-storage-tag )
Repository storage tag(s).
Specify tags that will be added to objects when the repository is an object store (e.g. S3). The option can be repeated to add multiple tags.
There is no provision in
pgBackRest
to modify these tags so be sure to set them correctly before running
stanza-create
to ensure uniform tags across the entire repository.
example: --repo1-storage-tag=key1=value1
Repository Storage Upload Chunk Size Option ( --repo-storage-upload-chunk-size )
Repository storage upload chunk size.
Object stores such as S3 allow files to be uploaded in chunks when the file is too large to be stored in memory. Even if the file can be stored in memory, it is more memory efficient to limit the amount of memory used for uploads.
A larger chunk size will generally lead to better performance because it will minimize upload requests and allow more files to be uploaded in a single request rather than in chunks. The disadvantage is that memory usage will be higher and because the chunk buffer must be allocated per process, larger
process-max
values will lead to more memory being consumed overall.
Default chunk sizes by repo type:
- azure - 4MiB
- gcs - 4MiB
- s3 - 5MiB
Note that valid chunk sizes vary by storage type and by platform. For example,
AWS S3
has a minimum chunk size of 5MiB but
S3
clones may accept lower values. Terminology for chunk size varies by storage type, so when searching min/max values use
part sizefor AWS S3 ,
chunk sizefor GCS , and
block sizefor Azure . No attempt is made to validate configured chunk sizes so selecting an invalid value will lead to errors from the storage service or undefined behavior.
allowed: 64KiB-1TiB example: --repo1-storage-upload-chunk-size=16MiB
Repository Storage Certificate Verify Option ( --repo-storage-verify-tls )
Repository storage certificate verify.
This option provides the ability to enable/disable verification of the storage (e.g. S3, Azure) server TLS certificate. Disabling should only be used for testing or other scenarios where a certificate has been self-signed.
default: y example: --no-repo1-storage-verify-tls
Deprecated Names: repo-azure-verify-tls, repo-s3-verify-ssl, repo-s3-verify-tls
Repository Type Option ( --repo-type )
Type of storage used for the repository.
The following repository types are supported:
- azure - Azure Blob Storage Service
- cifs - Like posix , but disables links and directory fsyncs
- gcs - Google Cloud Storage
- posix - Posix-compliant file systems
- s3 - AWS Simple Storage Service
- sftp - Secure File Transfer Protocol
When an
NFS
mount is used as a
posix
repository, the same rules apply to
pgBackRest
as described in the
PostgreSQL
documentation:
Creating a Database Cluster - File Systems
.
default: posix example: --repo1-type=cifs
Stanza Options
PostgreSQL Database Option ( --pg-database )
PostgreSQL
database.
The database name used when connecting to
PostgreSQL
. The default is usually best but some installations may not contain this database.
Note that for legacy reasons the setting of the
PGDATABASE
environment variable will be ignored.
default: postgres example: --pg1-database=backupdb
PostgreSQL Host Option ( --pg-host )
PostgreSQL
host for operating remotely.
Used for backups where the
PostgreSQL
host is different from the repository host.
example: --pg1-host=db.domain.com
Deprecated Name: db-host
PostgreSQL Host Certificate Authority File Option ( --pg-host-ca-file )
PostgreSQL
host certificate authority file.
Use a CA file other than the system default for connecting to the
PostgreSQL
host.
example: --pg1-host-ca-file=/etc/pki/tls/certs/ca-bundle.crt
PostgreSQL Host Certificate Authority Path Option ( --pg-host-ca-path )
PostgreSQL
host certificate authority path.
Use a CA path other than the system default for connecting to the
PostgreSQL
host.
example: --pg1-host-ca-path=/etc/pki/tls/certs
PostgreSQL Host Certificate File Option ( --pg-host-cert-file )
PostgreSQL
host certificate file.
Sent to
PostgreSQL
host to prove client identity.
example: --pg1-host-cert-file=/path/to/client.crt
PostgreSQL Host Command Option ( --pg-host-cmd )
PostgreSQL
host
pgBackRest
command.
Required only if the path to the
pgBackRest
command is different on the local and
PostgreSQL
hosts. If not defined, the
PostgreSQL
host command will be set the same as the local command.
example: --pg1-host-cmd=/usr/lib/backrest/bin/pgbackrest
Deprecated Name: db-cmd
PostgreSQL Host Configuration Option ( --pg-host-config )
pgBackRest
database host configuration file.
Sets the location of the configuration file on the
PostgreSQL
host. This is only required if the
PostgreSQL
host configuration file is in a different location than the local configuration file.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_FILE example: --pg1-host-config=/conf/pgbackrest/pgbackrest.conf
Deprecated Name: db-config
PostgreSQL Host Configuration Include Path Option ( --pg-host-config-include-path )
pgBackRest
database host configuration include path.
Sets the location of the configuration include path on the
PostgreSQL
host. This is only required if the
PostgreSQL
host configuration include path is in a different location than the local configuration include path.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_INCLUDE_PATH example: --pg1-host-config-include-path=/conf/pgbackrest/conf.d
PostgreSQL Host Configuration Path Option ( --pg-host-config-path )
pgBackRest
database host configuration path.
Sets the location of the configuration path on the
PostgreSQL
host. This is only required if the
PostgreSQL
host configuration path is in a different location than the local configuration path.
default: CFGOPTDEF_CONFIG_PATH example: --pg1-host-config-path=/conf/pgbackrest
PostgreSQL Host Key File Option ( --pg-host-key-file )
PostgreSQL
host key file.
Proves client certificate was sent by owner.
example: --pg1-host-key-file=/path/to/client.key
PostgreSQL Host Port Option ( --pg-host-port )
PostgreSQL
host port when
pg-host
is set.
Use this option to specify a non-default port for the
PostgreSQL
host protocol.
allowed: 0-65535 example: --pg1-host-port=25
Deprecated Name: db-ssh-port
PostgreSQL Host Protocol Type Option ( --pg-host-type )
PostgreSQL
host protocol type.
The following protocol types are supported:
- ssh - Secure Shell.
- tls - pgBackRest TLS server.
default: ssh example: --pg1-host-type=tls
PostgreSQL Host User Option ( --pg-host-user )
PostgreSQL
host logon user when
pg-host
is set.
This user will also own the remote
pgBackRest
process and will initiate connections to
PostgreSQL
. For this to work correctly the user should be the
PostgreSQL
database cluster owner which is generally
postgres
, the default.
default: postgres example: --pg1-host-user=db_owner
Deprecated Name: db-user
PostgreSQL Path Option ( --pg-path )
PostgreSQL
data directory.
This should be the same as the
data_directory
setting in
postgresql.conf
. Even though this value can be read from
postgresql.conf
or
PostgreSQL
it is prudent to set it in case those resources are not available during a restore or offline backup scenario.
The
pg-path
option is tested against the value reported by
PostgreSQL
on every online backup so it should always be current.
example: --pg1-path=/data/db
Deprecated Name: db-path
PostgreSQL Port Option ( --pg-port )
PostgreSQL
port.
Port that
PostgreSQL
is running on. This usually does not need to be specified as most
PostgreSQL
clusters run on the default port.
default: 5432 allowed: 0-65535 example: --pg1-port=6543
Deprecated Name: db-port
PostgreSQL Socket Path Option ( --pg-socket-path )
PostgreSQL
unix socket path.
The unix socket directory that was specified when
PostgreSQL
was started.
pgBackRest
will automatically look in the standard location for your OS so there is usually no need to specify this setting unless the socket directory was explicitly modified with the
unix_socket_directory
setting in
postgresql.conf
.
example: --pg1-socket-path=/var/run/postgresql
Deprecated Name: db-socket-path
Expire Command ( expire )
pgBackRest
does full backup rotation based on the retention type which can be a count or a time period. When a count is specified, then expiration is not concerned with when the backups were created but with how many must be retained. Differential and Incremental backups are count-based but will always be expired when the backup they depend on is expired. See sections
Full Backup Retention
and
Differential Backup Retention
for details and examples. Archived WAL is retained by default for backups that have not expired, however, although not recommended, this schedule can be modified per repository with the retention-archive options. See section
Archive Retention
for details and examples.
The
expire
command is run automatically after each successful backup and can also be run by the user. When run by the user, expiration will occur as defined by the retention settings for each configured repository. If the
--repo
option is provided, expiration will occur only on the specified repository. Expiration can also be limited by the user to a specific backup set with the
--set
option and, unless the
--repo
option is specified, all repositories will be searched and any matching the set criteria will be expired. It should be noted that the archive retention schedule will be checked and performed any time the
expire
command is run.
Command Options
Set Option ( --set )
Backup set to expire.
The specified backup set (i.e. the backup label provided and all of its dependent backups, if any) will be expired regardless of backup retention rules except that at least one full backup must remain in the repository.
WARNING:
Use this option with extreme caution — it will permanently remove all backups and archives not required to make a backup consistent from the
pgBackRest
repository for the specified backup set. This process may negate the ability to perform PITR. If
--repo-retention-full
and/or
--repo-retention-archive
options are configured, then it is recommended that you override these options by setting their values to the maximum while performing ad hoc expiration in order to prevent an unintended expiration of archives.
example: --set=20150131-153358F_20150131-153401I
General Options
Buffer Size Option ( --buffer-size )
Buffer size for I/O operations.
Buffer size used for copy, compress, encrypt, and other operations. The number of buffers used depends on options and each operation may use additional memory, e.g.
gz
compression may use an additional 256KiB of memory.
Allowed values are
16KiB
,
32KiB
,
64KiB
,
128KiB
,
256KiB
,
512KiB
,
1MiB
,
2MiB
,
4MiB
,
8MiB
, and
16MiB
.
default: 1MiB example: --buffer-size=2MiB
Config Option ( --config )
pgBackRest
configuration file.
Use this option to specify a different configuration file than the default.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_FILE example: --config=/conf/pgbackrest/pgbackrest.conf
Config Include Path Option ( --config-include-path )
Path to additional
pgBackRest
configuration files.
Configuration files existing in the specified location with extension
.conf
will be concatenated with the
pgBackRest
configuration file, resulting in one configuration file.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_INCLUDE_PATH example: --config-include-path=/conf/pgbackrest/conf.d
Config Path Option ( --config-path )
Base path of
pgBackRest
configuration files.
This setting is used to override the default base path setting for the
--config
and
--config-include-path
options unless they are explicitly set on the command-line.
For example, passing only
--config-path=/conf/pgbackrest
results in the
--config
default being set to
/conf/pgbackrest/pgbackrest.conf
and the
--config-include-path
default being set to
/conf/pgbackrest/conf.d
.
default: CFGOPTDEF_CONFIG_PATH example: --config-path=/conf/pgbackrest
Dry Run Option ( --dry-run )
Execute a dry-run for the command.
The
--dry-run
option is a command-line only option and can be passed when it is desirable to determine what modifications will be made by the command without the command actually making any modifications.
default: n example: --dry-run
I/O Timeout Option ( --io-timeout )
I/O timeout.
Timeout, in seconds, used for connections and read/write operations.
Note that the entire read/write operation does not need to complete within this timeout but
some
progress must be made, even if it is only a single byte.
default: 1m allowed: 100ms-1h example: --io-timeout=120
Lock Path Option ( --lock-path )
Path where lock files are stored.
The lock path provides a location for
pgBackRest
to create lock files to prevent conflicting operations from being run concurrently.
default: /tmp/pgbackrest example: --lock-path=/backup/db/lock
Neutral Umask Option ( --neutral-umask )
Use a neutral umask.
Sets the umask to 0000 so modes in the repository are created in a sensible way. The default directory mode is 0750 and default file mode is 0640. The lock and log directories set the directory and file mode to 0770 and 0660 respectively.
To use the executing user's umask instead specify
neutral-umask=n
in the config file or
--no-neutral-umask
on the command line.
default: y example: --no-neutral-umask
Keep Alive Option ( --sck-keep-alive )
Keep-alive enable.
Enables keep-alive messages on socket connections.
default: y example: --no-sck-keep-alive
Stanza Option ( --stanza )
Defines the stanza.
A stanza is the configuration for a
PostgreSQL
database cluster that defines where it is located, how it will be backed up, archiving options, etc. Most db servers will only have one
PostgreSQL
database cluster and therefore one stanza, whereas backup servers will have a stanza for every database cluster that needs to be backed up.
It is tempting to name the stanza after the primary cluster but a better name describes the databases contained in the cluster. Because the stanza name will be used for the primary and all replicas it is more appropriate to choose a name that describes the actual function of the cluster, such as app or dw, rather than the local cluster name, such as main or prod.
example: --stanza=main
Keep Alive Count Option ( --tcp-keep-alive-count )
Keep-alive count.
Specifies the number of TCP keep-alive messages that can be lost before the connection is considered dead.
This option is available on systems that support the
TCP_KEEPCNT
socket option.
allowed: 1-32 example: --tcp-keep-alive-count=3
Keep Alive Idle Option ( --tcp-keep-alive-idle )
Keep-alive idle time.
Specifies the amount of time (in seconds) with no network activity after which the operating system should send a TCP keep-alive message.
This option is available on systems that support the
TCP_KEEPIDLE
socket option.
allowed: 1-3600 example: --tcp-keep-alive-idle=60
Keep Alive Interval Option ( --tcp-keep-alive-interval )
Keep-alive interval time.
Specifies the amount of time (in seconds) after which a TCP keep-alive message that has not been acknowledged should be retransmitted.
This option is available on systems that support the
TCP_KEEPINTVL
socket option.
allowed: 1-900 example: --tcp-keep-alive-interval=30
Log Options
Console Log Level Option ( --log-level-console )
Level for console logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: warn example: --log-level-console=error
File Log Level Option ( --log-level-file )
Level for file logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: info example: --log-level-file=debug
Std Error Log Level Option ( --log-level-stderr )
Level for stderr logging.
Specifies which log levels will output to
stderr
rather than
stdout
(specified by
log-level-console
). The timestamp and process will not be output to
stderr
.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: off example: --log-level-stderr=error
Repository Options
Set Repository Option ( --repo )
Set repository.
Set the repository for a command to operate on.
For example, this option may be used to perform a restore from a specific repository, rather than letting
pgBackRest
choose.
allowed: 1-256 example: --repo=1
Azure Repository Container Option ( --repo-azure-container )
Azure repository container.
Azure container used to store the repository.
pgBackRest
repositories can be stored in the container root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other Azure-generated content can also be stored in the container.
example: --repo1-azure-container=pg-backup
Azure Repository Key Type Option ( --repo-azure-key-type )
Azure repository key type.
The following types are supported for authorization:
- shared - Shared key
- sas - Shared access signature
default: shared example: --repo1-azure-key-type=sas
Azure Repository URI Style Option ( --repo-azure-uri-style )
Azure URI Style.
The following URI styles are supported:
- host - Connect to account.endpoint host.
- path - Connect to endpoint host and prepend account to URIs.
default: host example: --repo1-azure-uri-style=path
Repository Cipher Type Option ( --repo-cipher-type )
Cipher used to encrypt the repository.
The following cipher types are supported:
- none - The repository is not encrypted
- aes-256-cbc - Advanced Encryption Standard with 256 bit key length
Note that encryption is always performed client-side even if the repository type (e.g. S3) supports encryption.
default: none example: --repo1-cipher-type=aes-256-cbc
GCS Repository Bucket Option ( --repo-gcs-bucket )
GCS repository bucket.
GCS bucket used to store the repository.
pgBackRest
repositories can be stored in the bucket root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other GCS-generated content can also be stored in the bucket.
example: --repo1-gcs-bucket=/pg-backup
GCS Repository Endpoint Option ( --repo-gcs-endpoint )
GCS repository endpoint.
Endpoint used to connect to the storage service. May be updated to use a local GCS server or alternate endpoint.
default: storage.googleapis.com example: --repo1-gcs-endpoint=localhost
GCS Repository Key Type Option ( --repo-gcs-key-type )
GCS repository key type.
The following types are supported for authorization:
- auto - Authorize using the instance service account.
- service - Service account from locally stored key.
- token - For local testing, e.g. fakegcs .
When
repo-gcs-key-type=service
the credentials will be reloaded when the authentication token is renewed.
default: service example: --repo1-gcs-key-type=auto
Repository Path Option ( --repo-path )
Path where backups and archive are stored.
The repository is where
pgBackRest
stores backups and archives WAL segments.
It may be difficult to estimate in advance how much space you'll need. The best thing to do is take some backups then record the size of different types of backups (full/incr/diff) and measure the amount of WAL generated per day. This will give you a general idea of how much space you'll need, though of course requirements will likely change over time as your database evolves.
default: /var/lib/pgbackrest example: --repo1-path=/backup/db/backrest
Archive Retention Option ( --repo-retention-archive )
Number of backups worth of continuous WAL to retain.
NOTE:
WAL segments required to make a backup consistent are always retained until the backup is expired regardless of how this option is configured.
If this value is not set and
repo-retention-full-type
is
count
(default), then the archive to expire will default to the
repo-retention-full
(or
repo-retention-diff
) value corresponding to the
repo-retention-archive-type
if set to
full
(or
diff
). This will ensure that WAL is only expired for backups that are already expired. If
repo-retention-full-type
is
time
, then this value will default to removing archives that are earlier than the oldest full backup retained after satisfying the
repo-retention-full
setting.
This option must be set if
repo-retention-archive-type
is set to
incr
. If disk space is at a premium, then this setting, in conjunction with
repo-retention-archive-type
, can be used to aggressively expire WAL segments. However, doing so negates the ability to perform PITR from the backups with expired WAL and is therefore
not
recommended.
allowed: 1-9999999 example: --repo1-retention-archive=2
Deprecated Name: retention-archive
Archive Retention Type Option ( --repo-retention-archive-type )
Backup type for WAL retention.
If set to
full
pgBackRest
will keep archive logs for the number of full backups defined by
repo-retention-archive
. If set to
diff
(differential)
pgBackRest
will keep archive logs for the number of full and differential backups defined by
repo-retention-archive
, meaning if the last backup taken was a full backup, it will be counted as a differential for the purpose of repo-retention. If set to
incr
(incremental)
pgBackRest
will keep archive logs for the number of full, differential, and incremental backups defined by
repo-retention-archive
. It is recommended that this setting not be changed from the default which will only expire WAL in conjunction with expiring full backups.
default: full example: --repo1-retention-archive-type=diff
Deprecated Name: retention-archive-type
Differential Retention Option ( --repo-retention-diff )
Number of differential backups to retain.
When a differential backup expires, all incremental backups associated with the differential backup will also expire. When not defined all differential backups will be kept until the full backups they depend on expire.
allowed: 1-9999999 example: --repo1-retention-diff=3
Deprecated Name: retention-diff
Full Retention Option ( --repo-retention-full )
Full backup retention count/time.
When a full backup expires, all differential and incremental backups associated with the full backup will also expire. When the option is not defined a warning will be issued. If indefinite retention is desired then set the option to the max value.
allowed: 1-9999999 example: --repo1-retention-full=2
Deprecated Name: retention-full
Full Retention Type Option ( --repo-retention-full-type )
Retention type for full backups.
Determines whether the
repo-retention-full
setting represents a time period (days) or count of full backups to keep. If set to
time
then full backups older than
repo-retention-full
will be removed from the repository if there is at least one backup that is equal to or greater than the
repo-retention-full
setting. For example, if
repo-retention-full
is 30 (days) and there are 2 full backups: one 25 days old and one 35 days old, no full backups will be expired because expiring the 35 day old backup would leave only the 25 day old backup, which would violate the 30 day retention policy of having at least one backup 30 days old before an older one can be expired. Archived WAL older than the oldest full backup remaining will be automatically expired unless
repo-retention-archive-type
and
repo-retention-archive
are explicitly set.
default: count example: --repo1-retention-full-type=time
Backup History Retention Option ( --repo-retention-history )
Days of backup history manifests to retain.
A copy of the backup manifest is stored in the
backup.history
path when a backup completes. By default these files are never expired since they are useful for data mining, e.g. measuring backup and WAL growth over time.
Set
repo-retention-history
to define the number of days of backup history manifests to retain. Unexpired backups are always kept in the backup history. Specify
repo-retention-history=0
to retain the backup history only for unexpired backups.
When a full backup history manifest is expired, all differential and incremental backup history manifests associated with the full backup also expire.
allowed: 0-9999999 example: --repo1-retention-history=365
S3 Repository Bucket Option ( --repo-s3-bucket )
S3 repository bucket.
S3 bucket used to store the repository.
pgBackRest
repositories can be stored in the bucket root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other AWS generated content can also be stored in the bucket.
example: --repo1-s3-bucket=pg-backup
S3 Repository Endpoint Option ( --repo-s3-endpoint )
S3 repository endpoint.
The AWS endpoint should be valid for the selected region.
For custom/test configurations the
repo-storage-ca-file
,
repo-storage-ca-path
,
repo-storage-host
,
repo-storage-port
, and
repo-storage-verify-tls
options may be useful.
example: --repo1-s3-endpoint=s3.amazonaws.com
S3 Repository Key Type Option ( --repo-s3-key-type )
S3 repository key type.
The following types are supported:
- shared - Shared keys
- auto - Automatically retrieve temporary credentials
- web-id - Automatically retrieve web identity credentials
default: shared example: --repo1-s3-key-type=auto
S3 Repository KMS Key ID Option ( --repo-s3-kms-key-id )
S3 repository KMS key.
Setting this option enables S3 server-side encryption using the specified AWS key management service key.
example: --repo1-s3-kms-key-id=bceb4f13-6939-4be3-910d-df54dee817b7
S3 Repository Region Option ( --repo-s3-region )
S3 repository region.
The AWS region where the bucket was created.
example: --repo1-s3-region=us-east-1
S3 Repository Role Option ( --repo-s3-role )
S3 repository role.
The AWS role name (not the full ARN) used to retrieve temporary credentials when
repo-s3-key-type=auto
.
example: --repo1-s3-role=authrole
S3 Repository URI Style Option ( --repo-s3-uri-style )
S3 URI Style.
The following URI styles are supported:
- host - Connect to bucket.endpoint host.
- path - Connect to endpoint host and prepend bucket to URIs.
default: host example: --repo1-s3-uri-style=path
SFTP Repository Host Option ( --repo-sftp-host )
SFTP repository host.
The SFTP host containing the repository.
example: --repo1-sftp-host=sftprepo.domain
SFTP Repository Host Fingerprint Option ( --repo-sftp-host-fingerprint )
SFTP repository host fingerprint.
SFTP repository host fingerprint generation should match the
repo-sftp-host-key-hash-type
. Generate the fingerprint via
awk '{print $2}' ssh_host_xxx_key.pub | base64 -d | (md5sum or sha1sum) -b
. The ssh host keys are normally found in the
/etc/ssh
directory.
example: --repo1-sftp-host-fingerprint=f84e172dfead7aeeeae6c1fdfb5aa8cf
SFTP Host Key Check Type Option ( --repo-sftp-host-key-check-type )
SFTP host key check type.
The following SFTP host key check types are supported:
- strict - pgBackRest will never automatically add host keys to the ~/.ssh/known_hosts file, and refuses to connect to hosts whose host key has changed or is not found in the known hosts files. This option forces the user to manually add all new hosts.
- accept-new - pgBackRest will automatically add new host keys to the user's known hosts file, but will not permit connections to hosts with changed host keys.
- fingerprint - pgBackRest will check the host key against the fingerprint specified by the repo-sftp-host-fingerprint option.
- none - no host key checking will be performed.
default: strict example: --repo1-sftp-host-key-check-type=accept-new
SFTP Repository Host Key Hash Type Option ( --repo-sftp-host-key-hash-type )
SFTP repository host key hash type.
SFTP repository host key hash type. Declares the hash type to be used to compute the digest of the remote system's host key on SSH startup. Newer versions of
libssh2
support
sha256
in addition to md5 and sha1.
example: --repo1-sftp-host-key-hash-type=sha256
SFTP Repository Host Port Option ( --repo-sftp-host-port )
SFTP repository host port.
SFTP repository host port.
default: 22 allowed: 1-65535 example: --repo1-sftp-host-port=22
SFTP Repository Host User Option ( --repo-sftp-host-user )
SFTP repository host user.
User on the host used to store the repository.
example: --repo1-sftp-host-user=pg-backup
SFTP Known Hosts File Option ( --repo-sftp-known-host )
SFTP known hosts file.
A known hosts file to search for an SFTP host match during authentication. When unspecified,
pgBackRest
will default to searching
~/.ssh/known_hosts
,
~/.ssh/known_hosts2
,
/etc/ssh/ssh_known_hosts
, and
/etc/ssh/ssh_known_hosts2
. If configured with one or more file paths,
pgBackRest
will search those for a match. File paths must be full or leading tilde paths. The
repo-sftp-known-host
option can be passed multiple times to specify more than one known hosts file to search. To utilize known hosts file checking
repo-sftp-host-fingerprint
must not be specified. See also
repo-sftp-host-check-type
option.
example: --repo1-sftp-known-host=/home/postgres/.ssh/known_hosts
SFTP Repository Private Key File Option ( --repo-sftp-private-key-file )
SFTP private key file.
SFTP private key file used for authentication.
example: --repo1-sftp-private-key-file=~/.ssh/id_ed25519
SFTP Repository Public Key File Option ( --repo-sftp-public-key-file )
SFTP public key file.
SFTP public key file used for authentication. Optional if compiled against OpenSSL, required if compiled against a different library.
example: --repo1-sftp-public-key-file=~/.ssh/id_ed25519.pub
Repository Storage CA File Option ( --repo-storage-ca-file )
Repository storage CA file.
Use a CA file other than the system default for storage (e.g. S3, Azure) certificates.
example: --repo1-storage-ca-file=/etc/pki/tls/certs/ca-bundle.crt
Deprecated Names: repo-azure-ca-file, repo-s3-ca-file
Repository Storage TLS CA Path Option ( --repo-storage-ca-path )
Repository storage CA path.
Use a CA path other than the system default for storage (e.g. S3, Azure) certificates.
example: --repo1-storage-ca-path=/etc/pki/tls/certs
Deprecated Names: repo-azure-ca-path, repo-s3-ca-path
Repository Storage Host Option ( --repo-storage-host )
Repository storage host.
Connect to a host other than the storage (e.g. S3, Azure) endpoint. This is typically used for testing.
example: --repo1-storage-host=127.0.0.1
Deprecated Names: repo-azure-host, repo-s3-host
Repository Storage Port Option ( --repo-storage-port )
Repository storage port.
Port to use when connecting to the storage (e.g. S3, Azure) endpoint (or host if specified).
default: 443 allowed: 1-65535 example: --repo1-storage-port=9000
Deprecated Names: repo-azure-port, repo-s3-port
Repository Storage Tag Option ( --repo-storage-tag )
Repository storage tag(s).
Specify tags that will be added to objects when the repository is an object store (e.g. S3). The option can be repeated to add multiple tags.
There is no provision in
pgBackRest
to modify these tags so be sure to set them correctly before running
stanza-create
to ensure uniform tags across the entire repository.
example: --repo1-storage-tag=key1=value1
Repository Storage Upload Chunk Size Option ( --repo-storage-upload-chunk-size )
Repository storage upload chunk size.
Object stores such as S3 allow files to be uploaded in chunks when the file is too large to be stored in memory. Even if the file can be stored in memory, it is more memory efficient to limit the amount of memory used for uploads.
A larger chunk size will generally lead to better performance because it will minimize upload requests and allow more files to be uploaded in a single request rather than in chunks. The disadvantage is that memory usage will be higher and because the chunk buffer must be allocated per process, larger
process-max
values will lead to more memory being consumed overall.
Default chunk sizes by repo type:
- azure - 4MiB
- gcs - 4MiB
- s3 - 5MiB
Note that valid chunk sizes vary by storage type and by platform. For example,
AWS S3
has a minimum chunk size of 5MiB but
S3
clones may accept lower values. Terminology for chunk size varies by storage type, so when searching min/max values use
part sizefor AWS S3 ,
chunk sizefor GCS , and
block sizefor Azure . No attempt is made to validate configured chunk sizes so selecting an invalid value will lead to errors from the storage service or undefined behavior.
allowed: 64KiB-1TiB example: --repo1-storage-upload-chunk-size=16MiB
Repository Storage Certificate Verify Option ( --repo-storage-verify-tls )
Repository storage certificate verify.
This option provides the ability to enable/disable verification of the storage (e.g. S3, Azure) server TLS certificate. Disabling should only be used for testing or other scenarios where a certificate has been self-signed.
default: y example: --no-repo1-storage-verify-tls
Deprecated Names: repo-azure-verify-tls, repo-s3-verify-ssl, repo-s3-verify-tls
Repository Type Option ( --repo-type )
Type of storage used for the repository.
The following repository types are supported:
- azure - Azure Blob Storage Service
- cifs - Like posix , but disables links and directory fsyncs
- gcs - Google Cloud Storage
- posix - Posix-compliant file systems
- s3 - AWS Simple Storage Service
- sftp - Secure File Transfer Protocol
When an
NFS
mount is used as a
posix
repository, the same rules apply to
pgBackRest
as described in the
PostgreSQL
documentation:
Creating a Database Cluster - File Systems
.
default: posix example: --repo1-type=cifs
Help Command ( help )
Three levels of help are provided. If no command is specified then general help will be displayed. If a command is specified (e.g.
pgbackrest help backup
) then a full description of the command will be displayed along with a list of valid options. If an option is specified in addition to a command (e.g.
pgbackrest help backup type
) then a full description of the option as it applies to the command will be displayed.
Info Command ( info )
The
info
command operates on a single stanza or all stanzas. Text output is the default and gives a human-readable summary of backups for the stanza(s) requested. This format is subject to change with any release.
For machine-readable output use
--output=json
. The JSON output contains far more information than the text output and is kept stable unless a bug is found.
Each stanza has a separate section and it is possible to limit output to a single stanza with the
--stanza
option. The stanza '
status
' gives a brief indication of the stanza's health. If this is '
ok
' then
pgBackRest
is functioning normally. If there are multiple repositories, then a status of '
mixed
' indicates that the stanza is not in a healthy state on one or more of the repositories; in this case the state of the stanza will be detailed per repository. For cases in which an error on a repository occurred that is not one of the known error codes, then an error code of '
other
' will be used and the full error details will be provided. The '
wal archive min/max
' shows the minimum and maximum WAL currently stored in the archive and, in the case of multiple repositories, will be reported across all repositories unless the
--repo
option is set. Note that there may be gaps due to archive retention policies or other reasons.
The '
backup/expire running
' message will appear beside the '
status
' information if one of those commands is currently running on the host.
The backups are displayed oldest to newest. The oldest backup will
always
be a full backup (indicated by an
F
at the end of the label) but the newest backup can be full, differential (ends with
D
), or incremental (ends with
I
).
The '
timestamp start/stop
' defines the time period when the backup ran. The '
timestamp stop
' can be used to determine the backup to use when performing Point-In-Time Recovery. More information about Point-In-Time Recovery can be found in the
Point-In-Time Recovery
section.
The '
wal start/stop
' defines the WAL range that is required to make the database consistent when restoring. The
backup
command will ensure that this WAL range is in the archive before completing.
The '
database size
' is the full uncompressed size of the database while '
database backup size
' is the amount of data in the database to actually back up (these will be the same for full backups).
The '
repo
' indicates in which repository this backup resides. The '
backup set size
' includes all the files from this backup and any referenced backups in the repository that are required to restore the database from this backup while '
backup size
' includes only the files in this backup (these will also be the same for full backups). Repository sizes reflect compressed file sizes if compression is enabled in
pgBackRest
.
The '
backup reference list
' contains the additional backups that are required to restore this backup.
Command Options
Output Option ( --output )
Output format.
The following output types are supported:
- text - Human-readable summary of backup information.
- json - Exhaustive machine-readable backup information in JSON format.
default: text example: --output=json
Set Option ( --set )
Backup set to detail.
Details include a list of databases (with OIDs) in the backup set (excluding template databases), tablespaces (with OIDs) with the destination where they will be restored by default, and symlinks with the destination where they will be restored when
--link-all
is specified.
example: --set=20150131-153358F_20150131-153401I
General Options
Buffer Size Option ( --buffer-size )
Buffer size for I/O operations.
Buffer size used for copy, compress, encrypt, and other operations. The number of buffers used depends on options and each operation may use additional memory, e.g.
gz
compression may use an additional 256KiB of memory.
Allowed values are
16KiB
,
32KiB
,
64KiB
,
128KiB
,
256KiB
,
512KiB
,
1MiB
,
2MiB
,
4MiB
,
8MiB
, and
16MiB
.
default: 1MiB example: --buffer-size=2MiB
pgBackRest Command Option ( --cmd )
pgBackRest
command.
pgBackRest
may generate a command string, e.g. when the
restore
command generates the
restore_command
setting. The command used to run the
pgBackRest
process will be used in this case unless the
cmd
option is provided.
CAUTION:
Wrapping the
pgBackRest
command may cause unpredictable behavior and is not recommended.
example: --cmd=/var/lib/pgsql/bin/pgbackrest_wrapper.sh
SSH Client Command Option ( --cmd-ssh )
SSH client command.
Use a specific SSH client command when an alternate is desired or the
ssh
command is not in $PATH.
default: ssh example: --cmd-ssh=/usr/bin/ssh
Network Compress Level Option ( --compress-level-network )
Network compression level.
Sets the network compression level when
compress-type=none
and the command is not run on the same host as the repository. Compression is used to reduce network traffic but can be disabled by setting
compress-level-network=0
. When
compress-type
does not equal
none
the
compress-level-network
setting is ignored and
compress-level
is used instead so that the file is only compressed once.
default: 3 allowed: 0-9 example: --compress-level-network=1
Config Option ( --config )
pgBackRest
configuration file.
Use this option to specify a different configuration file than the default.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_FILE example: --config=/conf/pgbackrest/pgbackrest.conf
Config Include Path Option ( --config-include-path )
Path to additional
pgBackRest
configuration files.
Configuration files existing in the specified location with extension
.conf
will be concatenated with the
pgBackRest
configuration file, resulting in one configuration file.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_INCLUDE_PATH example: --config-include-path=/conf/pgbackrest/conf.d
Config Path Option ( --config-path )
Base path of
pgBackRest
configuration files.
This setting is used to override the default base path setting for the
--config
and
--config-include-path
options unless they are explicitly set on the command-line.
For example, passing only
--config-path=/conf/pgbackrest
results in the
--config
default being set to
/conf/pgbackrest/pgbackrest.conf
and the
--config-include-path
default being set to
/conf/pgbackrest/conf.d
.
default: CFGOPTDEF_CONFIG_PATH example: --config-path=/conf/pgbackrest
I/O Timeout Option ( --io-timeout )
I/O timeout.
Timeout, in seconds, used for connections and read/write operations.
Note that the entire read/write operation does not need to complete within this timeout but
some
progress must be made, even if it is only a single byte.
default: 1m allowed: 100ms-1h example: --io-timeout=120
Lock Path Option ( --lock-path )
Path where lock files are stored.
The lock path provides a location for
pgBackRest
to create lock files to prevent conflicting operations from being run concurrently.
default: /tmp/pgbackrest example: --lock-path=/backup/db/lock
Protocol Timeout Option ( --protocol-timeout )
Protocol timeout.
Sets the timeout, in seconds, that the local or remote process will wait for a new message to be received on the protocol layer. This prevents processes from waiting indefinitely for a message.
NOTE:
The
protocol-timeout
option must be greater than the
db-timeout
option.
default: 31m allowed: 100ms-7d example: --protocol-timeout=630
Keep Alive Option ( --sck-keep-alive )
Keep-alive enable.
Enables keep-alive messages on socket connections.
default: y example: --no-sck-keep-alive
Stanza Option ( --stanza )
Defines the stanza.
A stanza is the configuration for a
PostgreSQL
database cluster that defines where it is located, how it will be backed up, archiving options, etc. Most db servers will only have one
PostgreSQL
database cluster and therefore one stanza, whereas backup servers will have a stanza for every database cluster that needs to be backed up.
It is tempting to name the stanza after the primary cluster but a better name describes the databases contained in the cluster. Because the stanza name will be used for the primary and all replicas it is more appropriate to choose a name that describes the actual function of the cluster, such as app or dw, rather than the local cluster name, such as main or prod.
example: --stanza=main
Keep Alive Count Option ( --tcp-keep-alive-count )
Keep-alive count.
Specifies the number of TCP keep-alive messages that can be lost before the connection is considered dead.
This option is available on systems that support the
TCP_KEEPCNT
socket option.
allowed: 1-32 example: --tcp-keep-alive-count=3
Keep Alive Idle Option ( --tcp-keep-alive-idle )
Keep-alive idle time.
Specifies the amount of time (in seconds) with no network activity after which the operating system should send a TCP keep-alive message.
This option is available on systems that support the
TCP_KEEPIDLE
socket option.
allowed: 1-3600 example: --tcp-keep-alive-idle=60
Keep Alive Interval Option ( --tcp-keep-alive-interval )
Keep-alive interval time.
Specifies the amount of time (in seconds) after which a TCP keep-alive message that has not been acknowledged should be retransmitted.
This option is available on systems that support the
TCP_KEEPINTVL
socket option.
allowed: 1-900 example: --tcp-keep-alive-interval=30
Log Options
Console Log Level Option ( --log-level-console )
Level for console logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: warn example: --log-level-console=error
File Log Level Option ( --log-level-file )
Level for file logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: info example: --log-level-file=debug
Std Error Log Level Option ( --log-level-stderr )
Level for stderr logging.
Specifies which log levels will output to
stderr
rather than
stdout
(specified by
log-level-console
). The timestamp and process will not be output to
stderr
.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: off example: --log-level-stderr=error
Log Path Option ( --log-path )
Path where log files are stored.
The log path provides a location for
pgBackRest
to store log files. Note that if
log-level-file=off
then no log path is required.
default: /var/log/pgbackrest example: --log-path=/backup/db/log
Repository Options
Set Repository Option ( --repo )
Set repository.
Set the repository for a command to operate on.
For example, this option may be used to perform a restore from a specific repository, rather than letting
pgBackRest
choose.
allowed: 1-256 example: --repo=1
Azure Repository Container Option ( --repo-azure-container )
Azure repository container.
Azure container used to store the repository.
pgBackRest
repositories can be stored in the container root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other Azure-generated content can also be stored in the container.
example: --repo1-azure-container=pg-backup
Azure Repository Key Type Option ( --repo-azure-key-type )
Azure repository key type.
The following types are supported for authorization:
- shared - Shared key
- sas - Shared access signature
default: shared example: --repo1-azure-key-type=sas
Azure Repository URI Style Option ( --repo-azure-uri-style )
Azure URI Style.
The following URI styles are supported:
- host - Connect to account.endpoint host.
- path - Connect to endpoint host and prepend account to URIs.
default: host example: --repo1-azure-uri-style=path
Repository Cipher Type Option ( --repo-cipher-type )
Cipher used to encrypt the repository.
The following cipher types are supported:
- none - The repository is not encrypted
- aes-256-cbc - Advanced Encryption Standard with 256 bit key length
Note that encryption is always performed client-side even if the repository type (e.g. S3) supports encryption.
default: none example: --repo1-cipher-type=aes-256-cbc
GCS Repository Bucket Option ( --repo-gcs-bucket )
GCS repository bucket.
GCS bucket used to store the repository.
pgBackRest
repositories can be stored in the bucket root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other GCS-generated content can also be stored in the bucket.
example: --repo1-gcs-bucket=/pg-backup
GCS Repository Endpoint Option ( --repo-gcs-endpoint )
GCS repository endpoint.
Endpoint used to connect to the storage service. May be updated to use a local GCS server or alternate endpoint.
default: storage.googleapis.com example: --repo1-gcs-endpoint=localhost
GCS Repository Key Type Option ( --repo-gcs-key-type )
GCS repository key type.
The following types are supported for authorization:
- auto - Authorize using the instance service account.
- service - Service account from locally stored key.
- token - For local testing, e.g. fakegcs .
When
repo-gcs-key-type=service
the credentials will be reloaded when the authentication token is renewed.
default: service example: --repo1-gcs-key-type=auto
Repository Host Option ( --repo-host )
Repository host when operating remotely.
When backing up and archiving to a locally mounted filesystem this setting is not required.
example: --repo1-host=repo1.domain.com
Deprecated Name: backup-host
Repository Host Certificate Authority File Option ( --repo-host-ca-file )
Repository host certificate authority file.
Use a CA file other than the system default for connecting to the repository host.
example: --repo1-host-ca-file=/etc/pki/tls/certs/ca-bundle.crt
Repository Host Certificate Authority Path Option ( --repo-host-ca-path )
Repository host certificate authority path.
Use a CA path other than the system default for connecting to the repository host.
example: --repo1-host-ca-path=/etc/pki/tls/certs
Repository Host Certificate File Option ( --repo-host-cert-file )
Repository host certificate file.
Sent to repository host to prove client identity.
example: --repo1-host-cert-file=/path/to/client.crt
Repository Host Command Option ( --repo-host-cmd )
Repository host
pgBackRest
command.
Required only if the path to the
pgBackRest
command is different on the local and repository hosts. If not defined, the repository host command will be set the same as the local command.
example: --repo1-host-cmd=/usr/lib/backrest/bin/pgbackrest
Deprecated Name: backup-cmd
Repository Host Configuration Option ( --repo-host-config )
pgBackRest
repository host configuration file.
Sets the location of the configuration file on the repository host. This is only required if the repository host configuration file is in a different location than the local configuration file.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_FILE example: --repo1-host-config=/conf/pgbackrest/pgbackrest.conf
Deprecated Name: backup-config
Repository Host Configuration Include Path Option ( --repo-host-config-include-path )
pgBackRest
repository host configuration include path.
Sets the location of the configuration include path on the repository host. This is only required if the repository host configuration include path is in a different location than the local configuration include path.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_INCLUDE_PATH example: --repo1-host-config-include-path=/conf/pgbackrest/conf.d
Repository Host Configuration Path Option ( --repo-host-config-path )
pgBackRest
repository host configuration path.
Sets the location of the configuration path on the repository host. This is only required if the repository host configuration path is in a different location than the local configuration path.
default: CFGOPTDEF_CONFIG_PATH example: --repo1-host-config-path=/conf/pgbackrest
Repository Host Key File Option ( --repo-host-key-file )
Repository host key file.
Proves client certificate was sent by owner.
example: --repo1-host-key-file=/path/to/client.key
Repository Host Port Option ( --repo-host-port )
Repository host port when
repo-host
is set.
Use this option to specify a non-default port for the repository host protocol.
allowed: 0-65535 example: --repo1-host-port=25
Deprecated Name: backup-ssh-port
Repository Host Protocol Type Option ( --repo-host-type )
Repository host protocol type.
The following protocol types are supported:
- ssh - Secure Shell.
- tls - pgBackRest TLS server.
default: ssh example: --repo1-host-type=tls
Repository Host User Option ( --repo-host-user )
Repository host user when
repo-host
is set.
Defines the user that will be used for operations on the repository host. Preferably this is not the
postgres
user but rather some other user like
pgbackrest
. If
PostgreSQL
runs on the repository host the
postgres
user can be placed in the
pgbackrest
group so it has read permissions on the repository without being able to damage the contents accidentally.
default: pgbackrest example: --repo1-host-user=repo-user
Deprecated Name: backup-user
Repository Path Option ( --repo-path )
Path where backups and archive are stored.
The repository is where
pgBackRest
stores backups and archives WAL segments.
It may be difficult to estimate in advance how much space you'll need. The best thing to do is take some backups then record the size of different types of backups (full/incr/diff) and measure the amount of WAL generated per day. This will give you a general idea of how much space you'll need, though of course requirements will likely change over time as your database evolves.
default: /var/lib/pgbackrest example: --repo1-path=/backup/db/backrest
S3 Repository Bucket Option ( --repo-s3-bucket )
S3 repository bucket.
S3 bucket used to store the repository.
pgBackRest
repositories can be stored in the bucket root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other AWS generated content can also be stored in the bucket.
example: --repo1-s3-bucket=pg-backup
S3 Repository Endpoint Option ( --repo-s3-endpoint )
S3 repository endpoint.
The AWS endpoint should be valid for the selected region.
For custom/test configurations the
repo-storage-ca-file
,
repo-storage-ca-path
,
repo-storage-host
,
repo-storage-port
, and
repo-storage-verify-tls
options may be useful.
example: --repo1-s3-endpoint=s3.amazonaws.com
S3 Repository Key Type Option ( --repo-s3-key-type )
S3 repository key type.
The following types are supported:
- shared - Shared keys
- auto - Automatically retrieve temporary credentials
- web-id - Automatically retrieve web identity credentials
default: shared example: --repo1-s3-key-type=auto
S3 Repository KMS Key ID Option ( --repo-s3-kms-key-id )
S3 repository KMS key.
Setting this option enables S3 server-side encryption using the specified AWS key management service key.
example: --repo1-s3-kms-key-id=bceb4f13-6939-4be3-910d-df54dee817b7
S3 Repository Region Option ( --repo-s3-region )
S3 repository region.
The AWS region where the bucket was created.
example: --repo1-s3-region=us-east-1
S3 Repository Role Option ( --repo-s3-role )
S3 repository role.
The AWS role name (not the full ARN) used to retrieve temporary credentials when
repo-s3-key-type=auto
.
example: --repo1-s3-role=authrole
S3 Repository URI Style Option ( --repo-s3-uri-style )
S3 URI Style.
The following URI styles are supported:
- host - Connect to bucket.endpoint host.
- path - Connect to endpoint host and prepend bucket to URIs.
default: host example: --repo1-s3-uri-style=path
SFTP Repository Host Option ( --repo-sftp-host )
SFTP repository host.
The SFTP host containing the repository.
example: --repo1-sftp-host=sftprepo.domain
SFTP Repository Host Fingerprint Option ( --repo-sftp-host-fingerprint )
SFTP repository host fingerprint.
SFTP repository host fingerprint generation should match the
repo-sftp-host-key-hash-type
. Generate the fingerprint via
awk '{print $2}' ssh_host_xxx_key.pub | base64 -d | (md5sum or sha1sum) -b
. The ssh host keys are normally found in the
/etc/ssh
directory.
example: --repo1-sftp-host-fingerprint=f84e172dfead7aeeeae6c1fdfb5aa8cf
SFTP Host Key Check Type Option ( --repo-sftp-host-key-check-type )
SFTP host key check type.
The following SFTP host key check types are supported:
- strict - pgBackRest will never automatically add host keys to the ~/.ssh/known_hosts file, and refuses to connect to hosts whose host key has changed or is not found in the known hosts files. This option forces the user to manually add all new hosts.
- accept-new - pgBackRest will automatically add new host keys to the user's known hosts file, but will not permit connections to hosts with changed host keys.
- fingerprint - pgBackRest will check the host key against the fingerprint specified by the repo-sftp-host-fingerprint option.
- none - no host key checking will be performed.
default: strict example: --repo1-sftp-host-key-check-type=accept-new
SFTP Repository Host Key Hash Type Option ( --repo-sftp-host-key-hash-type )
SFTP repository host key hash type.
SFTP repository host key hash type. Declares the hash type to be used to compute the digest of the remote system's host key on SSH startup. Newer versions of
libssh2
support
sha256
in addition to md5 and sha1.
example: --repo1-sftp-host-key-hash-type=sha256
SFTP Repository Host Port Option ( --repo-sftp-host-port )
SFTP repository host port.
SFTP repository host port.
default: 22 allowed: 1-65535 example: --repo1-sftp-host-port=22
SFTP Repository Host User Option ( --repo-sftp-host-user )
SFTP repository host user.
User on the host used to store the repository.
example: --repo1-sftp-host-user=pg-backup
SFTP Known Hosts File Option ( --repo-sftp-known-host )
SFTP known hosts file.
A known hosts file to search for an SFTP host match during authentication. When unspecified,
pgBackRest
will default to searching
~/.ssh/known_hosts
,
~/.ssh/known_hosts2
,
/etc/ssh/ssh_known_hosts
, and
/etc/ssh/ssh_known_hosts2
. If configured with one or more file paths,
pgBackRest
will search those for a match. File paths must be full or leading tilde paths. The
repo-sftp-known-host
option can be passed multiple times to specify more than one known hosts file to search. To utilize known hosts file checking
repo-sftp-host-fingerprint
must not be specified. See also
repo-sftp-host-check-type
option.
example: --repo1-sftp-known-host=/home/postgres/.ssh/known_hosts
SFTP Repository Private Key File Option ( --repo-sftp-private-key-file )
SFTP private key file.
SFTP private key file used for authentication.
example: --repo1-sftp-private-key-file=~/.ssh/id_ed25519
SFTP Repository Public Key File Option ( --repo-sftp-public-key-file )
SFTP public key file.
SFTP public key file used for authentication. Optional if compiled against OpenSSL, required if compiled against a different library.
example: --repo1-sftp-public-key-file=~/.ssh/id_ed25519.pub
Repository Storage CA File Option ( --repo-storage-ca-file )
Repository storage CA file.
Use a CA file other than the system default for storage (e.g. S3, Azure) certificates.
example: --repo1-storage-ca-file=/etc/pki/tls/certs/ca-bundle.crt
Deprecated Names: repo-azure-ca-file, repo-s3-ca-file
Repository Storage TLS CA Path Option ( --repo-storage-ca-path )
Repository storage CA path.
Use a CA path other than the system default for storage (e.g. S3, Azure) certificates.
example: --repo1-storage-ca-path=/etc/pki/tls/certs
Deprecated Names: repo-azure-ca-path, repo-s3-ca-path
Repository Storage Host Option ( --repo-storage-host )
Repository storage host.
Connect to a host other than the storage (e.g. S3, Azure) endpoint. This is typically used for testing.
example: --repo1-storage-host=127.0.0.1
Deprecated Names: repo-azure-host, repo-s3-host
Repository Storage Port Option ( --repo-storage-port )
Repository storage port.
Port to use when connecting to the storage (e.g. S3, Azure) endpoint (or host if specified).
default: 443 allowed: 1-65535 example: --repo1-storage-port=9000
Deprecated Names: repo-azure-port, repo-s3-port
Repository Storage Tag Option ( --repo-storage-tag )
Repository storage tag(s).
Specify tags that will be added to objects when the repository is an object store (e.g. S3). The option can be repeated to add multiple tags.
There is no provision in
pgBackRest
to modify these tags so be sure to set them correctly before running
stanza-create
to ensure uniform tags across the entire repository.
example: --repo1-storage-tag=key1=value1
Repository Storage Upload Chunk Size Option ( --repo-storage-upload-chunk-size )
Repository storage upload chunk size.
Object stores such as S3 allow files to be uploaded in chunks when the file is too large to be stored in memory. Even if the file can be stored in memory, it is more memory efficient to limit the amount of memory used for uploads.
A larger chunk size will generally lead to better performance because it will minimize upload requests and allow more files to be uploaded in a single request rather than in chunks. The disadvantage is that memory usage will be higher and because the chunk buffer must be allocated per process, larger
process-max
values will lead to more memory being consumed overall.
Default chunk sizes by repo type:
- azure - 4MiB
- gcs - 4MiB
- s3 - 5MiB
Note that valid chunk sizes vary by storage type and by platform. For example,
AWS S3
has a minimum chunk size of 5MiB but
S3
clones may accept lower values. Terminology for chunk size varies by storage type, so when searching min/max values use
part sizefor AWS S3 ,
chunk sizefor GCS , and
block sizefor Azure . No attempt is made to validate configured chunk sizes so selecting an invalid value will lead to errors from the storage service or undefined behavior.
allowed: 64KiB-1TiB example: --repo1-storage-upload-chunk-size=16MiB
Repository Storage Certificate Verify Option ( --repo-storage-verify-tls )
Repository storage certificate verify.
This option provides the ability to enable/disable verification of the storage (e.g. S3, Azure) server TLS certificate. Disabling should only be used for testing or other scenarios where a certificate has been self-signed.
default: y example: --no-repo1-storage-verify-tls
Deprecated Names: repo-azure-verify-tls, repo-s3-verify-ssl, repo-s3-verify-tls
Repository Type Option ( --repo-type )
Type of storage used for the repository.
The following repository types are supported:
- azure - Azure Blob Storage Service
- cifs - Like posix , but disables links and directory fsyncs
- gcs - Google Cloud Storage
- posix - Posix-compliant file systems
- s3 - AWS Simple Storage Service
- sftp - Secure File Transfer Protocol
When an
NFS
mount is used as a
posix
repository, the same rules apply to
pgBackRest
as described in the
PostgreSQL
documentation:
Creating a Database Cluster - File Systems
.
default: posix example: --repo1-type=cifs
Repository Get Command ( repo-get )
Similar to the unix
cat
command but works on any supported repository type. This command requires a fully qualified file name and is primarily for administration, investigation, and testing. It is not a required part of a normal
pgBackRest
setup.
If the repository is encrypted then
repo-get
will automatically decrypt the file. Files are not automatically decompressed but the output can be piped through the appropriate decompression command, e.g.
gzip -d
.
If more than one repository is configured, the command will default to the highest priority repository (e.g.
repo1
) unless the
--repo
option is specified.
General Options
Buffer Size Option ( --buffer-size )
Buffer size for I/O operations.
Buffer size used for copy, compress, encrypt, and other operations. The number of buffers used depends on options and each operation may use additional memory, e.g.
gz
compression may use an additional 256KiB of memory.
Allowed values are
16KiB
,
32KiB
,
64KiB
,
128KiB
,
256KiB
,
512KiB
,
1MiB
,
2MiB
,
4MiB
,
8MiB
, and
16MiB
.
default: 1MiB example: --buffer-size=2MiB
pgBackRest Command Option ( --cmd )
pgBackRest
command.
pgBackRest
may generate a command string, e.g. when the
restore
command generates the
restore_command
setting. The command used to run the
pgBackRest
process will be used in this case unless the
cmd
option is provided.
CAUTION:
Wrapping the
pgBackRest
command may cause unpredictable behavior and is not recommended.
example: --cmd=/var/lib/pgsql/bin/pgbackrest_wrapper.sh
SSH Client Command Option ( --cmd-ssh )
SSH client command.
Use a specific SSH client command when an alternate is desired or the
ssh
command is not in $PATH.
default: ssh example: --cmd-ssh=/usr/bin/ssh
Network Compress Level Option ( --compress-level-network )
Network compression level.
Sets the network compression level when
compress-type=none
and the command is not run on the same host as the repository. Compression is used to reduce network traffic but can be disabled by setting
compress-level-network=0
. When
compress-type
does not equal
none
the
compress-level-network
setting is ignored and
compress-level
is used instead so that the file is only compressed once.
default: 3 allowed: 0-9 example: --compress-level-network=1
Config Option ( --config )
pgBackRest
configuration file.
Use this option to specify a different configuration file than the default.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_FILE example: --config=/conf/pgbackrest/pgbackrest.conf
Config Include Path Option ( --config-include-path )
Path to additional
pgBackRest
configuration files.
Configuration files existing in the specified location with extension
.conf
will be concatenated with the
pgBackRest
configuration file, resulting in one configuration file.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_INCLUDE_PATH example: --config-include-path=/conf/pgbackrest/conf.d
Config Path Option ( --config-path )
Base path of
pgBackRest
configuration files.
This setting is used to override the default base path setting for the
--config
and
--config-include-path
options unless they are explicitly set on the command-line.
For example, passing only
--config-path=/conf/pgbackrest
results in the
--config
default being set to
/conf/pgbackrest/pgbackrest.conf
and the
--config-include-path
default being set to
/conf/pgbackrest/conf.d
.
default: CFGOPTDEF_CONFIG_PATH example: --config-path=/conf/pgbackrest
Database Timeout Option ( --db-timeout )
Database query timeout.
Sets the timeout, in seconds, for queries against the database. This includes the backup start/stop functions which can each take a substantial amount of time. Because of this the timeout should be kept high unless you know that these functions will return quickly (i.e. if you have set
start-fast=y
and you know that the database cluster will not generate many WAL segments during the backup).
NOTE:
The
db-timeout
option must be less than the
protocol-timeout
option.
default: 30m allowed: 100ms-7d example: --db-timeout=600
I/O Timeout Option ( --io-timeout )
I/O timeout.
Timeout, in seconds, used for connections and read/write operations.
Note that the entire read/write operation does not need to complete within this timeout but
some
progress must be made, even if it is only a single byte.
default: 1m allowed: 100ms-1h example: --io-timeout=120
Neutral Umask Option ( --neutral-umask )
Use a neutral umask.
Sets the umask to 0000 so modes in the repository are created in a sensible way. The default directory mode is 0750 and default file mode is 0640. The lock and log directories set the directory and file mode to 0770 and 0660 respectively.
To use the executing user's umask instead specify
neutral-umask=n
in the config file or
--no-neutral-umask
on the command line.
default: y example: --no-neutral-umask
Protocol Timeout Option ( --protocol-timeout )
Protocol timeout.
Sets the timeout, in seconds, that the local or remote process will wait for a new message to be received on the protocol layer. This prevents processes from waiting indefinitely for a message.
NOTE:
The
protocol-timeout
option must be greater than the
db-timeout
option.
default: 31m allowed: 100ms-7d example: --protocol-timeout=630
Raw Data Option ( --raw )
Do not transform data.
Do not transform (i.e, encrypt, decompress, etc.) data for the current command.
default: n example: --raw
Keep Alive Option ( --sck-keep-alive )
Keep-alive enable.
Enables keep-alive messages on socket connections.
default: y example: --no-sck-keep-alive
Stanza Option ( --stanza )
Defines the stanza.
A stanza is the configuration for a
PostgreSQL
database cluster that defines where it is located, how it will be backed up, archiving options, etc. Most db servers will only have one
PostgreSQL
database cluster and therefore one stanza, whereas backup servers will have a stanza for every database cluster that needs to be backed up.
It is tempting to name the stanza after the primary cluster but a better name describes the databases contained in the cluster. Because the stanza name will be used for the primary and all replicas it is more appropriate to choose a name that describes the actual function of the cluster, such as app or dw, rather than the local cluster name, such as main or prod.
example: --stanza=main
Keep Alive Count Option ( --tcp-keep-alive-count )
Keep-alive count.
Specifies the number of TCP keep-alive messages that can be lost before the connection is considered dead.
This option is available on systems that support the
TCP_KEEPCNT
socket option.
allowed: 1-32 example: --tcp-keep-alive-count=3
Keep Alive Idle Option ( --tcp-keep-alive-idle )
Keep-alive idle time.
Specifies the amount of time (in seconds) with no network activity after which the operating system should send a TCP keep-alive message.
This option is available on systems that support the
TCP_KEEPIDLE
socket option.
allowed: 1-3600 example: --tcp-keep-alive-idle=60
Keep Alive Interval Option ( --tcp-keep-alive-interval )
Keep-alive interval time.
Specifies the amount of time (in seconds) after which a TCP keep-alive message that has not been acknowledged should be retransmitted.
This option is available on systems that support the
TCP_KEEPINTVL
socket option.
allowed: 1-900 example: --tcp-keep-alive-interval=30
Log Options
Console Log Level Option ( --log-level-console )
Level for console logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: warn example: --log-level-console=error
File Log Level Option ( --log-level-file )
Level for file logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: info example: --log-level-file=debug
Std Error Log Level Option ( --log-level-stderr )
Level for stderr logging.
Specifies which log levels will output to
stderr
rather than
stdout
(specified by
log-level-console
). The timestamp and process will not be output to
stderr
.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: off example: --log-level-stderr=error
Log Path Option ( --log-path )
Path where log files are stored.
The log path provides a location for
pgBackRest
to store log files. Note that if
log-level-file=off
then no log path is required.
default: /var/log/pgbackrest example: --log-path=/backup/db/log
Repository Options
Set Repository Option ( --repo )
Set repository.
Set the repository for a command to operate on.
For example, this option may be used to perform a restore from a specific repository, rather than letting
pgBackRest
choose.
allowed: 1-256 example: --repo=1
Azure Repository Container Option ( --repo-azure-container )
Azure repository container.
Azure container used to store the repository.
pgBackRest
repositories can be stored in the container root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other Azure-generated content can also be stored in the container.
example: --repo1-azure-container=pg-backup
Azure Repository Key Type Option ( --repo-azure-key-type )
Azure repository key type.
The following types are supported for authorization:
- shared - Shared key
- sas - Shared access signature
default: shared example: --repo1-azure-key-type=sas
Azure Repository URI Style Option ( --repo-azure-uri-style )
Azure URI Style.
The following URI styles are supported:
- host - Connect to account.endpoint host.
- path - Connect to endpoint host and prepend account to URIs.
default: host example: --repo1-azure-uri-style=path
Repository Cipher Type Option ( --repo-cipher-type )
Cipher used to encrypt the repository.
The following cipher types are supported:
- none - The repository is not encrypted
- aes-256-cbc - Advanced Encryption Standard with 256 bit key length
Note that encryption is always performed client-side even if the repository type (e.g. S3) supports encryption.
default: none example: --repo1-cipher-type=aes-256-cbc
GCS Repository Bucket Option ( --repo-gcs-bucket )
GCS repository bucket.
GCS bucket used to store the repository.
pgBackRest
repositories can be stored in the bucket root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other GCS-generated content can also be stored in the bucket.
example: --repo1-gcs-bucket=/pg-backup
GCS Repository Endpoint Option ( --repo-gcs-endpoint )
GCS repository endpoint.
Endpoint used to connect to the storage service. May be updated to use a local GCS server or alternate endpoint.
default: storage.googleapis.com example: --repo1-gcs-endpoint=localhost
GCS Repository Key Type Option ( --repo-gcs-key-type )
GCS repository key type.
The following types are supported for authorization:
- auto - Authorize using the instance service account.
- service - Service account from locally stored key.
- token - For local testing, e.g. fakegcs .
When
repo-gcs-key-type=service
the credentials will be reloaded when the authentication token is renewed.
default: service example: --repo1-gcs-key-type=auto
Repository Host Option ( --repo-host )
Repository host when operating remotely.
When backing up and archiving to a locally mounted filesystem this setting is not required.
example: --repo1-host=repo1.domain.com
Deprecated Name: backup-host
Repository Host Certificate Authority File Option ( --repo-host-ca-file )
Repository host certificate authority file.
Use a CA file other than the system default for connecting to the repository host.
example: --repo1-host-ca-file=/etc/pki/tls/certs/ca-bundle.crt
Repository Host Certificate Authority Path Option ( --repo-host-ca-path )
Repository host certificate authority path.
Use a CA path other than the system default for connecting to the repository host.
example: --repo1-host-ca-path=/etc/pki/tls/certs
Repository Host Certificate File Option ( --repo-host-cert-file )
Repository host certificate file.
Sent to repository host to prove client identity.
example: --repo1-host-cert-file=/path/to/client.crt
Repository Host Command Option ( --repo-host-cmd )
Repository host
pgBackRest
command.
Required only if the path to the
pgBackRest
command is different on the local and repository hosts. If not defined, the repository host command will be set the same as the local command.
example: --repo1-host-cmd=/usr/lib/backrest/bin/pgbackrest
Deprecated Name: backup-cmd
Repository Host Configuration Option ( --repo-host-config )
pgBackRest
repository host configuration file.
Sets the location of the configuration file on the repository host. This is only required if the repository host configuration file is in a different location than the local configuration file.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_FILE example: --repo1-host-config=/conf/pgbackrest/pgbackrest.conf
Deprecated Name: backup-config
Repository Host Configuration Include Path Option ( --repo-host-config-include-path )
pgBackRest
repository host configuration include path.
Sets the location of the configuration include path on the repository host. This is only required if the repository host configuration include path is in a different location than the local configuration include path.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_INCLUDE_PATH example: --repo1-host-config-include-path=/conf/pgbackrest/conf.d
Repository Host Configuration Path Option ( --repo-host-config-path )
pgBackRest
repository host configuration path.
Sets the location of the configuration path on the repository host. This is only required if the repository host configuration path is in a different location than the local configuration path.
default: CFGOPTDEF_CONFIG_PATH example: --repo1-host-config-path=/conf/pgbackrest
Repository Host Key File Option ( --repo-host-key-file )
Repository host key file.
Proves client certificate was sent by owner.
example: --repo1-host-key-file=/path/to/client.key
Repository Host Port Option ( --repo-host-port )
Repository host port when
repo-host
is set.
Use this option to specify a non-default port for the repository host protocol.
allowed: 0-65535 example: --repo1-host-port=25
Deprecated Name: backup-ssh-port
Repository Host Protocol Type Option ( --repo-host-type )
Repository host protocol type.
The following protocol types are supported:
- ssh - Secure Shell.
- tls - pgBackRest TLS server.
default: ssh example: --repo1-host-type=tls
Repository Host User Option ( --repo-host-user )
Repository host user when
repo-host
is set.
Defines the user that will be used for operations on the repository host. Preferably this is not the
postgres
user but rather some other user like
pgbackrest
. If
PostgreSQL
runs on the repository host the
postgres
user can be placed in the
pgbackrest
group so it has read permissions on the repository without being able to damage the contents accidentally.
default: pgbackrest example: --repo1-host-user=repo-user
Deprecated Name: backup-user
Repository Path Option ( --repo-path )
Path where backups and archive are stored.
The repository is where
pgBackRest
stores backups and archives WAL segments.
It may be difficult to estimate in advance how much space you'll need. The best thing to do is take some backups then record the size of different types of backups (full/incr/diff) and measure the amount of WAL generated per day. This will give you a general idea of how much space you'll need, though of course requirements will likely change over time as your database evolves.
default: /var/lib/pgbackrest example: --repo1-path=/backup/db/backrest
S3 Repository Bucket Option ( --repo-s3-bucket )
S3 repository bucket.
S3 bucket used to store the repository.
pgBackRest
repositories can be stored in the bucket root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other AWS generated content can also be stored in the bucket.
example: --repo1-s3-bucket=pg-backup
S3 Repository Endpoint Option ( --repo-s3-endpoint )
S3 repository endpoint.
The AWS endpoint should be valid for the selected region.
For custom/test configurations the
repo-storage-ca-file
,
repo-storage-ca-path
,
repo-storage-host
,
repo-storage-port
, and
repo-storage-verify-tls
options may be useful.
example: --repo1-s3-endpoint=s3.amazonaws.com
S3 Repository Key Type Option ( --repo-s3-key-type )
S3 repository key type.
The following types are supported:
- shared - Shared keys
- auto - Automatically retrieve temporary credentials
- web-id - Automatically retrieve web identity credentials
default: shared example: --repo1-s3-key-type=auto
S3 Repository KMS Key ID Option ( --repo-s3-kms-key-id )
S3 repository KMS key.
Setting this option enables S3 server-side encryption using the specified AWS key management service key.
example: --repo1-s3-kms-key-id=bceb4f13-6939-4be3-910d-df54dee817b7
S3 Repository Region Option ( --repo-s3-region )
S3 repository region.
The AWS region where the bucket was created.
example: --repo1-s3-region=us-east-1
S3 Repository Role Option ( --repo-s3-role )
S3 repository role.
The AWS role name (not the full ARN) used to retrieve temporary credentials when
repo-s3-key-type=auto
.
example: --repo1-s3-role=authrole
S3 Repository URI Style Option ( --repo-s3-uri-style )
S3 URI Style.
The following URI styles are supported:
- host - Connect to bucket.endpoint host.
- path - Connect to endpoint host and prepend bucket to URIs.
default: host example: --repo1-s3-uri-style=path
SFTP Repository Host Option ( --repo-sftp-host )
SFTP repository host.
The SFTP host containing the repository.
example: --repo1-sftp-host=sftprepo.domain
SFTP Repository Host Fingerprint Option ( --repo-sftp-host-fingerprint )
SFTP repository host fingerprint.
SFTP repository host fingerprint generation should match the
repo-sftp-host-key-hash-type
. Generate the fingerprint via
awk '{print $2}' ssh_host_xxx_key.pub | base64 -d | (md5sum or sha1sum) -b
. The ssh host keys are normally found in the
/etc/ssh
directory.
example: --repo1-sftp-host-fingerprint=f84e172dfead7aeeeae6c1fdfb5aa8cf
SFTP Host Key Check Type Option ( --repo-sftp-host-key-check-type )
SFTP host key check type.
The following SFTP host key check types are supported:
- strict - pgBackRest will never automatically add host keys to the ~/.ssh/known_hosts file, and refuses to connect to hosts whose host key has changed or is not found in the known hosts files. This option forces the user to manually add all new hosts.
- accept-new - pgBackRest will automatically add new host keys to the user's known hosts file, but will not permit connections to hosts with changed host keys.
- fingerprint - pgBackRest will check the host key against the fingerprint specified by the repo-sftp-host-fingerprint option.
- none - no host key checking will be performed.
default: strict example: --repo1-sftp-host-key-check-type=accept-new
SFTP Repository Host Key Hash Type Option ( --repo-sftp-host-key-hash-type )
SFTP repository host key hash type.
SFTP repository host key hash type. Declares the hash type to be used to compute the digest of the remote system's host key on SSH startup. Newer versions of
libssh2
support
sha256
in addition to md5 and sha1.
example: --repo1-sftp-host-key-hash-type=sha256
SFTP Repository Host Port Option ( --repo-sftp-host-port )
SFTP repository host port.
SFTP repository host port.
default: 22 allowed: 1-65535 example: --repo1-sftp-host-port=22
SFTP Repository Host User Option ( --repo-sftp-host-user )
SFTP repository host user.
User on the host used to store the repository.
example: --repo1-sftp-host-user=pg-backup
SFTP Known Hosts File Option ( --repo-sftp-known-host )
SFTP known hosts file.
A known hosts file to search for an SFTP host match during authentication. When unspecified,
pgBackRest
will default to searching
~/.ssh/known_hosts
,
~/.ssh/known_hosts2
,
/etc/ssh/ssh_known_hosts
, and
/etc/ssh/ssh_known_hosts2
. If configured with one or more file paths,
pgBackRest
will search those for a match. File paths must be full or leading tilde paths. The
repo-sftp-known-host
option can be passed multiple times to specify more than one known hosts file to search. To utilize known hosts file checking
repo-sftp-host-fingerprint
must not be specified. See also
repo-sftp-host-check-type
option.
example: --repo1-sftp-known-host=/home/postgres/.ssh/known_hosts
SFTP Repository Private Key File Option ( --repo-sftp-private-key-file )
SFTP private key file.
SFTP private key file used for authentication.
example: --repo1-sftp-private-key-file=~/.ssh/id_ed25519
SFTP Repository Public Key File Option ( --repo-sftp-public-key-file )
SFTP public key file.
SFTP public key file used for authentication. Optional if compiled against OpenSSL, required if compiled against a different library.
example: --repo1-sftp-public-key-file=~/.ssh/id_ed25519.pub
Repository Storage CA File Option ( --repo-storage-ca-file )
Repository storage CA file.
Use a CA file other than the system default for storage (e.g. S3, Azure) certificates.
example: --repo1-storage-ca-file=/etc/pki/tls/certs/ca-bundle.crt
Deprecated Names: repo-azure-ca-file, repo-s3-ca-file
Repository Storage TLS CA Path Option ( --repo-storage-ca-path )
Repository storage CA path.
Use a CA path other than the system default for storage (e.g. S3, Azure) certificates.
example: --repo1-storage-ca-path=/etc/pki/tls/certs
Deprecated Names: repo-azure-ca-path, repo-s3-ca-path
Repository Storage Host Option ( --repo-storage-host )
Repository storage host.
Connect to a host other than the storage (e.g. S3, Azure) endpoint. This is typically used for testing.
example: --repo1-storage-host=127.0.0.1
Deprecated Names: repo-azure-host, repo-s3-host
Repository Storage Port Option ( --repo-storage-port )
Repository storage port.
Port to use when connecting to the storage (e.g. S3, Azure) endpoint (or host if specified).
default: 443 allowed: 1-65535 example: --repo1-storage-port=9000
Deprecated Names: repo-azure-port, repo-s3-port
Repository Storage Tag Option ( --repo-storage-tag )
Repository storage tag(s).
Specify tags that will be added to objects when the repository is an object store (e.g. S3). The option can be repeated to add multiple tags.
There is no provision in
pgBackRest
to modify these tags so be sure to set them correctly before running
stanza-create
to ensure uniform tags across the entire repository.
example: --repo1-storage-tag=key1=value1
Repository Storage Upload Chunk Size Option ( --repo-storage-upload-chunk-size )
Repository storage upload chunk size.
Object stores such as S3 allow files to be uploaded in chunks when the file is too large to be stored in memory. Even if the file can be stored in memory, it is more memory efficient to limit the amount of memory used for uploads.
A larger chunk size will generally lead to better performance because it will minimize upload requests and allow more files to be uploaded in a single request rather than in chunks. The disadvantage is that memory usage will be higher and because the chunk buffer must be allocated per process, larger
process-max
values will lead to more memory being consumed overall.
Default chunk sizes by repo type:
- azure - 4MiB
- gcs - 4MiB
- s3 - 5MiB
Note that valid chunk sizes vary by storage type and by platform. For example,
AWS S3
has a minimum chunk size of 5MiB but
S3
clones may accept lower values. Terminology for chunk size varies by storage type, so when searching min/max values use
part sizefor AWS S3 ,
chunk sizefor GCS , and
block sizefor Azure . No attempt is made to validate configured chunk sizes so selecting an invalid value will lead to errors from the storage service or undefined behavior.
allowed: 64KiB-1TiB example: --repo1-storage-upload-chunk-size=16MiB
Repository Storage Certificate Verify Option ( --repo-storage-verify-tls )
Repository storage certificate verify.
This option provides the ability to enable/disable verification of the storage (e.g. S3, Azure) server TLS certificate. Disabling should only be used for testing or other scenarios where a certificate has been self-signed.
default: y example: --no-repo1-storage-verify-tls
Deprecated Names: repo-azure-verify-tls, repo-s3-verify-ssl, repo-s3-verify-tls
Repository Type Option ( --repo-type )
Type of storage used for the repository.
The following repository types are supported:
- azure - Azure Blob Storage Service
- cifs - Like posix , but disables links and directory fsyncs
- gcs - Google Cloud Storage
- posix - Posix-compliant file systems
- s3 - AWS Simple Storage Service
- sftp - Secure File Transfer Protocol
When an
NFS
mount is used as a
posix
repository, the same rules apply to
pgBackRest
as described in the
PostgreSQL
documentation:
Creating a Database Cluster - File Systems
.
default: posix example: --repo1-type=cifs
Repository List Command ( repo-ls )
Similar to the unix
ls
command but works on any supported repository type. This command accepts a path, absolute or relative to the repository path defined by the
--repo-path
option, and is primarily for administration, investigation, and testing. It is not a required part of a normal
pgBackRest
setup.
The default text output prints one file name per line. JSON output is available by specifying
--output=json
.
If more than one repository is configured, the command will default to the highest priority repository (e.g.
repo1
) unless the
--repo
option is specified.
Command Options
Filter Output Option ( --filter )
Filter output with a regular expression.
The filter is applied against the file/path names before they are output.
example: --filter="(F|D|I)$"
Output Option ( --output )
Output format.
The following output types are supported:
- text - Simple list with one file/link/path name on each line.
- json - Detailed file/link/path information in JSON format.
In JSON format the available fields are:
- name - file/link/path name (and partial path when recursing).
- type - file , path , or link .
- size - size in bytes (files only).
- time - time last modified (files only).
- destination - link destination (links only).
default: text example: --output=json
General Options
Buffer Size Option ( --buffer-size )
Buffer size for I/O operations.
Buffer size used for copy, compress, encrypt, and other operations. The number of buffers used depends on options and each operation may use additional memory, e.g.
gz
compression may use an additional 256KiB of memory.
Allowed values are
16KiB
,
32KiB
,
64KiB
,
128KiB
,
256KiB
,
512KiB
,
1MiB
,
2MiB
,
4MiB
,
8MiB
, and
16MiB
.
default: 1MiB example: --buffer-size=2MiB
pgBackRest Command Option ( --cmd )
pgBackRest
command.
pgBackRest
may generate a command string, e.g. when the
restore
command generates the
restore_command
setting. The command used to run the
pgBackRest
process will be used in this case unless the
cmd
option is provided.
CAUTION:
Wrapping the
pgBackRest
command may cause unpredictable behavior and is not recommended.
example: --cmd=/var/lib/pgsql/bin/pgbackrest_wrapper.sh
SSH Client Command Option ( --cmd-ssh )
SSH client command.
Use a specific SSH client command when an alternate is desired or the
ssh
command is not in $PATH.
default: ssh example: --cmd-ssh=/usr/bin/ssh
Network Compress Level Option ( --compress-level-network )
Network compression level.
Sets the network compression level when
compress-type=none
and the command is not run on the same host as the repository. Compression is used to reduce network traffic but can be disabled by setting
compress-level-network=0
. When
compress-type
does not equal
none
the
compress-level-network
setting is ignored and
compress-level
is used instead so that the file is only compressed once.
default: 3 allowed: 0-9 example: --compress-level-network=1
Config Option ( --config )
pgBackRest
configuration file.
Use this option to specify a different configuration file than the default.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_FILE example: --config=/conf/pgbackrest/pgbackrest.conf
Config Include Path Option ( --config-include-path )
Path to additional
pgBackRest
configuration files.
Configuration files existing in the specified location with extension
.conf
will be concatenated with the
pgBackRest
configuration file, resulting in one configuration file.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_INCLUDE_PATH example: --config-include-path=/conf/pgbackrest/conf.d
Config Path Option ( --config-path )
Base path of
pgBackRest
configuration files.
This setting is used to override the default base path setting for the
--config
and
--config-include-path
options unless they are explicitly set on the command-line.
For example, passing only
--config-path=/conf/pgbackrest
results in the
--config
default being set to
/conf/pgbackrest/pgbackrest.conf
and the
--config-include-path
default being set to
/conf/pgbackrest/conf.d
.
default: CFGOPTDEF_CONFIG_PATH example: --config-path=/conf/pgbackrest
Database Timeout Option ( --db-timeout )
Database query timeout.
Sets the timeout, in seconds, for queries against the database. This includes the backup start/stop functions which can each take a substantial amount of time. Because of this the timeout should be kept high unless you know that these functions will return quickly (i.e. if you have set
start-fast=y
and you know that the database cluster will not generate many WAL segments during the backup).
NOTE:
The
db-timeout
option must be less than the
protocol-timeout
option.
default: 30m allowed: 100ms-7d example: --db-timeout=600
I/O Timeout Option ( --io-timeout )
I/O timeout.
Timeout, in seconds, used for connections and read/write operations.
Note that the entire read/write operation does not need to complete within this timeout but
some
progress must be made, even if it is only a single byte.
default: 1m allowed: 100ms-1h example: --io-timeout=120
Neutral Umask Option ( --neutral-umask )
Use a neutral umask.
Sets the umask to 0000 so modes in the repository are created in a sensible way. The default directory mode is 0750 and default file mode is 0640. The lock and log directories set the directory and file mode to 0770 and 0660 respectively.
To use the executing user's umask instead specify
neutral-umask=n
in the config file or
--no-neutral-umask
on the command line.
default: y example: --no-neutral-umask
Protocol Timeout Option ( --protocol-timeout )
Protocol timeout.
Sets the timeout, in seconds, that the local or remote process will wait for a new message to be received on the protocol layer. This prevents processes from waiting indefinitely for a message.
NOTE:
The
protocol-timeout
option must be greater than the
db-timeout
option.
default: 31m allowed: 100ms-7d example: --protocol-timeout=630
Keep Alive Option ( --sck-keep-alive )
Keep-alive enable.
Enables keep-alive messages on socket connections.
default: y example: --no-sck-keep-alive
Stanza Option ( --stanza )
Defines the stanza.
A stanza is the configuration for a
PostgreSQL
database cluster that defines where it is located, how it will be backed up, archiving options, etc. Most db servers will only have one
PostgreSQL
database cluster and therefore one stanza, whereas backup servers will have a stanza for every database cluster that needs to be backed up.
It is tempting to name the stanza after the primary cluster but a better name describes the databases contained in the cluster. Because the stanza name will be used for the primary and all replicas it is more appropriate to choose a name that describes the actual function of the cluster, such as app or dw, rather than the local cluster name, such as main or prod.
example: --stanza=main
Keep Alive Count Option ( --tcp-keep-alive-count )
Keep-alive count.
Specifies the number of TCP keep-alive messages that can be lost before the connection is considered dead.
This option is available on systems that support the
TCP_KEEPCNT
socket option.
allowed: 1-32 example: --tcp-keep-alive-count=3
Keep Alive Idle Option ( --tcp-keep-alive-idle )
Keep-alive idle time.
Specifies the amount of time (in seconds) with no network activity after which the operating system should send a TCP keep-alive message.
This option is available on systems that support the
TCP_KEEPIDLE
socket option.
allowed: 1-3600 example: --tcp-keep-alive-idle=60
Keep Alive Interval Option ( --tcp-keep-alive-interval )
Keep-alive interval time.
Specifies the amount of time (in seconds) after which a TCP keep-alive message that has not been acknowledged should be retransmitted.
This option is available on systems that support the
TCP_KEEPINTVL
socket option.
allowed: 1-900 example: --tcp-keep-alive-interval=30
Log Options
Console Log Level Option ( --log-level-console )
Level for console logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: warn example: --log-level-console=error
File Log Level Option ( --log-level-file )
Level for file logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: info example: --log-level-file=debug
Std Error Log Level Option ( --log-level-stderr )
Level for stderr logging.
Specifies which log levels will output to
stderr
rather than
stdout
(specified by
log-level-console
). The timestamp and process will not be output to
stderr
.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: off example: --log-level-stderr=error
Log Path Option ( --log-path )
Path where log files are stored.
The log path provides a location for
pgBackRest
to store log files. Note that if
log-level-file=off
then no log path is required.
default: /var/log/pgbackrest example: --log-path=/backup/db/log
Repository Options
Set Repository Option ( --repo )
Set repository.
Set the repository for a command to operate on.
For example, this option may be used to perform a restore from a specific repository, rather than letting
pgBackRest
choose.
allowed: 1-256 example: --repo=1
Azure Repository Container Option ( --repo-azure-container )
Azure repository container.
Azure container used to store the repository.
pgBackRest
repositories can be stored in the container root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other Azure-generated content can also be stored in the container.
example: --repo1-azure-container=pg-backup
Azure Repository Key Type Option ( --repo-azure-key-type )
Azure repository key type.
The following types are supported for authorization:
- shared - Shared key
- sas - Shared access signature
default: shared example: --repo1-azure-key-type=sas
Azure Repository URI Style Option ( --repo-azure-uri-style )
Azure URI Style.
The following URI styles are supported:
- host - Connect to account.endpoint host.
- path - Connect to endpoint host and prepend account to URIs.
default: host example: --repo1-azure-uri-style=path
Repository Cipher Type Option ( --repo-cipher-type )
Cipher used to encrypt the repository.
The following cipher types are supported:
- none - The repository is not encrypted
- aes-256-cbc - Advanced Encryption Standard with 256 bit key length
Note that encryption is always performed client-side even if the repository type (e.g. S3) supports encryption.
default: none example: --repo1-cipher-type=aes-256-cbc
GCS Repository Bucket Option ( --repo-gcs-bucket )
GCS repository bucket.
GCS bucket used to store the repository.
pgBackRest
repositories can be stored in the bucket root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other GCS-generated content can also be stored in the bucket.
example: --repo1-gcs-bucket=/pg-backup
GCS Repository Endpoint Option ( --repo-gcs-endpoint )
GCS repository endpoint.
Endpoint used to connect to the storage service. May be updated to use a local GCS server or alternate endpoint.
default: storage.googleapis.com example: --repo1-gcs-endpoint=localhost
GCS Repository Key Type Option ( --repo-gcs-key-type )
GCS repository key type.
The following types are supported for authorization:
- auto - Authorize using the instance service account.
- service - Service account from locally stored key.
- token - For local testing, e.g. fakegcs .
When
repo-gcs-key-type=service
the credentials will be reloaded when the authentication token is renewed.
default: service example: --repo1-gcs-key-type=auto
Repository Host Option ( --repo-host )
Repository host when operating remotely.
When backing up and archiving to a locally mounted filesystem this setting is not required.
example: --repo1-host=repo1.domain.com
Deprecated Name: backup-host
Repository Host Certificate Authority File Option ( --repo-host-ca-file )
Repository host certificate authority file.
Use a CA file other than the system default for connecting to the repository host.
example: --repo1-host-ca-file=/etc/pki/tls/certs/ca-bundle.crt
Repository Host Certificate Authority Path Option ( --repo-host-ca-path )
Repository host certificate authority path.
Use a CA path other than the system default for connecting to the repository host.
example: --repo1-host-ca-path=/etc/pki/tls/certs
Repository Host Certificate File Option ( --repo-host-cert-file )
Repository host certificate file.
Sent to repository host to prove client identity.
example: --repo1-host-cert-file=/path/to/client.crt
Repository Host Command Option ( --repo-host-cmd )
Repository host
pgBackRest
command.
Required only if the path to the
pgBackRest
command is different on the local and repository hosts. If not defined, the repository host command will be set the same as the local command.
example: --repo1-host-cmd=/usr/lib/backrest/bin/pgbackrest
Deprecated Name: backup-cmd
Repository Host Configuration Option ( --repo-host-config )
pgBackRest
repository host configuration file.
Sets the location of the configuration file on the repository host. This is only required if the repository host configuration file is in a different location than the local configuration file.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_FILE example: --repo1-host-config=/conf/pgbackrest/pgbackrest.conf
Deprecated Name: backup-config
Repository Host Configuration Include Path Option ( --repo-host-config-include-path )
pgBackRest
repository host configuration include path.
Sets the location of the configuration include path on the repository host. This is only required if the repository host configuration include path is in a different location than the local configuration include path.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_INCLUDE_PATH example: --repo1-host-config-include-path=/conf/pgbackrest/conf.d
Repository Host Configuration Path Option ( --repo-host-config-path )
pgBackRest
repository host configuration path.
Sets the location of the configuration path on the repository host. This is only required if the repository host configuration path is in a different location than the local configuration path.
default: CFGOPTDEF_CONFIG_PATH example: --repo1-host-config-path=/conf/pgbackrest
Repository Host Key File Option ( --repo-host-key-file )
Repository host key file.
Proves client certificate was sent by owner.
example: --repo1-host-key-file=/path/to/client.key
Repository Host Port Option ( --repo-host-port )
Repository host port when
repo-host
is set.
Use this option to specify a non-default port for the repository host protocol.
allowed: 0-65535 example: --repo1-host-port=25
Deprecated Name: backup-ssh-port
Repository Host Protocol Type Option ( --repo-host-type )
Repository host protocol type.
The following protocol types are supported:
- ssh - Secure Shell.
- tls - pgBackRest TLS server.
default: ssh example: --repo1-host-type=tls
Repository Host User Option ( --repo-host-user )
Repository host user when
repo-host
is set.
Defines the user that will be used for operations on the repository host. Preferably this is not the
postgres
user but rather some other user like
pgbackrest
. If
PostgreSQL
runs on the repository host the
postgres
user can be placed in the
pgbackrest
group so it has read permissions on the repository without being able to damage the contents accidentally.
default: pgbackrest example: --repo1-host-user=repo-user
Deprecated Name: backup-user
Repository Path Option ( --repo-path )
Path where backups and archive are stored.
The repository is where
pgBackRest
stores backups and archives WAL segments.
It may be difficult to estimate in advance how much space you'll need. The best thing to do is take some backups then record the size of different types of backups (full/incr/diff) and measure the amount of WAL generated per day. This will give you a general idea of how much space you'll need, though of course requirements will likely change over time as your database evolves.
default: /var/lib/pgbackrest example: --repo1-path=/backup/db/backrest
S3 Repository Bucket Option ( --repo-s3-bucket )
S3 repository bucket.
S3 bucket used to store the repository.
pgBackRest
repositories can be stored in the bucket root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other AWS generated content can also be stored in the bucket.
example: --repo1-s3-bucket=pg-backup
S3 Repository Endpoint Option ( --repo-s3-endpoint )
S3 repository endpoint.
The AWS endpoint should be valid for the selected region.
For custom/test configurations the
repo-storage-ca-file
,
repo-storage-ca-path
,
repo-storage-host
,
repo-storage-port
, and
repo-storage-verify-tls
options may be useful.
example: --repo1-s3-endpoint=s3.amazonaws.com
S3 Repository Key Type Option ( --repo-s3-key-type )
S3 repository key type.
The following types are supported:
- shared - Shared keys
- auto - Automatically retrieve temporary credentials
- web-id - Automatically retrieve web identity credentials
default: shared example: --repo1-s3-key-type=auto
S3 Repository KMS Key ID Option ( --repo-s3-kms-key-id )
S3 repository KMS key.
Setting this option enables S3 server-side encryption using the specified AWS key management service key.
example: --repo1-s3-kms-key-id=bceb4f13-6939-4be3-910d-df54dee817b7
S3 Repository Region Option ( --repo-s3-region )
S3 repository region.
The AWS region where the bucket was created.
example: --repo1-s3-region=us-east-1
S3 Repository Role Option ( --repo-s3-role )
S3 repository role.
The AWS role name (not the full ARN) used to retrieve temporary credentials when
repo-s3-key-type=auto
.
example: --repo1-s3-role=authrole
S3 Repository URI Style Option ( --repo-s3-uri-style )
S3 URI Style.
The following URI styles are supported:
- host - Connect to bucket.endpoint host.
- path - Connect to endpoint host and prepend bucket to URIs.
default: host example: --repo1-s3-uri-style=path
SFTP Repository Host Option ( --repo-sftp-host )
SFTP repository host.
The SFTP host containing the repository.
example: --repo1-sftp-host=sftprepo.domain
SFTP Repository Host Fingerprint Option ( --repo-sftp-host-fingerprint )
SFTP repository host fingerprint.
SFTP repository host fingerprint generation should match the
repo-sftp-host-key-hash-type
. Generate the fingerprint via
awk '{print $2}' ssh_host_xxx_key.pub | base64 -d | (md5sum or sha1sum) -b
. The ssh host keys are normally found in the
/etc/ssh
directory.
example: --repo1-sftp-host-fingerprint=f84e172dfead7aeeeae6c1fdfb5aa8cf
SFTP Host Key Check Type Option ( --repo-sftp-host-key-check-type )
SFTP host key check type.
The following SFTP host key check types are supported:
- strict - pgBackRest will never automatically add host keys to the ~/.ssh/known_hosts file, and refuses to connect to hosts whose host key has changed or is not found in the known hosts files. This option forces the user to manually add all new hosts.
- accept-new - pgBackRest will automatically add new host keys to the user's known hosts file, but will not permit connections to hosts with changed host keys.
- fingerprint - pgBackRest will check the host key against the fingerprint specified by the repo-sftp-host-fingerprint option.
- none - no host key checking will be performed.
default: strict example: --repo1-sftp-host-key-check-type=accept-new
SFTP Repository Host Key Hash Type Option ( --repo-sftp-host-key-hash-type )
SFTP repository host key hash type.
SFTP repository host key hash type. Declares the hash type to be used to compute the digest of the remote system's host key on SSH startup. Newer versions of
libssh2
support
sha256
in addition to md5 and sha1.
example: --repo1-sftp-host-key-hash-type=sha256
SFTP Repository Host Port Option ( --repo-sftp-host-port )
SFTP repository host port.
SFTP repository host port.
default: 22 allowed: 1-65535 example: --repo1-sftp-host-port=22
SFTP Repository Host User Option ( --repo-sftp-host-user )
SFTP repository host user.
User on the host used to store the repository.
example: --repo1-sftp-host-user=pg-backup
SFTP Known Hosts File Option ( --repo-sftp-known-host )
SFTP known hosts file.
A known hosts file to search for an SFTP host match during authentication. When unspecified,
pgBackRest
will default to searching
~/.ssh/known_hosts
,
~/.ssh/known_hosts2
,
/etc/ssh/ssh_known_hosts
, and
/etc/ssh/ssh_known_hosts2
. If configured with one or more file paths,
pgBackRest
will search those for a match. File paths must be full or leading tilde paths. The
repo-sftp-known-host
option can be passed multiple times to specify more than one known hosts file to search. To utilize known hosts file checking
repo-sftp-host-fingerprint
must not be specified. See also
repo-sftp-host-check-type
option.
example: --repo1-sftp-known-host=/home/postgres/.ssh/known_hosts
SFTP Repository Private Key File Option ( --repo-sftp-private-key-file )
SFTP private key file.
SFTP private key file used for authentication.
example: --repo1-sftp-private-key-file=~/.ssh/id_ed25519
SFTP Repository Public Key File Option ( --repo-sftp-public-key-file )
SFTP public key file.
SFTP public key file used for authentication. Optional if compiled against OpenSSL, required if compiled against a different library.
example: --repo1-sftp-public-key-file=~/.ssh/id_ed25519.pub
Repository Storage CA File Option ( --repo-storage-ca-file )
Repository storage CA file.
Use a CA file other than the system default for storage (e.g. S3, Azure) certificates.
example: --repo1-storage-ca-file=/etc/pki/tls/certs/ca-bundle.crt
Deprecated Names: repo-azure-ca-file, repo-s3-ca-file
Repository Storage TLS CA Path Option ( --repo-storage-ca-path )
Repository storage CA path.
Use a CA path other than the system default for storage (e.g. S3, Azure) certificates.
example: --repo1-storage-ca-path=/etc/pki/tls/certs
Deprecated Names: repo-azure-ca-path, repo-s3-ca-path
Repository Storage Host Option ( --repo-storage-host )
Repository storage host.
Connect to a host other than the storage (e.g. S3, Azure) endpoint. This is typically used for testing.
example: --repo1-storage-host=127.0.0.1
Deprecated Names: repo-azure-host, repo-s3-host
Repository Storage Port Option ( --repo-storage-port )
Repository storage port.
Port to use when connecting to the storage (e.g. S3, Azure) endpoint (or host if specified).
default: 443 allowed: 1-65535 example: --repo1-storage-port=9000
Deprecated Names: repo-azure-port, repo-s3-port
Repository Storage Tag Option ( --repo-storage-tag )
Repository storage tag(s).
Specify tags that will be added to objects when the repository is an object store (e.g. S3). The option can be repeated to add multiple tags.
There is no provision in
pgBackRest
to modify these tags so be sure to set them correctly before running
stanza-create
to ensure uniform tags across the entire repository.
example: --repo1-storage-tag=key1=value1
Repository Storage Upload Chunk Size Option ( --repo-storage-upload-chunk-size )
Repository storage upload chunk size.
Object stores such as S3 allow files to be uploaded in chunks when the file is too large to be stored in memory. Even if the file can be stored in memory, it is more memory efficient to limit the amount of memory used for uploads.
A larger chunk size will generally lead to better performance because it will minimize upload requests and allow more files to be uploaded in a single request rather than in chunks. The disadvantage is that memory usage will be higher and because the chunk buffer must be allocated per process, larger
process-max
values will lead to more memory being consumed overall.
Default chunk sizes by repo type:
- azure - 4MiB
- gcs - 4MiB
- s3 - 5MiB
Note that valid chunk sizes vary by storage type and by platform. For example,
AWS S3
has a minimum chunk size of 5MiB but
S3
clones may accept lower values. Terminology for chunk size varies by storage type, so when searching min/max values use
part sizefor AWS S3 ,
chunk sizefor GCS , and
block sizefor Azure . No attempt is made to validate configured chunk sizes so selecting an invalid value will lead to errors from the storage service or undefined behavior.
allowed: 64KiB-1TiB example: --repo1-storage-upload-chunk-size=16MiB
Repository Storage Certificate Verify Option ( --repo-storage-verify-tls )
Repository storage certificate verify.
This option provides the ability to enable/disable verification of the storage (e.g. S3, Azure) server TLS certificate. Disabling should only be used for testing or other scenarios where a certificate has been self-signed.
default: y example: --no-repo1-storage-verify-tls
Deprecated Names: repo-azure-verify-tls, repo-s3-verify-ssl, repo-s3-verify-tls
Repository Type Option ( --repo-type )
Type of storage used for the repository.
The following repository types are supported:
- azure - Azure Blob Storage Service
- cifs - Like posix , but disables links and directory fsyncs
- gcs - Google Cloud Storage
- posix - Posix-compliant file systems
- s3 - AWS Simple Storage Service
- sftp - Secure File Transfer Protocol
When an
NFS
mount is used as a
posix
repository, the same rules apply to
pgBackRest
as described in the
PostgreSQL
documentation:
Creating a Database Cluster - File Systems
.
default: posix example: --repo1-type=cifs
Restore Command ( restore )
The restore command automatically defaults to selecting the latest backup from the first repository where backups exist (see
Quick Start - Restore a Backup
). The order in which the repositories are checked is dictated by the
pgbackrest.conf
(e.g. repo1 will be checked before repo2). To select from a specific repository, the
--repo
option can be passed (e.g.
--repo=1
). The
--set
option can be passed if a backup other than the latest is desired.
When PITR of
--type=time
or
--type=lsn
is specified, then the target time or target lsn must be specified with the
--target
option. If a backup is not specified via the
--set
option, then the configured repositories will be checked, in order, for a backup that contains the requested time or lsn. If no matching backup is found, the latest backup from the first repository containing backups will be used for
--type=time
while no backup will be selected for
--type=lsn
. For other types of PITR, e.g.
xid
, the
--set
option must be provided if the target is prior to the latest backup. See
Point-in-Time Recovery
for more details and examples.
Replication slots are not included per recommendation of
PostgreSQL
. See
Backing Up The Data Directory
in the
PostgreSQL
documentation for more information.
Command Options
Archive Mode Option ( --archive-mode )
Preserve or disable archiving on restored cluster.
This option allows archiving to be preserved or disabled on a restored cluster. This is useful when the cluster must be promoted to do some work but is not intended to become the new primary. In this case it is not a good idea to push WAL from the cluster into the repository.
The following modes are supported:
- off - disable archiving by setting archive_mode=off .
- preserve - preserve current archive_mode setting.
NOTE
: This option is not available on
PostgreSQL
< 12.
default: preserve example: --archive-mode=off
Exclude Database Option ( --db-exclude )
Restore excluding the specified databases.
Databases excluded will be restored as sparse, zeroed files to save space but still allow
PostgreSQL
to perform recovery. After recovery, those databases will not be accessible but can be removed with the
drop database
command. The
--db-exclude
option can be passed multiple times to specify more than one database to exclude.
When used in combination with the
--db-include
option,
--db-exclude
will only apply to standard system databases (
template0
,
template1
, and
postgres
).
example: --db-exclude=db_main
Include Database Option ( --db-include )
Restore only specified databases.
This feature allows only selected databases to be restored. Databases not specifically included will be restored as sparse, zeroed files to save space but still allow
PostgreSQL
to perform recovery. After recovery, the databases that were not included will not be accessible but can be removed with the
drop database
command.
NOTE:
built-in databases (
template0
,
template1
, and
postgres
) are always restored unless specifically excluded.
The
--db-include
option can be passed multiple times to specify more than one database to include.
See
Restore Selected Databases
for additional information and caveats.
example: --db-include=db_main
Force Option ( --force )
Force a restore.
By itself this option forces the
PostgreSQL
data and tablespace paths to be completely overwritten. In combination with
--delta
a timestamp/size delta will be performed instead of using checksums.
default: n example: --force
Link All Option ( --link-all )
Restore all symlinks.
By default symlinked directories and files are restored as normal directories and files in $PGDATA. This is because it may not be safe to restore symlinks to their original destinations on a system other than where the original backup was performed. This option restores all the symlinks just as they were on the original system where the backup was performed.
default: n example: --link-all
Link Map Option ( --link-map )
Modify the destination of a symlink.
Allows the destination file or path of a symlink to be changed on restore. This is useful for restoring to systems that have a different storage layout than the original system where the backup was generated.
example: --link-map=pg_xlog=/data/xlog
Recovery Option Option ( --recovery-option )
Set an option in
postgresql.auto.conf
or
recovery.conf
.
See
Server Configuration
for details on
postgresql.auto.conf
or
recovery.conf
options (be sure to select your
PostgreSQL
version). This option can be used multiple times.
For
PostgreSQL
>= 12, options will be written into
postgresql.auto.conf
. For all other versions, options will be written into
recovery.conf
.
NOTE:
The
restore_command
option will be automatically generated but can be overridden with this option. Be careful about specifying your own
restore_command
as
pgBackRest
is designed to handle this for you. Target Recovery options (recovery_target_name, recovery_target_time, etc.) are generated automatically by
pgBackRest
and should not be set with this option.
Since
pgBackRest
does not start
PostgreSQL
after writing the
postgresql.auto.conf
or
recovery.conf
file, it is always possible to edit/check
postgresql.auto.conf
or
recovery.conf
before manually restarting.
example: --recovery-option=primary_conninfo=db.mydomain.com
Set Option ( --set )
Backup set to restore.
The backup set to be restored.
latest
will restore the latest backup, otherwise provide the name of the backup to restore.
default: latest example: --set=20150131-153358F_20150131-153401I
Tablespace Map Option ( --tablespace-map )
Restore a tablespace into the specified directory.
Moves a tablespace to a new location during the restore. This is useful when tablespace locations are not the same on a replica, or an upgraded system has different mount points.
Tablespace locations are not stored in pg_tablespace so moving tablespaces can be done with impunity. However, moving a tablespace to the
data_directory
is not recommended and may cause problems. For more information on moving tablespaces http://www.databasesoup.com/2013/11/moving-tablespaces.html is a good resource.
example: --tablespace-map=ts_01=/db/ts_01
Map All Tablespaces Option ( --tablespace-map-all )
Restore all tablespaces into the specified directory.
Tablespaces are restored into their original locations by default. This behavior can be modified for each tablespace with the
tablespace-map
option, but it is sometimes preferable to remap all tablespaces to a new directory all at once. This is particularly useful for development or staging systems that may not have the same storage layout as the original system where the backup was generated.
The path specified will be the parent path used to create all the tablespaces in the backup.
example: --tablespace-map-all=/data/tablespace
Target Option ( --target )
Recovery target.
Defines the recovery target when
--type
is
lsn
,
name
,
xid
, or
time
. If the target is prior to the latest backup and
--type
is not
time
or
lsn
, then use the
--set
option to specify the backup set.
example: --target=2015-01-30 14:15:11 EST
Target Action Option ( --target-action )
Action to take when recovery target is reached.
When
hot_standby=on
, the default since
PostgreSQL
10, this option consistently controls what the cluster does when the target is reached or there is no more WAL in the archive.
When
hot_standby=off
in
PostgreSQL
>= 12,
pause
acts like
shutdown
. When
hot_standby=off
in
PostgreSQL
< 12,
pause
acts like
promote
.
The following actions are supported:
- pause - pause when recovery target is reached.
- promote - promote and switch timeline when recovery target is reached.
- shutdown - shutdown server when recovery target is reached. ( PostgreSQL >= 9.5)
default: pause example: --target-action=promote
Target Exclusive Option ( --target-exclusive )
Stop just before the recovery target is reached.
Defines whether recovery to the target would be exclusive (the default is inclusive) and is only valid when
--type
is
lsn
,
time
or
xid
. For example, using
--target-exclusive
would exclude the contents of transaction
1007
when
--type=xid
and
--target=1007
. See the
recovery_target_inclusive
option in the
PostgreSQL
docs for more information.
default: n example: --no-target-exclusive
Target Timeline Option ( --target-timeline )
Recover along a timeline.
See
recovery_target_timeline
in the
PostgreSQL
docs for more information.
example: --target-timeline=3
Type Option ( --type )
Recovery type.
The following recovery types are supported:
- default - recover to the end of the archive stream.
- immediate - recover only until the database becomes consistent. This option is only supported on PostgreSQL >= 9.4.
- lsn - recover to the LSN (Log Sequence Number) specified in --target . This option is only supported on PostgreSQL >= 10.
- name - recover the restore point specified in --target .
- xid - recover to the transaction id specified in --target .
- time - recover to the time specified in --target .
- preserve - preserve the existing postgresql.auto.conf or recovery.conf file.
- standby - add standby_mode=on to the postgresql.auto.conf or recovery.conf file so cluster will start in standby mode.
- none - no postgresql.auto.conf or recovery.conf file is written so PostgreSQL will attempt to achieve consistency using WAL segments present in pg_xlog / pg_wal . Provide the required WAL segments or use the archive-copy setting to include them with the backup.
WARNING:
Recovery
type=none
should be avoided because the timeline will not be incremented at the end of recovery. This can lead to, for example,
PostgreSQL
attempting to archive duplicate WAL, which will be rejected, and may cause the disk to fill up and result in a
PostgreSQL
panic. In addition, tools like
pg_rewind
may not work correctly or may cause corruption.
Note that the default restore
type
for offline backups is
none
since Point-in-Time-Recovery is not possible if
wal_level=minimal
. If
type
is set explicitly then it will be honored since Point-in-Time-Recovery is possible from offline backups as long as
wal_level > minimal
.
default: default example: --type=xid
General Options
Buffer Size Option ( --buffer-size )
Buffer size for I/O operations.
Buffer size used for copy, compress, encrypt, and other operations. The number of buffers used depends on options and each operation may use additional memory, e.g.
gz
compression may use an additional 256KiB of memory.
Allowed values are
16KiB
,
32KiB
,
64KiB
,
128KiB
,
256KiB
,
512KiB
,
1MiB
,
2MiB
,
4MiB
,
8MiB
, and
16MiB
.
default: 1MiB example: --buffer-size=2MiB
pgBackRest Command Option ( --cmd )
pgBackRest
command.
pgBackRest
may generate a command string, e.g. when the
restore
command generates the
restore_command
setting. The command used to run the
pgBackRest
process will be used in this case unless the
cmd
option is provided.
CAUTION:
Wrapping the
pgBackRest
command may cause unpredictable behavior and is not recommended.
example: --cmd=/var/lib/pgsql/bin/pgbackrest_wrapper.sh
SSH Client Command Option ( --cmd-ssh )
SSH client command.
Use a specific SSH client command when an alternate is desired or the
ssh
command is not in $PATH.
default: ssh example: --cmd-ssh=/usr/bin/ssh
Network Compress Level Option ( --compress-level-network )
Network compression level.
Sets the network compression level when
compress-type=none
and the command is not run on the same host as the repository. Compression is used to reduce network traffic but can be disabled by setting
compress-level-network=0
. When
compress-type
does not equal
none
the
compress-level-network
setting is ignored and
compress-level
is used instead so that the file is only compressed once.
default: 3 allowed: 0-9 example: --compress-level-network=1
Config Option ( --config )
pgBackRest
configuration file.
Use this option to specify a different configuration file than the default.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_FILE example: --config=/conf/pgbackrest/pgbackrest.conf
Config Include Path Option ( --config-include-path )
Path to additional
pgBackRest
configuration files.
Configuration files existing in the specified location with extension
.conf
will be concatenated with the
pgBackRest
configuration file, resulting in one configuration file.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_INCLUDE_PATH example: --config-include-path=/conf/pgbackrest/conf.d
Config Path Option ( --config-path )
Base path of
pgBackRest
configuration files.
This setting is used to override the default base path setting for the
--config
and
--config-include-path
options unless they are explicitly set on the command-line.
For example, passing only
--config-path=/conf/pgbackrest
results in the
--config
default being set to
/conf/pgbackrest/pgbackrest.conf
and the
--config-include-path
default being set to
/conf/pgbackrest/conf.d
.
default: CFGOPTDEF_CONFIG_PATH example: --config-path=/conf/pgbackrest
Delta Option ( --delta )
Restore or backup using checksums.
During a restore, by default the
PostgreSQL
data and tablespace directories are expected to be present but empty. This option performs a delta restore using checksums.
During a backup, this option will use checksums instead of the timestamps to determine if files will be copied.
default: n example: --delta
I/O Timeout Option ( --io-timeout )
I/O timeout.
Timeout, in seconds, used for connections and read/write operations.
Note that the entire read/write operation does not need to complete within this timeout but
some
progress must be made, even if it is only a single byte.
default: 1m allowed: 100ms-1h example: --io-timeout=120
Lock Path Option ( --lock-path )
Path where lock files are stored.
The lock path provides a location for
pgBackRest
to create lock files to prevent conflicting operations from being run concurrently.
default: /tmp/pgbackrest example: --lock-path=/backup/db/lock
Neutral Umask Option ( --neutral-umask )
Use a neutral umask.
Sets the umask to 0000 so modes in the repository are created in a sensible way. The default directory mode is 0750 and default file mode is 0640. The lock and log directories set the directory and file mode to 0770 and 0660 respectively.
To use the executing user's umask instead specify
neutral-umask=n
in the config file or
--no-neutral-umask
on the command line.
default: y example: --no-neutral-umask
Process Maximum Option ( --process-max )
Max processes to use for compress/transfer.
Each process will perform compression and transfer to make the command run faster, but don't set
process-max
so high that it impacts database performance.
default: 1 allowed: 1-999 example: --process-max=4
Protocol Timeout Option ( --protocol-timeout )
Protocol timeout.
Sets the timeout, in seconds, that the local or remote process will wait for a new message to be received on the protocol layer. This prevents processes from waiting indefinitely for a message.
NOTE:
The
protocol-timeout
option must be greater than the
db-timeout
option.
default: 31m allowed: 100ms-7d example: --protocol-timeout=630
Keep Alive Option ( --sck-keep-alive )
Keep-alive enable.
Enables keep-alive messages on socket connections.
default: y example: --no-sck-keep-alive
Stanza Option ( --stanza )
Defines the stanza.
A stanza is the configuration for a
PostgreSQL
database cluster that defines where it is located, how it will be backed up, archiving options, etc. Most db servers will only have one
PostgreSQL
database cluster and therefore one stanza, whereas backup servers will have a stanza for every database cluster that needs to be backed up.
It is tempting to name the stanza after the primary cluster but a better name describes the databases contained in the cluster. Because the stanza name will be used for the primary and all replicas it is more appropriate to choose a name that describes the actual function of the cluster, such as app or dw, rather than the local cluster name, such as main or prod.
example: --stanza=main
Keep Alive Count Option ( --tcp-keep-alive-count )
Keep-alive count.
Specifies the number of TCP keep-alive messages that can be lost before the connection is considered dead.
This option is available on systems that support the
TCP_KEEPCNT
socket option.
allowed: 1-32 example: --tcp-keep-alive-count=3
Keep Alive Idle Option ( --tcp-keep-alive-idle )
Keep-alive idle time.
Specifies the amount of time (in seconds) with no network activity after which the operating system should send a TCP keep-alive message.
This option is available on systems that support the
TCP_KEEPIDLE
socket option.
allowed: 1-3600 example: --tcp-keep-alive-idle=60
Keep Alive Interval Option ( --tcp-keep-alive-interval )
Keep-alive interval time.
Specifies the amount of time (in seconds) after which a TCP keep-alive message that has not been acknowledged should be retransmitted.
This option is available on systems that support the
TCP_KEEPINTVL
socket option.
allowed: 1-900 example: --tcp-keep-alive-interval=30
Log Options
Console Log Level Option ( --log-level-console )
Level for console logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: warn example: --log-level-console=error
File Log Level Option ( --log-level-file )
Level for file logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: info example: --log-level-file=debug
Std Error Log Level Option ( --log-level-stderr )
Level for stderr logging.
Specifies which log levels will output to
stderr
rather than
stdout
(specified by
log-level-console
). The timestamp and process will not be output to
stderr
.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: off example: --log-level-stderr=error
Log Path Option ( --log-path )
Path where log files are stored.
The log path provides a location for
pgBackRest
to store log files. Note that if
log-level-file=off
then no log path is required.
default: /var/log/pgbackrest example: --log-path=/backup/db/log
Maintainer Options
Force PostgreSQL Version Option ( --pg-version-force )
Force
PostgreSQL
version.
The specified
PostgreSQL
version will be used instead of the version automatically detected by reading
pg_control
or WAL headers. This is mainly useful for
PostgreSQL
forks or development versions where those values are different from the release version. The version reported by
PostgreSQL
via `server_version_num` must match the forced version.
WARNING:
Be cautious when using this option because
pg_control
and WAL headers will still be read with the expected format for the specified version, i.e. the format from the official open-source version of
PostgreSQL
. If the fork or development version changes the format of the fields that
pgBackRest
depends on it will lead to unexpected behavior. In general, this option will only work as expected if the fork adds all custom struct members
after
the standard
PostgreSQL
members.
example: --pg-version-force=15
Repository Options
Set Repository Option ( --repo )
Set repository.
Set the repository for a command to operate on.
For example, this option may be used to perform a restore from a specific repository, rather than letting
pgBackRest
choose.
allowed: 1-256 example: --repo=1
Azure Repository Container Option ( --repo-azure-container )
Azure repository container.
Azure container used to store the repository.
pgBackRest
repositories can be stored in the container root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other Azure-generated content can also be stored in the container.
example: --repo1-azure-container=pg-backup
Azure Repository Key Type Option ( --repo-azure-key-type )
Azure repository key type.
The following types are supported for authorization:
- shared - Shared key
- sas - Shared access signature
default: shared example: --repo1-azure-key-type=sas
Azure Repository URI Style Option ( --repo-azure-uri-style )
Azure URI Style.
The following URI styles are supported:
- host - Connect to account.endpoint host.
- path - Connect to endpoint host and prepend account to URIs.
default: host example: --repo1-azure-uri-style=path
Repository Cipher Type Option ( --repo-cipher-type )
Cipher used to encrypt the repository.
The following cipher types are supported:
- none - The repository is not encrypted
- aes-256-cbc - Advanced Encryption Standard with 256 bit key length
Note that encryption is always performed client-side even if the repository type (e.g. S3) supports encryption.
default: none example: --repo1-cipher-type=aes-256-cbc
GCS Repository Bucket Option ( --repo-gcs-bucket )
GCS repository bucket.
GCS bucket used to store the repository.
pgBackRest
repositories can be stored in the bucket root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other GCS-generated content can also be stored in the bucket.
example: --repo1-gcs-bucket=/pg-backup
GCS Repository Endpoint Option ( --repo-gcs-endpoint )
GCS repository endpoint.
Endpoint used to connect to the storage service. May be updated to use a local GCS server or alternate endpoint.
default: storage.googleapis.com example: --repo1-gcs-endpoint=localhost
GCS Repository Key Type Option ( --repo-gcs-key-type )
GCS repository key type.
The following types are supported for authorization:
- auto - Authorize using the instance service account.
- service - Service account from locally stored key.
- token - For local testing, e.g. fakegcs .
When
repo-gcs-key-type=service
the credentials will be reloaded when the authentication token is renewed.
default: service example: --repo1-gcs-key-type=auto
Repository Host Option ( --repo-host )
Repository host when operating remotely.
When backing up and archiving to a locally mounted filesystem this setting is not required.
example: --repo1-host=repo1.domain.com
Deprecated Name: backup-host
Repository Host Certificate Authority File Option ( --repo-host-ca-file )
Repository host certificate authority file.
Use a CA file other than the system default for connecting to the repository host.
example: --repo1-host-ca-file=/etc/pki/tls/certs/ca-bundle.crt
Repository Host Certificate Authority Path Option ( --repo-host-ca-path )
Repository host certificate authority path.
Use a CA path other than the system default for connecting to the repository host.
example: --repo1-host-ca-path=/etc/pki/tls/certs
Repository Host Certificate File Option ( --repo-host-cert-file )
Repository host certificate file.
Sent to repository host to prove client identity.
example: --repo1-host-cert-file=/path/to/client.crt
Repository Host Command Option ( --repo-host-cmd )
Repository host
pgBackRest
command.
Required only if the path to the
pgBackRest
command is different on the local and repository hosts. If not defined, the repository host command will be set the same as the local command.
example: --repo1-host-cmd=/usr/lib/backrest/bin/pgbackrest
Deprecated Name: backup-cmd
Repository Host Configuration Option ( --repo-host-config )
pgBackRest
repository host configuration file.
Sets the location of the configuration file on the repository host. This is only required if the repository host configuration file is in a different location than the local configuration file.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_FILE example: --repo1-host-config=/conf/pgbackrest/pgbackrest.conf
Deprecated Name: backup-config
Repository Host Configuration Include Path Option ( --repo-host-config-include-path )
pgBackRest
repository host configuration include path.
Sets the location of the configuration include path on the repository host. This is only required if the repository host configuration include path is in a different location than the local configuration include path.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_INCLUDE_PATH example: --repo1-host-config-include-path=/conf/pgbackrest/conf.d
Repository Host Configuration Path Option ( --repo-host-config-path )
pgBackRest
repository host configuration path.
Sets the location of the configuration path on the repository host. This is only required if the repository host configuration path is in a different location than the local configuration path.
default: CFGOPTDEF_CONFIG_PATH example: --repo1-host-config-path=/conf/pgbackrest
Repository Host Key File Option ( --repo-host-key-file )
Repository host key file.
Proves client certificate was sent by owner.
example: --repo1-host-key-file=/path/to/client.key
Repository Host Port Option ( --repo-host-port )
Repository host port when
repo-host
is set.
Use this option to specify a non-default port for the repository host protocol.
allowed: 0-65535 example: --repo1-host-port=25
Deprecated Name: backup-ssh-port
Repository Host Protocol Type Option ( --repo-host-type )
Repository host protocol type.
The following protocol types are supported:
- ssh - Secure Shell.
- tls - pgBackRest TLS server.
default: ssh example: --repo1-host-type=tls
Repository Host User Option ( --repo-host-user )
Repository host user when
repo-host
is set.
Defines the user that will be used for operations on the repository host. Preferably this is not the
postgres
user but rather some other user like
pgbackrest
. If
PostgreSQL
runs on the repository host the
postgres
user can be placed in the
pgbackrest
group so it has read permissions on the repository without being able to damage the contents accidentally.
default: pgbackrest example: --repo1-host-user=repo-user
Deprecated Name: backup-user
Repository Path Option ( --repo-path )
Path where backups and archive are stored.
The repository is where
pgBackRest
stores backups and archives WAL segments.
It may be difficult to estimate in advance how much space you'll need. The best thing to do is take some backups then record the size of different types of backups (full/incr/diff) and measure the amount of WAL generated per day. This will give you a general idea of how much space you'll need, though of course requirements will likely change over time as your database evolves.
default: /var/lib/pgbackrest example: --repo1-path=/backup/db/backrest
S3 Repository Bucket Option ( --repo-s3-bucket )
S3 repository bucket.
S3 bucket used to store the repository.
pgBackRest
repositories can be stored in the bucket root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other AWS generated content can also be stored in the bucket.
example: --repo1-s3-bucket=pg-backup
S3 Repository Endpoint Option ( --repo-s3-endpoint )
S3 repository endpoint.
The AWS endpoint should be valid for the selected region.
For custom/test configurations the
repo-storage-ca-file
,
repo-storage-ca-path
,
repo-storage-host
,
repo-storage-port
, and
repo-storage-verify-tls
options may be useful.
example: --repo1-s3-endpoint=s3.amazonaws.com
S3 Repository Key Type Option ( --repo-s3-key-type )
S3 repository key type.
The following types are supported:
- shared - Shared keys
- auto - Automatically retrieve temporary credentials
- web-id - Automatically retrieve web identity credentials
default: shared example: --repo1-s3-key-type=auto
S3 Repository KMS Key ID Option ( --repo-s3-kms-key-id )
S3 repository KMS key.
Setting this option enables S3 server-side encryption using the specified AWS key management service key.
example: --repo1-s3-kms-key-id=bceb4f13-6939-4be3-910d-df54dee817b7
S3 Repository Region Option ( --repo-s3-region )
S3 repository region.
The AWS region where the bucket was created.
example: --repo1-s3-region=us-east-1
S3 Repository Role Option ( --repo-s3-role )
S3 repository role.
The AWS role name (not the full ARN) used to retrieve temporary credentials when
repo-s3-key-type=auto
.
example: --repo1-s3-role=authrole
S3 Repository URI Style Option ( --repo-s3-uri-style )
S3 URI Style.
The following URI styles are supported:
- host - Connect to bucket.endpoint host.
- path - Connect to endpoint host and prepend bucket to URIs.
default: host example: --repo1-s3-uri-style=path
SFTP Repository Host Option ( --repo-sftp-host )
SFTP repository host.
The SFTP host containing the repository.
example: --repo1-sftp-host=sftprepo.domain
SFTP Repository Host Fingerprint Option ( --repo-sftp-host-fingerprint )
SFTP repository host fingerprint.
SFTP repository host fingerprint generation should match the
repo-sftp-host-key-hash-type
. Generate the fingerprint via
awk '{print $2}' ssh_host_xxx_key.pub | base64 -d | (md5sum or sha1sum) -b
. The ssh host keys are normally found in the
/etc/ssh
directory.
example: --repo1-sftp-host-fingerprint=f84e172dfead7aeeeae6c1fdfb5aa8cf
SFTP Host Key Check Type Option ( --repo-sftp-host-key-check-type )
SFTP host key check type.
The following SFTP host key check types are supported:
- strict - pgBackRest will never automatically add host keys to the ~/.ssh/known_hosts file, and refuses to connect to hosts whose host key has changed or is not found in the known hosts files. This option forces the user to manually add all new hosts.
- accept-new - pgBackRest will automatically add new host keys to the user's known hosts file, but will not permit connections to hosts with changed host keys.
- fingerprint - pgBackRest will check the host key against the fingerprint specified by the repo-sftp-host-fingerprint option.
- none - no host key checking will be performed.
default: strict example: --repo1-sftp-host-key-check-type=accept-new
SFTP Repository Host Key Hash Type Option ( --repo-sftp-host-key-hash-type )
SFTP repository host key hash type.
SFTP repository host key hash type. Declares the hash type to be used to compute the digest of the remote system's host key on SSH startup. Newer versions of
libssh2
support
sha256
in addition to md5 and sha1.
example: --repo1-sftp-host-key-hash-type=sha256
SFTP Repository Host Port Option ( --repo-sftp-host-port )
SFTP repository host port.
SFTP repository host port.
default: 22 allowed: 1-65535 example: --repo1-sftp-host-port=22
SFTP Repository Host User Option ( --repo-sftp-host-user )
SFTP repository host user.
User on the host used to store the repository.
example: --repo1-sftp-host-user=pg-backup
SFTP Known Hosts File Option ( --repo-sftp-known-host )
SFTP known hosts file.
A known hosts file to search for an SFTP host match during authentication. When unspecified,
pgBackRest
will default to searching
~/.ssh/known_hosts
,
~/.ssh/known_hosts2
,
/etc/ssh/ssh_known_hosts
, and
/etc/ssh/ssh_known_hosts2
. If configured with one or more file paths,
pgBackRest
will search those for a match. File paths must be full or leading tilde paths. The
repo-sftp-known-host
option can be passed multiple times to specify more than one known hosts file to search. To utilize known hosts file checking
repo-sftp-host-fingerprint
must not be specified. See also
repo-sftp-host-check-type
option.
example: --repo1-sftp-known-host=/home/postgres/.ssh/known_hosts
SFTP Repository Private Key File Option ( --repo-sftp-private-key-file )
SFTP private key file.
SFTP private key file used for authentication.
example: --repo1-sftp-private-key-file=~/.ssh/id_ed25519
SFTP Repository Public Key File Option ( --repo-sftp-public-key-file )
SFTP public key file.
SFTP public key file used for authentication. Optional if compiled against OpenSSL, required if compiled against a different library.
example: --repo1-sftp-public-key-file=~/.ssh/id_ed25519.pub
Repository Storage CA File Option ( --repo-storage-ca-file )
Repository storage CA file.
Use a CA file other than the system default for storage (e.g. S3, Azure) certificates.
example: --repo1-storage-ca-file=/etc/pki/tls/certs/ca-bundle.crt
Deprecated Names: repo-azure-ca-file, repo-s3-ca-file
Repository Storage TLS CA Path Option ( --repo-storage-ca-path )
Repository storage CA path.
Use a CA path other than the system default for storage (e.g. S3, Azure) certificates.
example: --repo1-storage-ca-path=/etc/pki/tls/certs
Deprecated Names: repo-azure-ca-path, repo-s3-ca-path
Repository Storage Host Option ( --repo-storage-host )
Repository storage host.
Connect to a host other than the storage (e.g. S3, Azure) endpoint. This is typically used for testing.
example: --repo1-storage-host=127.0.0.1
Deprecated Names: repo-azure-host, repo-s3-host
Repository Storage Port Option ( --repo-storage-port )
Repository storage port.
Port to use when connecting to the storage (e.g. S3, Azure) endpoint (or host if specified).
default: 443 allowed: 1-65535 example: --repo1-storage-port=9000
Deprecated Names: repo-azure-port, repo-s3-port
Repository Storage Tag Option ( --repo-storage-tag )
Repository storage tag(s).
Specify tags that will be added to objects when the repository is an object store (e.g. S3). The option can be repeated to add multiple tags.
There is no provision in
pgBackRest
to modify these tags so be sure to set them correctly before running
stanza-create
to ensure uniform tags across the entire repository.
example: --repo1-storage-tag=key1=value1
Repository Storage Upload Chunk Size Option ( --repo-storage-upload-chunk-size )
Repository storage upload chunk size.
Object stores such as S3 allow files to be uploaded in chunks when the file is too large to be stored in memory. Even if the file can be stored in memory, it is more memory efficient to limit the amount of memory used for uploads.
A larger chunk size will generally lead to better performance because it will minimize upload requests and allow more files to be uploaded in a single request rather than in chunks. The disadvantage is that memory usage will be higher and because the chunk buffer must be allocated per process, larger
process-max
values will lead to more memory being consumed overall.
Default chunk sizes by repo type:
- azure - 4MiB
- gcs - 4MiB
- s3 - 5MiB
Note that valid chunk sizes vary by storage type and by platform. For example,
AWS S3
has a minimum chunk size of 5MiB but
S3
clones may accept lower values. Terminology for chunk size varies by storage type, so when searching min/max values use
part sizefor AWS S3 ,
chunk sizefor GCS , and
block sizefor Azure . No attempt is made to validate configured chunk sizes so selecting an invalid value will lead to errors from the storage service or undefined behavior.
allowed: 64KiB-1TiB example: --repo1-storage-upload-chunk-size=16MiB
Repository Storage Certificate Verify Option ( --repo-storage-verify-tls )
Repository storage certificate verify.
This option provides the ability to enable/disable verification of the storage (e.g. S3, Azure) server TLS certificate. Disabling should only be used for testing or other scenarios where a certificate has been self-signed.
default: y example: --no-repo1-storage-verify-tls
Deprecated Names: repo-azure-verify-tls, repo-s3-verify-ssl, repo-s3-verify-tls
Repository Type Option ( --repo-type )
Type of storage used for the repository.
The following repository types are supported:
- azure - Azure Blob Storage Service
- cifs - Like posix , but disables links and directory fsyncs
- gcs - Google Cloud Storage
- posix - Posix-compliant file systems
- s3 - AWS Simple Storage Service
- sftp - Secure File Transfer Protocol
When an
NFS
mount is used as a
posix
repository, the same rules apply to
pgBackRest
as described in the
PostgreSQL
documentation:
Creating a Database Cluster - File Systems
.
default: posix example: --repo1-type=cifs
Stanza Options
PostgreSQL Path Option ( --pg-path )
PostgreSQL
data directory.
This should be the same as the
data_directory
setting in
postgresql.conf
. Even though this value can be read from
postgresql.conf
or
PostgreSQL
it is prudent to set it in case those resources are not available during a restore or offline backup scenario.
The
pg-path
option is tested against the value reported by
PostgreSQL
on every online backup so it should always be current.
example: --pg1-path=/data/db
Deprecated Name: db-path
Server Command ( server )
The
pgBackRest
server allows access to remote hosts without using the
SSH
protocol.
Command Options
TLS Server Address Option ( --tls-server-address )
TLS server address.
IP address the server will listen on for client requests.
default: localhost example: --tls-server-address=*
TLS Server Authorized Clients Option ( --tls-server-auth )
TLS server authorized clients.
Clients are authorized on the server by verifying their certificate and checking their certificate CN (Common Name) against a list on the server configured with the
tls-server-auth
option.
A client CN can be authorized for as many stanzas as needed by repeating the
tls-server-auth
option, or for all stanzas by specifying
tls-server-auth=client-cn=*
. Wildcards may not be specified for the client CN.
example: --tls-server-auth=client-cn=stanza1
TLS Server Certificate Authorities Option ( --tls-server-ca-file )
TLS server certificate authorities.
Checks that client certificates are signed by a trusted certificate authority.
example: --tls-server-ca-file=/path/to/server.ca
TLS Server Certificate Option ( --tls-server-cert-file )
TLS server certificate file.
Sent to the client to show the server identity.
example: --tls-server-cert-file=/path/to/server.crt
General Options
Buffer Size Option ( --buffer-size )
Buffer size for I/O operations.
Buffer size used for copy, compress, encrypt, and other operations. The number of buffers used depends on options and each operation may use additional memory, e.g.
gz
compression may use an additional 256KiB of memory.
Allowed values are
16KiB
,
32KiB
,
64KiB
,
128KiB
,
256KiB
,
512KiB
,
1MiB
,
2MiB
,
4MiB
,
8MiB
, and
16MiB
.
default: 1MiB example: --buffer-size=2MiB
Config Option ( --config )
pgBackRest
configuration file.
Use this option to specify a different configuration file than the default.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_FILE example: --config=/conf/pgbackrest/pgbackrest.conf
Config Include Path Option ( --config-include-path )
Path to additional
pgBackRest
configuration files.
Configuration files existing in the specified location with extension
.conf
will be concatenated with the
pgBackRest
configuration file, resulting in one configuration file.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_INCLUDE_PATH example: --config-include-path=/conf/pgbackrest/conf.d
Config Path Option ( --config-path )
Base path of
pgBackRest
configuration files.
This setting is used to override the default base path setting for the
--config
and
--config-include-path
options unless they are explicitly set on the command-line.
For example, passing only
--config-path=/conf/pgbackrest
results in the
--config
default being set to
/conf/pgbackrest/pgbackrest.conf
and the
--config-include-path
default being set to
/conf/pgbackrest/conf.d
.
default: CFGOPTDEF_CONFIG_PATH example: --config-path=/conf/pgbackrest
I/O Timeout Option ( --io-timeout )
I/O timeout.
Timeout, in seconds, used for connections and read/write operations.
Note that the entire read/write operation does not need to complete within this timeout but
some
progress must be made, even if it is only a single byte.
default: 1m allowed: 100ms-1h example: --io-timeout=120
Protocol Timeout Option ( --protocol-timeout )
Protocol timeout.
Sets the timeout, in seconds, that the local or remote process will wait for a new message to be received on the protocol layer. This prevents processes from waiting indefinitely for a message.
NOTE:
The
protocol-timeout
option must be greater than the
db-timeout
option.
default: 31m allowed: 100ms-7d example: --protocol-timeout=630
Keep Alive Option ( --sck-keep-alive )
Keep-alive enable.
Enables keep-alive messages on socket connections.
default: y example: --no-sck-keep-alive
Keep Alive Count Option ( --tcp-keep-alive-count )
Keep-alive count.
Specifies the number of TCP keep-alive messages that can be lost before the connection is considered dead.
This option is available on systems that support the
TCP_KEEPCNT
socket option.
allowed: 1-32 example: --tcp-keep-alive-count=3
Keep Alive Idle Option ( --tcp-keep-alive-idle )
Keep-alive idle time.
Specifies the amount of time (in seconds) with no network activity after which the operating system should send a TCP keep-alive message.
This option is available on systems that support the
TCP_KEEPIDLE
socket option.
allowed: 1-3600 example: --tcp-keep-alive-idle=60
Keep Alive Interval Option ( --tcp-keep-alive-interval )
Keep-alive interval time.
Specifies the amount of time (in seconds) after which a TCP keep-alive message that has not been acknowledged should be retransmitted.
This option is available on systems that support the
TCP_KEEPINTVL
socket option.
allowed: 1-900 example: --tcp-keep-alive-interval=30
Log Options
Console Log Level Option ( --log-level-console )
Level for console logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: warn example: --log-level-console=error
File Log Level Option ( --log-level-file )
Level for file logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: info example: --log-level-file=debug
Std Error Log Level Option ( --log-level-stderr )
Level for stderr logging.
Specifies which log levels will output to
stderr
rather than
stdout
(specified by
log-level-console
). The timestamp and process will not be output to
stderr
.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: off example: --log-level-stderr=error
Server Ping Command ( server-ping )
Ping a
pgBackRest
TLS
server to ensure it is accepting connections. This serves as an aliveness check only since no authentication is attempted.
If no host is specified on the command-line then the
tls-server-host
option will be used.
Command Options
General Options
Buffer Size Option ( --buffer-size )
Buffer size for I/O operations.
Buffer size used for copy, compress, encrypt, and other operations. The number of buffers used depends on options and each operation may use additional memory, e.g.
gz
compression may use an additional 256KiB of memory.
Allowed values are
16KiB
,
32KiB
,
64KiB
,
128KiB
,
256KiB
,
512KiB
,
1MiB
,
2MiB
,
4MiB
,
8MiB
, and
16MiB
.
default: 1MiB example: --buffer-size=2MiB
Config Option ( --config )
pgBackRest
configuration file.
Use this option to specify a different configuration file than the default.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_FILE example: --config=/conf/pgbackrest/pgbackrest.conf
Config Include Path Option ( --config-include-path )
Path to additional
pgBackRest
configuration files.
Configuration files existing in the specified location with extension
.conf
will be concatenated with the
pgBackRest
configuration file, resulting in one configuration file.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_INCLUDE_PATH example: --config-include-path=/conf/pgbackrest/conf.d
Config Path Option ( --config-path )
Base path of
pgBackRest
configuration files.
This setting is used to override the default base path setting for the
--config
and
--config-include-path
options unless they are explicitly set on the command-line.
For example, passing only
--config-path=/conf/pgbackrest
results in the
--config
default being set to
/conf/pgbackrest/pgbackrest.conf
and the
--config-include-path
default being set to
/conf/pgbackrest/conf.d
.
default: CFGOPTDEF_CONFIG_PATH example: --config-path=/conf/pgbackrest
I/O Timeout Option ( --io-timeout )
I/O timeout.
Timeout, in seconds, used for connections and read/write operations.
Note that the entire read/write operation does not need to complete within this timeout but
some
progress must be made, even if it is only a single byte.
default: 1m allowed: 100ms-1h example: --io-timeout=120
Keep Alive Option ( --sck-keep-alive )
Keep-alive enable.
Enables keep-alive messages on socket connections.
default: y example: --no-sck-keep-alive
Keep Alive Count Option ( --tcp-keep-alive-count )
Keep-alive count.
Specifies the number of TCP keep-alive messages that can be lost before the connection is considered dead.
This option is available on systems that support the
TCP_KEEPCNT
socket option.
allowed: 1-32 example: --tcp-keep-alive-count=3
Keep Alive Idle Option ( --tcp-keep-alive-idle )
Keep-alive idle time.
Specifies the amount of time (in seconds) with no network activity after which the operating system should send a TCP keep-alive message.
This option is available on systems that support the
TCP_KEEPIDLE
socket option.
allowed: 1-3600 example: --tcp-keep-alive-idle=60
Keep Alive Interval Option ( --tcp-keep-alive-interval )
Keep-alive interval time.
Specifies the amount of time (in seconds) after which a TCP keep-alive message that has not been acknowledged should be retransmitted.
This option is available on systems that support the
TCP_KEEPINTVL
socket option.
allowed: 1-900 example: --tcp-keep-alive-interval=30
Log Options
Console Log Level Option ( --log-level-console )
Level for console logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: warn example: --log-level-console=error
File Log Level Option ( --log-level-file )
Level for file logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: info example: --log-level-file=debug
Std Error Log Level Option ( --log-level-stderr )
Level for stderr logging.
Specifies which log levels will output to
stderr
rather than
stdout
(specified by
log-level-console
). The timestamp and process will not be output to
stderr
.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: off example: --log-level-stderr=error
Stanza Create Command ( stanza-create )
The
stanza-create
command must be run after the stanza has been configured in
pgbackrest.conf
. If there is more than one repository configured, the stanza will be created on each. Stanzas that have already been created will be skipped so it is always safe to run
stanza-create
, even when a new repository has been configured.
See
Create the Stanza
for more information and an example.
General Options
Buffer Size Option ( --buffer-size )
Buffer size for I/O operations.
Buffer size used for copy, compress, encrypt, and other operations. The number of buffers used depends on options and each operation may use additional memory, e.g.
gz
compression may use an additional 256KiB of memory.
Allowed values are
16KiB
,
32KiB
,
64KiB
,
128KiB
,
256KiB
,
512KiB
,
1MiB
,
2MiB
,
4MiB
,
8MiB
, and
16MiB
.
default: 1MiB example: --buffer-size=2MiB
pgBackRest Command Option ( --cmd )
pgBackRest
command.
pgBackRest
may generate a command string, e.g. when the
restore
command generates the
restore_command
setting. The command used to run the
pgBackRest
process will be used in this case unless the
cmd
option is provided.
CAUTION:
Wrapping the
pgBackRest
command may cause unpredictable behavior and is not recommended.
example: --cmd=/var/lib/pgsql/bin/pgbackrest_wrapper.sh
SSH Client Command Option ( --cmd-ssh )
SSH client command.
Use a specific SSH client command when an alternate is desired or the
ssh
command is not in $PATH.
default: ssh example: --cmd-ssh=/usr/bin/ssh
Network Compress Level Option ( --compress-level-network )
Network compression level.
Sets the network compression level when
compress-type=none
and the command is not run on the same host as the repository. Compression is used to reduce network traffic but can be disabled by setting
compress-level-network=0
. When
compress-type
does not equal
none
the
compress-level-network
setting is ignored and
compress-level
is used instead so that the file is only compressed once.
default: 3 allowed: 0-9 example: --compress-level-network=1
Config Option ( --config )
pgBackRest
configuration file.
Use this option to specify a different configuration file than the default.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_FILE example: --config=/conf/pgbackrest/pgbackrest.conf
Config Include Path Option ( --config-include-path )
Path to additional
pgBackRest
configuration files.
Configuration files existing in the specified location with extension
.conf
will be concatenated with the
pgBackRest
configuration file, resulting in one configuration file.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_INCLUDE_PATH example: --config-include-path=/conf/pgbackrest/conf.d
Config Path Option ( --config-path )
Base path of
pgBackRest
configuration files.
This setting is used to override the default base path setting for the
--config
and
--config-include-path
options unless they are explicitly set on the command-line.
For example, passing only
--config-path=/conf/pgbackrest
results in the
--config
default being set to
/conf/pgbackrest/pgbackrest.conf
and the
--config-include-path
default being set to
/conf/pgbackrest/conf.d
.
default: CFGOPTDEF_CONFIG_PATH example: --config-path=/conf/pgbackrest
Database Timeout Option ( --db-timeout )
Database query timeout.
Sets the timeout, in seconds, for queries against the database. This includes the backup start/stop functions which can each take a substantial amount of time. Because of this the timeout should be kept high unless you know that these functions will return quickly (i.e. if you have set
start-fast=y
and you know that the database cluster will not generate many WAL segments during the backup).
NOTE:
The
db-timeout
option must be less than the
protocol-timeout
option.
default: 30m allowed: 100ms-7d example: --db-timeout=600
I/O Timeout Option ( --io-timeout )
I/O timeout.
Timeout, in seconds, used for connections and read/write operations.
Note that the entire read/write operation does not need to complete within this timeout but
some
progress must be made, even if it is only a single byte.
default: 1m allowed: 100ms-1h example: --io-timeout=120
Lock Path Option ( --lock-path )
Path where lock files are stored.
The lock path provides a location for
pgBackRest
to create lock files to prevent conflicting operations from being run concurrently.
default: /tmp/pgbackrest example: --lock-path=/backup/db/lock
Neutral Umask Option ( --neutral-umask )
Use a neutral umask.
Sets the umask to 0000 so modes in the repository are created in a sensible way. The default directory mode is 0750 and default file mode is 0640. The lock and log directories set the directory and file mode to 0770 and 0660 respectively.
To use the executing user's umask instead specify
neutral-umask=n
in the config file or
--no-neutral-umask
on the command line.
default: y example: --no-neutral-umask
Protocol Timeout Option ( --protocol-timeout )
Protocol timeout.
Sets the timeout, in seconds, that the local or remote process will wait for a new message to be received on the protocol layer. This prevents processes from waiting indefinitely for a message.
NOTE:
The
protocol-timeout
option must be greater than the
db-timeout
option.
default: 31m allowed: 100ms-7d example: --protocol-timeout=630
Keep Alive Option ( --sck-keep-alive )
Keep-alive enable.
Enables keep-alive messages on socket connections.
default: y example: --no-sck-keep-alive
Stanza Option ( --stanza )
Defines the stanza.
A stanza is the configuration for a
PostgreSQL
database cluster that defines where it is located, how it will be backed up, archiving options, etc. Most db servers will only have one
PostgreSQL
database cluster and therefore one stanza, whereas backup servers will have a stanza for every database cluster that needs to be backed up.
It is tempting to name the stanza after the primary cluster but a better name describes the databases contained in the cluster. Because the stanza name will be used for the primary and all replicas it is more appropriate to choose a name that describes the actual function of the cluster, such as app or dw, rather than the local cluster name, such as main or prod.
example: --stanza=main
Keep Alive Count Option ( --tcp-keep-alive-count )
Keep-alive count.
Specifies the number of TCP keep-alive messages that can be lost before the connection is considered dead.
This option is available on systems that support the
TCP_KEEPCNT
socket option.
allowed: 1-32 example: --tcp-keep-alive-count=3
Keep Alive Idle Option ( --tcp-keep-alive-idle )
Keep-alive idle time.
Specifies the amount of time (in seconds) with no network activity after which the operating system should send a TCP keep-alive message.
This option is available on systems that support the
TCP_KEEPIDLE
socket option.
allowed: 1-3600 example: --tcp-keep-alive-idle=60
Keep Alive Interval Option ( --tcp-keep-alive-interval )
Keep-alive interval time.
Specifies the amount of time (in seconds) after which a TCP keep-alive message that has not been acknowledged should be retransmitted.
This option is available on systems that support the
TCP_KEEPINTVL
socket option.
allowed: 1-900 example: --tcp-keep-alive-interval=30
Log Options
Console Log Level Option ( --log-level-console )
Level for console logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: warn example: --log-level-console=error
File Log Level Option ( --log-level-file )
Level for file logging.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: info example: --log-level-file=debug
Std Error Log Level Option ( --log-level-stderr )
Level for stderr logging.
Specifies which log levels will output to
stderr
rather than
stdout
(specified by
log-level-console
). The timestamp and process will not be output to
stderr
.
The following log levels are supported:
- off - No logging at all (not recommended)
- error - Log only errors
- warn - Log warnings and errors
- info - Log info, warnings, and errors
- detail - Log detail, info, warnings, and errors
- debug - Log debug, detail, info, warnings, and errors
- trace - Log trace (very verbose debugging), debug, info, warnings, and errors
default: off example: --log-level-stderr=error
Log Path Option ( --log-path )
Path where log files are stored.
The log path provides a location for
pgBackRest
to store log files. Note that if
log-level-file=off
then no log path is required.
default: /var/log/pgbackrest example: --log-path=/backup/db/log
Maintainer Options
Force PostgreSQL Version Option ( --pg-version-force )
Force
PostgreSQL
version.
The specified
PostgreSQL
version will be used instead of the version automatically detected by reading
pg_control
or WAL headers. This is mainly useful for
PostgreSQL
forks or development versions where those values are different from the release version. The version reported by
PostgreSQL
via `server_version_num` must match the forced version.
WARNING:
Be cautious when using this option because
pg_control
and WAL headers will still be read with the expected format for the specified version, i.e. the format from the official open-source version of
PostgreSQL
. If the fork or development version changes the format of the fields that
pgBackRest
depends on it will lead to unexpected behavior. In general, this option will only work as expected if the fork adds all custom struct members
after
the standard
PostgreSQL
members.
example: --pg-version-force=15
Repository Options
Azure Repository Container Option ( --repo-azure-container )
Azure repository container.
Azure container used to store the repository.
pgBackRest
repositories can be stored in the container root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other Azure-generated content can also be stored in the container.
example: --repo1-azure-container=pg-backup
Azure Repository Key Type Option ( --repo-azure-key-type )
Azure repository key type.
The following types are supported for authorization:
- shared - Shared key
- sas - Shared access signature
default: shared example: --repo1-azure-key-type=sas
Azure Repository URI Style Option ( --repo-azure-uri-style )
Azure URI Style.
The following URI styles are supported:
- host - Connect to account.endpoint host.
- path - Connect to endpoint host and prepend account to URIs.
default: host example: --repo1-azure-uri-style=path
Repository Cipher Type Option ( --repo-cipher-type )
Cipher used to encrypt the repository.
The following cipher types are supported:
- none - The repository is not encrypted
- aes-256-cbc - Advanced Encryption Standard with 256 bit key length
Note that encryption is always performed client-side even if the repository type (e.g. S3) supports encryption.
default: none example: --repo1-cipher-type=aes-256-cbc
GCS Repository Bucket Option ( --repo-gcs-bucket )
GCS repository bucket.
GCS bucket used to store the repository.
pgBackRest
repositories can be stored in the bucket root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other GCS-generated content can also be stored in the bucket.
example: --repo1-gcs-bucket=/pg-backup
GCS Repository Endpoint Option ( --repo-gcs-endpoint )
GCS repository endpoint.
Endpoint used to connect to the storage service. May be updated to use a local GCS server or alternate endpoint.
default: storage.googleapis.com example: --repo1-gcs-endpoint=localhost
GCS Repository Key Type Option ( --repo-gcs-key-type )
GCS repository key type.
The following types are supported for authorization:
- auto - Authorize using the instance service account.
- service - Service account from locally stored key.
- token - For local testing, e.g. fakegcs .
When
repo-gcs-key-type=service
the credentials will be reloaded when the authentication token is renewed.
default: service example: --repo1-gcs-key-type=auto
Repository Host Option ( --repo-host )
Repository host when operating remotely.
When backing up and archiving to a locally mounted filesystem this setting is not required.
example: --repo1-host=repo1.domain.com
Deprecated Name: backup-host
Repository Host Certificate Authority File Option ( --repo-host-ca-file )
Repository host certificate authority file.
Use a CA file other than the system default for connecting to the repository host.
example: --repo1-host-ca-file=/etc/pki/tls/certs/ca-bundle.crt
Repository Host Certificate Authority Path Option ( --repo-host-ca-path )
Repository host certificate authority path.
Use a CA path other than the system default for connecting to the repository host.
example: --repo1-host-ca-path=/etc/pki/tls/certs
Repository Host Certificate File Option ( --repo-host-cert-file )
Repository host certificate file.
Sent to repository host to prove client identity.
example: --repo1-host-cert-file=/path/to/client.crt
Repository Host Command Option ( --repo-host-cmd )
Repository host
pgBackRest
command.
Required only if the path to the
pgBackRest
command is different on the local and repository hosts. If not defined, the repository host command will be set the same as the local command.
example: --repo1-host-cmd=/usr/lib/backrest/bin/pgbackrest
Deprecated Name: backup-cmd
Repository Host Configuration Option ( --repo-host-config )
pgBackRest
repository host configuration file.
Sets the location of the configuration file on the repository host. This is only required if the repository host configuration file is in a different location than the local configuration file.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_FILE example: --repo1-host-config=/conf/pgbackrest/pgbackrest.conf
Deprecated Name: backup-config
Repository Host Configuration Include Path Option ( --repo-host-config-include-path )
pgBackRest
repository host configuration include path.
Sets the location of the configuration include path on the repository host. This is only required if the repository host configuration include path is in a different location than the local configuration include path.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_INCLUDE_PATH example: --repo1-host-config-include-path=/conf/pgbackrest/conf.d
Repository Host Configuration Path Option ( --repo-host-config-path )
pgBackRest
repository host configuration path.
Sets the location of the configuration path on the repository host. This is only required if the repository host configuration path is in a different location than the local configuration path.
default: CFGOPTDEF_CONFIG_PATH example: --repo1-host-config-path=/conf/pgbackrest
Repository Host Key File Option ( --repo-host-key-file )
Repository host key file.
Proves client certificate was sent by owner.
example: --repo1-host-key-file=/path/to/client.key
Repository Host Port Option ( --repo-host-port )
Repository host port when
repo-host
is set.
Use this option to specify a non-default port for the repository host protocol.
allowed: 0-65535 example: --repo1-host-port=25
Deprecated Name: backup-ssh-port
Repository Host Protocol Type Option ( --repo-host-type )
Repository host protocol type.
The following protocol types are supported:
- ssh - Secure Shell.
- tls - pgBackRest TLS server.
default: ssh example: --repo1-host-type=tls
Repository Host User Option ( --repo-host-user )
Repository host user when
repo-host
is set.
Defines the user that will be used for operations on the repository host. Preferably this is not the
postgres
user but rather some other user like
pgbackrest
. If
PostgreSQL
runs on the repository host the
postgres
user can be placed in the
pgbackrest
group so it has read permissions on the repository without being able to damage the contents accidentally.
default: pgbackrest example: --repo1-host-user=repo-user
Deprecated Name: backup-user
Repository Path Option ( --repo-path )
Path where backups and archive are stored.
The repository is where
pgBackRest
stores backups and archives WAL segments.
It may be difficult to estimate in advance how much space you'll need. The best thing to do is take some backups then record the size of different types of backups (full/incr/diff) and measure the amount of WAL generated per day. This will give you a general idea of how much space you'll need, though of course requirements will likely change over time as your database evolves.
default: /var/lib/pgbackrest example: --repo1-path=/backup/db/backrest
S3 Repository Bucket Option ( --repo-s3-bucket )
S3 repository bucket.
S3 bucket used to store the repository.
pgBackRest
repositories can be stored in the bucket root by setting
repo-path=/
but it is usually best to specify a prefix, such as
/repo
, so logs and other AWS generated content can also be stored in the bucket.
example: --repo1-s3-bucket=pg-backup
S3 Repository Endpoint Option ( --repo-s3-endpoint )
S3 repository endpoint.
The AWS endpoint should be valid for the selected region.
For custom/test configurations the
repo-storage-ca-file
,
repo-storage-ca-path
,
repo-storage-host
,
repo-storage-port
, and
repo-storage-verify-tls
options may be useful.
example: --repo1-s3-endpoint=s3.amazonaws.com
S3 Repository Key Type Option ( --repo-s3-key-type )
S3 repository key type.
The following types are supported:
- shared - Shared keys
- auto - Automatically retrieve temporary credentials
- web-id - Automatically retrieve web identity credentials
default: shared example: --repo1-s3-key-type=auto
S3 Repository KMS Key ID Option ( --repo-s3-kms-key-id )
S3 repository KMS key.
Setting this option enables S3 server-side encryption using the specified AWS key management service key.
example: --repo1-s3-kms-key-id=bceb4f13-6939-4be3-910d-df54dee817b7
S3 Repository Region Option ( --repo-s3-region )
S3 repository region.
The AWS region where the bucket was created.
example: --repo1-s3-region=us-east-1
S3 Repository Role Option ( --repo-s3-role )
S3 repository role.
The AWS role name (not the full ARN) used to retrieve temporary credentials when
repo-s3-key-type=auto
.
example: --repo1-s3-role=authrole
S3 Repository URI Style Option ( --repo-s3-uri-style )
S3 URI Style.
The following URI styles are supported:
- host - Connect to bucket.endpoint host.
- path - Connect to endpoint host and prepend bucket to URIs.
default: host example: --repo1-s3-uri-style=path
SFTP Repository Host Option ( --repo-sftp-host )
SFTP repository host.
The SFTP host containing the repository.
example: --repo1-sftp-host=sftprepo.domain
SFTP Repository Host Fingerprint Option ( --repo-sftp-host-fingerprint )
SFTP repository host fingerprint.
SFTP repository host fingerprint generation should match the
repo-sftp-host-key-hash-type
. Generate the fingerprint via
awk '{print $2}' ssh_host_xxx_key.pub | base64 -d | (md5sum or sha1sum) -b
. The ssh host keys are normally found in the
/etc/ssh
directory.
example: --repo1-sftp-host-fingerprint=f84e172dfead7aeeeae6c1fdfb5aa8cf
SFTP Host Key Check Type Option ( --repo-sftp-host-key-check-type )
SFTP host key check type.
The following SFTP host key check types are supported:
- strict - pgBackRest will never automatically add host keys to the ~/.ssh/known_hosts file, and refuses to connect to hosts whose host key has changed or is not found in the known hosts files. This option forces the user to manually add all new hosts.
- accept-new - pgBackRest will automatically add new host keys to the user's known hosts file, but will not permit connections to hosts with changed host keys.
- fingerprint - pgBackRest will check the host key against the fingerprint specified by the repo-sftp-host-fingerprint option.
- none - no host key checking will be performed.
default: strict example: --repo1-sftp-host-key-check-type=accept-new
SFTP Repository Host Key Hash Type Option ( --repo-sftp-host-key-hash-type )
SFTP repository host key hash type.
SFTP repository host key hash type. Declares the hash type to be used to compute the digest of the remote system's host key on SSH startup. Newer versions of
libssh2
support
sha256
in addition to md5 and sha1.
example: --repo1-sftp-host-key-hash-type=sha256
SFTP Repository Host Port Option ( --repo-sftp-host-port )
SFTP repository host port.
SFTP repository host port.
default: 22 allowed: 1-65535 example: --repo1-sftp-host-port=22
SFTP Repository Host User Option ( --repo-sftp-host-user )
SFTP repository host user.
User on the host used to store the repository.
example: --repo1-sftp-host-user=pg-backup
SFTP Known Hosts File Option ( --repo-sftp-known-host )
SFTP known hosts file.
A known hosts file to search for an SFTP host match during authentication. When unspecified,
pgBackRest
will default to searching
~/.ssh/known_hosts
,
~/.ssh/known_hosts2
,
/etc/ssh/ssh_known_hosts
, and
/etc/ssh/ssh_known_hosts2
. If configured with one or more file paths,
pgBackRest
will search those for a match. File paths must be full or leading tilde paths. The
repo-sftp-known-host
option can be passed multiple times to specify more than one known hosts file to search. To utilize known hosts file checking
repo-sftp-host-fingerprint
must not be specified. See also
repo-sftp-host-check-type
option.
example: --repo1-sftp-known-host=/home/postgres/.ssh/known_hosts
SFTP Repository Private Key File Option ( --repo-sftp-private-key-file )
SFTP private key file.
SFTP private key file used for authentication.
example: --repo1-sftp-private-key-file=~/.ssh/id_ed25519
SFTP Repository Public Key File Option ( --repo-sftp-public-key-file )
SFTP public key file.
SFTP public key file used for authentication. Optional if compiled against OpenSSL, required if compiled against a different library.
example: --repo1-sftp-public-key-file=~/.ssh/id_ed25519.pub
Repository Storage CA File Option ( --repo-storage-ca-file )
Repository storage CA file.
Use a CA file other than the system default for storage (e.g. S3, Azure) certificates.
example: --repo1-storage-ca-file=/etc/pki/tls/certs/ca-bundle.crt
Deprecated Names: repo-azure-ca-file, repo-s3-ca-file
Repository Storage TLS CA Path Option ( --repo-storage-ca-path )
Repository storage CA path.
Use a CA path other than the system default for storage (e.g. S3, Azure) certificates.
example: --repo1-storage-ca-path=/etc/pki/tls/certs
Deprecated Names: repo-azure-ca-path, repo-s3-ca-path
Repository Storage Host Option ( --repo-storage-host )
Repository storage host.
Connect to a host other than the storage (e.g. S3, Azure) endpoint. This is typically used for testing.
example: --repo1-storage-host=127.0.0.1
Deprecated Names: repo-azure-host, repo-s3-host
Repository Storage Port Option ( --repo-storage-port )
Repository storage port.
Port to use when connecting to the storage (e.g. S3, Azure) endpoint (or host if specified).
default: 443 allowed: 1-65535 example: --repo1-storage-port=9000
Deprecated Names: repo-azure-port, repo-s3-port
Repository Storage Tag Option ( --repo-storage-tag )
Repository storage tag(s).
Specify tags that will be added to objects when the repository is an object store (e.g. S3). The option can be repeated to add multiple tags.
There is no provision in
pgBackRest
to modify these tags so be sure to set them correctly before running
stanza-create
to ensure uniform tags across the entire repository.
example: --repo1-storage-tag=key1=value1
Repository Storage Upload Chunk Size Option ( --repo-storage-upload-chunk-size )
Repository storage upload chunk size.
Object stores such as S3 allow files to be uploaded in chunks when the file is too large to be stored in memory. Even if the file can be stored in memory, it is more memory efficient to limit the amount of memory used for uploads.
A larger chunk size will generally lead to better performance because it will minimize upload requests and allow more files to be uploaded in a single request rather than in chunks. The disadvantage is that memory usage will be higher and because the chunk buffer must be allocated per process, larger
process-max
values will lead to more memory being consumed overall.
Default chunk sizes by repo type:
- azure - 4MiB
- gcs - 4MiB
- s3 - 5MiB
Note that valid chunk sizes vary by storage type and by platform. For example,
AWS S3
has a minimum chunk size of 5MiB but
S3
clones may accept lower values. Terminology for chunk size varies by storage type, so when searching min/max values use
part sizefor AWS S3 ,
chunk sizefor GCS , and
block sizefor Azure . No attempt is made to validate configured chunk sizes so selecting an invalid value will lead to errors from the storage service or undefined behavior.
allowed: 64KiB-1TiB example: --repo1-storage-upload-chunk-size=16MiB
Repository Storage Certificate Verify Option ( --repo-storage-verify-tls )
Repository storage certificate verify.
This option provides the ability to enable/disable verification of the storage (e.g. S3, Azure) server TLS certificate. Disabling should only be used for testing or other scenarios where a certificate has been self-signed.
default: y example: --no-repo1-storage-verify-tls
Deprecated Names: repo-azure-verify-tls, repo-s3-verify-ssl, repo-s3-verify-tls
Repository Type Option ( --repo-type )
Type of storage used for the repository.
The following repository types are supported:
- azure - Azure Blob Storage Service
- cifs - Like posix , but disables links and directory fsyncs
- gcs - Google Cloud Storage
- posix - Posix-compliant file systems
- s3 - AWS Simple Storage Service
- sftp - Secure File Transfer Protocol
When an
NFS
mount is used as a
posix
repository, the same rules apply to
pgBackRest
as described in the
PostgreSQL
documentation:
Creating a Database Cluster - File Systems
.
default: posix example: --repo1-type=cifs
Stanza Options
PostgreSQL Database Option ( --pg-database )
PostgreSQL
database.
The database name used when connecting to
PostgreSQL
. The default is usually best but some installations may not contain this database.
Note that for legacy reasons the setting of the
PGDATABASE
environment variable will be ignored.
default: postgres example: --pg1-database=backupdb
PostgreSQL Host Option ( --pg-host )
PostgreSQL
host for operating remotely.
Used for backups where the
PostgreSQL
host is different from the repository host.
example: --pg1-host=db.domain.com
Deprecated Name: db-host
PostgreSQL Host Certificate Authority File Option ( --pg-host-ca-file )
PostgreSQL
host certificate authority file.
Use a CA file other than the system default for connecting to the
PostgreSQL
host.
example: --pg1-host-ca-file=/etc/pki/tls/certs/ca-bundle.crt
PostgreSQL Host Certificate Authority Path Option ( --pg-host-ca-path )
PostgreSQL
host certificate authority path.
Use a CA path other than the system default for connecting to the
PostgreSQL
host.
example: --pg1-host-ca-path=/etc/pki/tls/certs
PostgreSQL Host Certificate File Option ( --pg-host-cert-file )
PostgreSQL
host certificate file.
Sent to
PostgreSQL
host to prove client identity.
example: --pg1-host-cert-file=/path/to/client.crt
PostgreSQL Host Command Option ( --pg-host-cmd )
PostgreSQL
host
pgBackRest
command.
Required only if the path to the
pgBackRest
command is different on the local and
PostgreSQL
hosts. If not defined, the
PostgreSQL
host command will be set the same as the local command.
example: --pg1-host-cmd=/usr/lib/backrest/bin/pgbackrest
Deprecated Name: db-cmd
PostgreSQL Host Configuration Option ( --pg-host-config )
pgBackRest
database host configuration file.
Sets the location of the configuration file on the
PostgreSQL
host. This is only required if the
PostgreSQL
host configuration file is in a different location than the local configuration file.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_FILE example: --pg1-host-config=/conf/pgbackrest/pgbackrest.conf
Deprecated Name: db-config
PostgreSQL Host Configuration Include Path Option ( --pg-host-config-include-path )
pgBackRest
database host configuration include path.
Sets the location of the configuration include path on the
PostgreSQL
host. This is only required if the
PostgreSQL
host configuration include path is in a different location than the local configuration include path.
default: CFGOPTDEF_CONFIG_PATH "/" PROJECT_CONFIG_INCLUDE_PATH example: --pg1-host-config-include-path=/conf/pgbackrest/conf.d
PostgreSQL Host Configuration Path Option ( --pg-host-config-path )
pgBackRest
database host configuration path.
Sets the location of the configuration path on the
PostgreSQL
host. This is only required if the
PostgreSQL
host configuration path is in a different location than the local configuration path.
default: CFGOPTDEF_CONFIG_PATH example: --pg1-host-config-path=/conf/pgbackrest