allow_alter_system

allow_alter_system allows running the ALTER SYSTEM command. It is a sighup setting present in PG17–18; the latest recorded boot default is on.

Note

Fact — official short description: “Allows running the ALTER SYSTEM command.”

Identity

Type , Valuebool: Upstream pg_settings type
Context , Valuesighup: Takes effect after configuration reload
Unit , Value—: Raw unit
Range , Value—: Raw limits in the last observed version
Enum values , Value—: — for non-enum types
Category , ValueVersion and Platform Compatibility / Other Platforms and Clients: Upstream classification
Latest boot value , Valueon: on

Lifecycle

Fact	Value
First observed	PG17
Present in	PG17–19 Beta 3
Removed in	No
Introduction commit	`d3ae2a24f265` — Add allow_alter_system GUC.
Commit date	2024-03-29
Discussion	thread 1

Default history

Measured PG9.0–19 Beta 3 boot defaults
Versions	Raw `boot_val`	Unit	Human value
PG17–19 Beta 3	`on`	—	on

How it works

Allows running the ALTER SYSTEM command. A configuration reload applies a new value; existing work already in flight is not retroactively changed.

When off, PostgreSQL rejects ALTER SYSTEM before it can rewrite postgresql.auto.conf. The switch neither erases existing auto.conf entries nor prevents an operating-system administrator from editing configuration files, so it is an SQL administration boundary rather than a filesystem security boundary.

Monitor and change allow_alter_system together with config_file, data_directory, hba_file. Validate on the relevant server role and real workload, then use its sighup context to choose session change, reload, or restart; a historical boot default is not the current effective value.

Tuning advice

Tip

Advice. These are workload-specific starting points and must be validated with measurements.

Workload	Guidance
OLTP	A managed environment whose configuration controller owns postgresql.conf/auto.conf may disable it to narrow the SQL administration surface. Audit existing auto.conf and still restrict filesystem and superuser access.
OLAP	Use the same policy as OLTP. If batch tooling calls ALTER SYSTEM, migrate it to the declarative configuration interface first so jobs do not begin failing silently after reload.
Small nodes	A single-admin instance may keep the default, but ALTER SYSTEM is not a change-audit system; retain versioned configuration, rollback, and restart/reload records.

Pigsty

Values use the fixed 8-vCPU, 32-GiB, 100-GiB SSD fixture and render the current Pigsty templates for PG19 Beta 3; this does not assert current Pigsty support for that historical or beta release.

Template	Effective value	Versus upstream boot	Source expression
OLTP	Unmodified	—	—
OLAP	Unmodified	—	—
CRIT	Unmodified	—	—
TINY	Unmodified	—	—

Caution

Advice — pending human review. Fact from the current Pigsty template projection: OLTP: PG17–19 Beta 3 unmodified; OLAP: PG17–19 Beta 3 unmodified; CRIT: PG17–19 Beta 3 unmodified; TINY: PG17–19 Beta 3 unmodified. No Pigsty-specific rationale is inferred from an absent override.

Common pitfalls

Keeping a compatibility switch permanently instead of fixing the client.
Testing in one session and deploying globally to unrelated applications.
Confusing parsing compatibility with data or security compatibility.
Forgetting to remove an override after the upgrade migration is complete.

config_file · data_directory · hba_file · ident_file · external_pid_file · transform_null_equals