# recovery_end_command

> recovery_end_command sets the shell command that will be executed once at the end of recovery. It is a sighup setting present in PG12–18; the latest recorded boot default is empty.
---

> [!NOTE]
> **Fact — official short description:** “Sets the shell command that will be executed once at the end of recovery.”

## Identity {#identity}

| Field | Value | Meaning |
| --- | --- | --- |
| Type | `string` | Upstream pg_settings type |
| Context | `sighup` | Takes effect after configuration reload |
| Unit | — | Raw unit |
| Range | — | Raw limits in the last observed version |
| Enum values | — | — for non-enum types |
| Category | Write-Ahead Log / Archive Recovery | Upstream classification |
| Latest boot value | `""` | empty string |
{.fields meta="-"}

## Lifecycle {#lifecycle}

| Fact | Value |
| --- | --- |
| First observed | PG12 |
| Present in | PG12–19 Beta 3 |
| Removed in | No |
| Introduction commit | [`2dedf4d9a899`](https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=2dedf4d9a899b36d1a8ed29be5efbd1b31a8fe85) — Integrate recovery.conf into postgresql.conf |
| Commit date | 2018-11-25 |
| Discussion | [thread 1](https://www.postgresql.org/message-id/flat/607741529606767@web3g.yandex.ru/) |

## Default history {#default-history}

| Versions | Raw `boot_val` | Unit | Human value |
| --- | --- | --- | --- |
| PG12–19 Beta 3 | `""` | — | empty string |
{.full-width caption="Measured PG9.0–19 Beta 3 boot defaults"}

## How it works {#mechanism}

Sets the shell command that will be executed once at the end of recovery. A configuration reload applies a new value; existing work already in flight is not retroactively changed.

PostgreSQL runs this shell command once when archive recovery finishes or a standby is promoted. %r expands to the last restart-point file name; command failure is logged but must not be treated as a transactional post-promotion hook.

Monitor and change recovery_end_command together with archive_mode, archive_command, archive_library. Validate on the relevant server role and real workload, then use its sighup context to choose session change, reload, or restart; a historical boot default is not the current effective value.

## Tuning advice {#tuning-advice}

> [!TIP]
> **Advice.** These are workload-specific starting points and must be validated with measurements.

| Workload | Guidance |
| --- | --- |
| OLTP | Manage recovery_end_command as part of the backup/restore protocol: the command or module must be idempotent, fail visibly, and be verified by restoring from the real archive—not merely by exit status. |
| OLAP | Provision archive throughput and capacity for bulk-load WAL peaks. If archiving falls behind, throttle the job and alert; never hide backlog with false success or aggressive cleanup. |
| Small nodes | Enable it only for a defined PITR requirement and use a mature backup tool. Keep rebuildable instances simple, but never install a no-op command that creates the illusion of a backup. |
{.full-width}

## Pigsty {#pigsty}

Values use the fixed 8-vCPU, 32-GiB, 100-GiB SSD fixture and render the current Pigsty templates for PG19 Beta 3; this does not assert current Pigsty support for that historical or beta release.

| Template | Effective value | Versus upstream boot | Source expression |
| --- | --- | --- | --- |
| OLTP | Unmodified | — | — |
| OLAP | Unmodified | — | — |
| CRIT | Unmodified | — | — |
| TINY | Unmodified | — | — |
{.full-width}

> [!CAUTION]
> **Advice — pending human review.** Fact from the current Pigsty template projection: OLTP: PG12–19 Beta 3 unmodified; OLAP: PG12–19 Beta 3 unmodified; CRIT: PG12–19 Beta 3 unmodified; TINY: PG12–19 Beta 3 unmodified. No Pigsty-specific rationale is inferred from an absent override.

## Common pitfalls {#common-pitfalls}

- Treating the shell command as a transactional promotion hook whose failure rolls recovery back.
- Misreading %r and deleting WAL still needed by another recovery consumer.
- Using non-idempotent external side effects without accounting for promotion and recovery retries.
- Assuming a reload executes the command; it runs once when archive recovery ends.
- Embedding credentials or unsafe shell expansion in a command executed by the PostgreSQL service account.

## Related parameters {#related-parameters}

[`archive_mode`](/parameters/archive-mode/) · [`archive_command`](/parameters/archive-command/) · [`archive_library`](/parameters/archive-library/) · [`archive_timeout`](/parameters/archive-timeout/) · [`archive_cleanup_command`](/parameters/archive-cleanup-command/) · [`restore_command`](/parameters/restore-command/)

## References {#references}

- [PostgreSQL 19 Beta 3 — recovery_end_command](https://www.postgresql.org/docs/19/runtime-config-wal.html#GUC-RECOVERY-END-COMMAND)
- [PostgreSQL 19 release notes](https://www.postgresql.org/docs/19/release-19.html)
- [Machine-readable GUC export](/data/guc.jsonl)