Skip to content

Troubleshooting

pg_vault_tables must be loaded via shared_preload_libraries

The extension is not enabled on this server.

Add it to postgresql.conf and restart — a reload will not do:

shared_preload_libraries = 'pg_vault_tables'

If you see this on a standby, that replica is missing the setting. Replication has been working fine regardless; only reading vault tables is affected. See Replication and Standbys.

unrecognized parameter "permissions"

Same cause, different symptom. You are running CREATE TABLE ... WITH (permissions = ...) on a server where the extension is not loaded, so PostgreSQL does not recognise the option.

openssl/ssl.h: No such file or directory when building

Install the development headers:

sudo apt-get install libssl-dev libkrb5-dev     # Debian, Ubuntu
sudo dnf install openssl-devel krb5-devel       # Rocky, RHEL, Fedora

The same applies to gssapi/gssapi.h. See Installation.

a vault table must specify "permissions"

USING vault was given without a permissions list. A vault table with no permissions would refuse everything forever and could never be altered, so it is treated as a mistake.

"truncate" cannot be granted on a table that sets "retention"

They cannot be combined. TRUNCATE empties a table in one operation without consulting retention, so the pair would declare a retention period that a single statement could ignore.

Grant delete instead if rows must be removable before their deadline.

row in vault table "x" is still within its retention period

Working as intended. The row has not reached its deadline.

To delete only eligible rows:

DELETE FROM x WHERE _$purge_ts < now();

To see when a row becomes eligible:

SELECT id, _$purge_ts FROM x WHERE id = 42;

ALTER TABLE is not permitted on vault table "x"

Working as intended. Vault tables cannot be altered — see What You Cannot Change.

The fix is a new table with the definition you want, and copying the data across.

vault table "x" already holds its one permitted insert

The table grants insertonce and has been used. Nothing can reset it.

Note that a rolled-back insert does not consume it. If you are seeing this on what you believe is an empty table, check whether an earlier transaction actually committed.

drop is not permitted on vault table "x"

The table does not grant drop, so it cannot be removed by anybody. See Uninstalling for what your options actually are.

Restored rows all expire in the future

restore_mode was not set during the restore, so every row was given a fresh retention period.

There is no way to recalculate the original deadlines after the fact — the information is not in the database. Restore again from the same dump, this time with the setting on. See Backups and Restores.

A logical replication subscription has stalled

Check the subscriber's log for a violation record. The usual cause is the subscriber's copy of the table granting less than the publisher sends — for instance insert where the stream contains updates.

Both sides need the same permissions unless you specifically intend otherwise.

PostgreSQL will not start after removing the extension files

shared_preload_libraries still names a library that is no longer on disk.

Edit postgresql.conf to remove it and start again — or put the file back. See Uninstalling for the correct order.

Something else

Violation records in the server log are the first place to look. They record what was attempted, why it was refused, and who by. See Monitoring Violations.