cockroach start , which you use to start a new multi-node cluster or add nodes to an existing cluster.
Node-level settings are defined by flags passed to the
cockroach start command and cannot be changed without stopping and restarting the node. In contrast, some cluster-wide settings are defined via SQL statements and can be updated anytime after a cluster has been started. For more details, see .Synopsis
Start a node to be part of a new multi-node cluster:Flags
Thecockroach start command supports the following general-use, networking, security, and logging flags.
Many flags have useful defaults that can be overridden by specifying the flags explicitly. If you specify flags explicitly, however, be sure to do so each time the node is restarted, as they will not be remembered. The one exception is the --join flag, which is stored in a node’s data directory. We still recommend specifying the --join flag every time, as this will allow nodes to rejoin the cluster even if their data directory was destroyed.
General
Networking
Security
Locality
The--locality flag accepts arbitrary key-value pairs that describe the location of the node. Locality should include a region key-value if you are using CockroachDB’s .
Depending on your deployment you can also specify country, availability zone, etc. The key-value pairs should be ordered into locality tiers from most inclusive to least inclusive (e.g., region before availability zone as in region=eu-west-1,zone=eu-west-1a), and the keys and order of key-value pairs must be the same on all nodes. It’s typically better to include more pairs than fewer.
- Specifying a region with a
regiontier is required in order to enable CockroachDB’s . - CockroachDB spreads the replicas of each piece of data across as diverse a set of localities as possible, with the order determining the priority. Locality can also be used to influence the location of data replicas in various ways using high-level or low-level .
- When there is high latency between nodes (e.g., cross-availability zone deployments), CockroachDB uses locality to move range leases closer to the current workload, reducing network round trips and improving read performance, also known as . In a deployment across more than 3 availability zones, however, to ensure that all data benefits from “follow-the-workload”, you must increase your replication factor to match the total number of availability zones.
- Locality is also a prerequisite for using the , , and Enterprise features.
Example
The following shell commands use the--locality flag to start 9 nodes to run across 3 regions: us-east-1, us-west-1, and europe-west-1. Each region’s nodes are further spread across different availability zones within that region.
This example follows the conventions required to use CockroachDB’s .
us-east-1:
us-west-1:
europe-west-1:
Load-based lease rebalancing in uneven latency deployments
When nodes are started with the--locality flag, CockroachDB attempts to place the replica lease holder (the replica that client requests are forwarded to) on the node closest to the source of the request. This means as client requests move geographically, so too does the replica lease holder.
However, you might see increased latency caused by a consistently high rate of lease transfers between datacenters in the following case:
- Your cluster runs in datacenters which are very different distances away from each other.
- Each node was started with a single tier of
--locality, e.g.,--locality=datacenter=a. - Most client requests get sent to a single datacenter because that’s where all your application traffic is.
--locality=region=foo,datacenter=a and --locality=region=foo,datacenter=b, while restarting nodes in datacenter C with a different region, --locality=region=bar,datacenter=c.
Storage
Storage engine
The--storage-engine flag is used to choose the storage engine used by the node. Note that this setting applies to all stores on the node, including the temp store.
As of v21.1 and later, CockroachDB always uses the . As such, pebble is the default and only option for the --storage-engine flag.
Store
The--store flag allows you to specify details about a node’s storage.
To start a node with multiple disks or SSDs, provide a separate --store flag for each disk when starting the cockroach process on the node. For more details about stores, see .
If you start a node with multiple
--store flags, it is not possible to scale back down to only using a single store on the node. Instead, you must decommission the node and start a new node with the updated --store.--store flag supports the following fields. Note that commas are used to separate fields, and so are forbidden in all field values.
In-memory storage is not suitable for production deployments at this time.
Write Ahead Log (WAL) failover
On a CockroachDB with , you can mitigate some effects of by configuring the node to failover each store’s to another store’s data directory using the--wal-failover flag to or the COCKROACH_WAL_FAILOVER environment variable.
Failing over the WAL may allow some operations against a store to continue to complete despite temporary unavailability of the underlying storage. For example, if the node’s primary store is stalled, and the node can’t read from or write to it, the node can still write to the WAL on another store. This can allow the node to continue to service requests during momentary unavailability of the underlying storage device.
When WAL failover is enabled, CockroachDB does the following:
- Pairs each primary store with a secondary failover store at node startup.
- Monitors latency of all write operations against the primary WAL. If any operation exceeds the duration of , the node redirects new WAL writes to the secondary store.
- Checks the primary store while failed over by performing a set of filesystem operations against a small internal “probe file” on its volume. This file contains no user data and exists only when WAL failover is enabled.
- Switches back to the primary store once the set of filesystem operations against the probe file on its volume starts consuming less than a latency threshold (order of tens of milliseconds). If a probe
fsyncblocks longer than , CockroachDB emits a log like:disk stall detected: sync on file probe-file has been ongoing for 40.0sand, if the stall persists, the node exits (fatals) to and allow recovery elsewhere. - Exposes status at so you can monitor each store’s health and failover state.
- WAL failover only relocates the WAL. Data files remain on the primary volume. Reads that miss the Pebble block cache and the OS page cache can still stall if the primary disk is stalled. Caches typically limit blast radius, but some reads may see elevated latency.
Enable WAL failover
To enable WAL failover, you must take one of the following actions:- Pass
--wal-failover=among-storestocockroach start, or - Set the environment variable
COCKROACH_WAL_FAILOVER=among-storesbefore starting the node.
- Disable . File-based audit logging cannot coexist with the WAL failover feature. File-based audit logging provides guarantees that every log message makes it to disk, or CockroachDB must be shut down. For this reason, resuming operations in the face of disk unavailability is not compatible with audit logging.
- Enable asynchronous buffering of using the
bufferingconfiguration option. Thebufferingconfiguration can be applied to or individualfile-groupsas needed. Note that enabling asynchronous buffering offile-groupslog sinks is in . - Set
max-staleness: 1sandflush-trigger-size: 256KiB. - When
bufferingis enabled,buffered-writesmust be explicitly disabled as shown in the following example. This is necessary becausebuffered-writesdoes not provide true asynchronous disk access, but rather a small buffer. If the small buffer fills up, it can cause internal routines performing logging operations to hang. This will in turn cause internal routines doing other important work to hang, potentially affecting cluster stability. - The recommended logging configuration for using file-based logging with WAL failover is as follows:
Disable WAL failover
To disable WAL failover, you must and either:- Pass the
--wal-failover=disabledflag tocockroach start, or - Set the environment variable
COCKROACH_WAL_FAILOVER=disabledbefore restarting the node.
Monitor WAL failover
You can monitor WAL failover occurrences using the following metrics:storage.wal.failover.secondary.duration: Cumulative time spent (in nanoseconds) writing to the secondary WAL directory. Only populated when WAL failover is configured.storage.wal.failover.primary.duration: Cumulative time spent (in nanoseconds) writing to the primary WAL directory. Only populated when WAL failover is configured.storage.wal.failover.switch.count: Count of the number of times WAL writing has switched from primary to secondary store, and vice versa.storage.wal.fsync.latencymonitors the latencies of WAL files. If you have WAL failover enabled and are failing over,storage.wal.fsync.latencywill include the latency of the stalled primary.storage.wal.failover.write_and_sync.latency: When WAL failover is configured in a cluster, the operator should monitor this metric which shows the effective latency observed by the higher layer writing to the WAL. This metric is expected to stay low in a healthy system, regardless of whether WAL files are being written to the primary or secondary.
storage.wal.failover.secondary.duration is the primary metric to monitor. You should expect this metric to be 0 unless a WAL failover occurs. If a WAL failover occurs, the rate at which it increases provides an indication of the health of the primary store.
You can access these metrics via the following methods:
- The in .
- By .
Logging
By ,cockroach start writes all messages to log files, and prints nothing to stderr. This includes events with INFO and higher. However, you can of this command by using the --log flag:
Defaults
See the .Standard output
When you runcockroach start, some helpful details are printed to the standard output:
Examples
Start a multi-node cluster
To start a multi-node cluster, run thecockroach start command for each node, setting the --join flag to the addresses of the initial nodes.
For a cluster in a single region, set 3-5 --join addresses. Each starting node will attempt to contact one of the join hosts. In case a join host cannot be reached, the node will try another address on the list until it can join the gossip network.
When starting a multi-region cluster, set more than one --join address per region, and select nodes that are spread across failure domains. This ensures .
- Secure
- Insecure
Start a multi-region cluster
In this example we will start a multi-node with a multi-region setup that uses the same regions (passed to the--locality flag) as the multi-region MovR demo application.
-
Start a node in the
us-east1region: -
Start a node in the
us-west1region: -
Start a node in the
europe-west1region: -
Initialize the cluster:
-
Connect to the cluster using :
-
Issue the statement to verify that the list of regions is expected:
For more information about the
--locality flag, see Locality.Start a multi-node cluster across private networks
Scenario:- You have a cluster that spans GCE and AWS.
- The nodes on each cloud can reach each other on public addresses, but the private addresses aren’t reachable from the other cloud.
-
Start each node on GCE with
--localityset to describe its location,--locality-advertise-addrset to advertise its private address to other nodes in on GCE,--advertise-addrset to advertise its public address to nodes on AWS, and--joinset to the public addresses of 3-5 of the initial nodes: -
Start each node on AWS with
--localityset to describe its location,--locality-advertise-addrset to advertise its private address to other nodes on AWS,--advertise-addrset to advertise its public address to nodes on GCE, and--joinset to the public addresses of 3-5 of the initial nodes: -
Run the command against any node to perform a one-time cluster initialization:
Add a node to a cluster
To add a node to an existing cluster, run thecockroach start command, setting the --join flag to the same addresses you used when starting the cluster:
- Secure
- Insecure
Create a table with node locality information
Start a three-node cluster with locality information specified in thecockroach start commands:
crdb_internal.locality_value('zone') as the DEFAULT value to use for the zone column of new rows. Other available locality keys for the running three-node cluster include region and cloud.
zone column has the zone of the node on which the row was created.
In a separate terminal window, open a SQL shell to a different node on the cluster:
Start a cluster with separate RPC and SQL networks
Separating the network addresses used for intra-cluster RPC traffic and application SQL connections can provide an additional level of protection against security issues as a form of defense in depth. This separation is accomplished with a combination of the--sql-addr flag and firewall rules or other network-level access control (which must be maintained outside of CockroachDB).
For example, suppose you want to use port 26257 for SQL connections and 26258 for intra-cluster traffic. Set up firewall rules so that the CockroachDB nodes can reach each other on port 26258, but other machines cannot. Start the CockroachDB processes as follows:
26258 (the value for listen-addr, not sql-addr) in the --join flag. Also, if your environment requires the use of the --advertise-addr flag, you should probably also use the --advertise-sql-addr flag when using a separate SQL address.
Clusters using this configuration with client certificate authentication may also wish to use .

