OptionalappendPer-append capacity or retryable store-fault deadline. Defaults to 30 seconds.
OptionalbackpressureBehavior when maxBytes is exhausted. wait pauses the append until ACK
trimming frees space or its deadline expires; error fails it at once
with QwpReplayStoreFullError. Defaults to wait, as a connect string does.
This decides journal exhaustion only. A transient retryable fault parks until appendDeadlineMs under either policy, so the only errors an append surfaces are exhaustion and that deadline.
OptionalcatchMinimum time an orphan slot's symbol catch-up cap gap must persist before it is quarantined. The gap must also be observed 16 times. Defaults to five minutes; zero uses the observation threshold alone.
OptionalcheckpointPeriodic durability checkpoint cadence. Defaults to 5 seconds.
The slot root. Each sender journals into its own slot below it:
<directory>/<senderId>, with senderId defaulting to default, or
<directory>/<senderId>-<slot> for a pooled sender. This is the layout
sf_dir and sender_id describe in a connect string.
OptionaldrainAdopts sibling replay slots left by terminated producers. Standalone
senders default this to false; pooled clients always recover their own
idle in-range and out-of-range <senderId>-N slots.
OptionaldurabilityLocal persistence barrier. append fsyncs every frame before its append
resolves, periodic checkpoints dirty files in the background, and
memory relies on OS page-cache writeback, which normally survives a
process failure but makes no power-loss promise. Defaults to memory, as
sf_durability does; choose append for a journal that has to survive
power loss.
OptionalmaxMaximum sibling slots drained concurrently. Defaults to 4.
OptionalmaxTarget maximum journal size including fixed segment reservations and symbol metadata. Defaults to 10 GiB. The current symbol dictionary may exceed this target so it cannot consume the journal's live frame budget before a drained close retires that dictionary generation.
A commit whose deferred prefix already fills the journal also overshoots it, because QuestDB withholds that prefix's ACK until the commit arrives, so no amount of trimming could make room first. For fixed segment size S, reservations are capped at S * (floor(maxBytes / S) + max(floor(maxBytes / S), ceil(min(maxBytes, 32 MiB) / S))), saturated at Number.MAX_SAFE_INTEGER. The closing batch must fit the applicable standalone rounded segment allowance on its own. The retained dictionary is additive; beyond the cap appends backpressure. When S divides maxBytes exactly, this segment cap is 2 * maxBytes.
Must reserve at least one whole segment -- maxSegmentBytes + 32 for the
24-byte SFA header and the 8-byte frame header. A smaller target throws a
RangeError, because no append could ever reserve its first segment and
no acknowledgement could ever free room for one.
OptionalmaxMaximum QWP frame payload and target segment data size. Each fixed segment
reserves this value plus one record header and its 24-byte SFA header,
so a maximum-sized frame still fits. Defaults to 4 MiB. maxBytes must
leave room for one whole segment of this size plus those 32 bytes of
headers.
OptionalonReceives isolated scanner, drainer, durable-ACK capability-gap, and primary-unavailable lifecycle notifications.
OptionalonReports journal bytes abandoned during recovery. Defaults to logging at error level; recovery still succeeds, so this must never be silent.
OptionalonReceives a data-loss notification when corrupt foreground replay bytes are
preserved under an .unreplayable-N pathname and a fresh slot is opened.
OptionalorphanPeriodic rescan cadence; zero disables the timer. Pooled ownership
changes can still trigger a scan. Defaults to 30 seconds. Capped at
2,147,483,647ms (the host timer ceiling); a larger value throws a
RangeError.
Node store-and-forward: a crash-safe journal that keeps each frame on disk until the server acknowledges it, and the recovery of journals that terminated producers left behind.