Strong Consistency commit-to-device durability and drive cache interaction

Direct Answer

Aerospike does not validate the storage device's fsync implementation. When commit-to-device=true, the server issues an fsync() system call and treats the OS return value as the durability signal. If fsync() returns 0, the write is acknowledged; any non-zero return aborts the acknowledgement. There is no built-in statistic, API, or health check in Strong Consistency mode that confirms a write reached non-volatile media versus a volatile drive cache or kernel page cache.

Confirmed Behavior

• commit-to-device=true forces an fsync() on the namespace's storage file/device before replying to the client.
• The fsync() return code is the only durability gate inside Aerospike; the engine does not query SMART, PLP status, or drive cache state.
• Strong Consistency statistics (asinfo -v 'statistics') expose replication latency, quorum counts, and transaction metrics, but nothing about physical media persistence.

Why Hardware Cache Matters

On drives without Power Loss Protection (PLP), a successful fsync() may only mean the data reached the drive's volatile write cache. If power fails before the drive flushes that cache to non-volatile cells, the acknowledged write can be lost. Aerospike assumes the OS and block layer honor fsync() semantics; it cannot detect a drive that lies about completion.

Verification Steps (External to Aerospike)

1. Check write cache state: hdparm -W /dev/nvme0n1 (or sdparm for SATA). Output Write cache = 0 means the volatile cache is disabled; = 1 means it is enabled and data may be at risk without PLP.
2. Confirm PLP capability: Vendor tools (e.g., nvme id-ctrl, smartctl -a) report Power Loss Protection or Volatile Write Cache features. Enterprise drives typically expose a PLP capacitor health indicator.
3. Observe fsync latency: iostat -x 1 or bpftrace -e 'tracepoint:syscalls:sys_enter_fsync { @start[tid] = nsecs; } tracepoint:syscalls:sys_exit_fsync /@start[tid]/ { @lat = hist(nsecs - @start[tid]); delete(@start[tid]); }' shows whether fsync completes in microseconds (cache ack) or milliseconds (media flush).
4. Power-loss test: In a staging environment, write a known pattern, cut power abruptly, restart, and verify the pattern exists. This is the only end-to-end proof.

One Diagnostic Detail Needed

What is the exact drive model (or cloud instance storage type) and its PLP status? The recommendation changes from "enable commit-to-device and monitor" to "disable drive write cache or use PLP-backed storage" if the device lacks PLP.