On 08/01/2013 01:16 PM, Andrey Ilinykh wrote:

TTL is effectively DELETE; you need to run a repair once every gc_grace_seconds. If you don't, data might un-delete itself. 

How is it possible? Every replica has TTL, so it when it expires every replica has tombstone. I don't see how you can get data with no tombstone. What do I miss?

The only way I can think of is this scenario:

   - value "A" for some key is written with ttl=30days, to all replicas   (i.e a long ttl or no ttl at all)
   - value "B" for the same key is written with ttl=1day, but doesn't reach all replicas
   - one day passes and the ttl=1day values turn into deletes
   - gc_grace passes and the tombstones are purged

at this point, the replica that didn't get the ttl=1day value will think the older value "A" is live.

I'm no expert on this so I may be mistaken, but in any case it's a corner case as overwriting columns with shorter ttls would be unusual.

- Erik -