ext4 deep dive - features, tuning, and operations · Linux

ext4 is the default filesystem for most Debian-family distributions and a reliable choice for production. Understanding its features, tuning, and operations makes the difference between a healthy filesystem and a chronic performance problem.

Creating an ext4 filesystem

Read-only / Safemkfs.ext4— mkfs.ext4 -L sets a label; -m 0 reserves 0% for root (only safe when the filesystem is dedicated to data, not shared with system); -O enables features. The superblock backup list at the end shows the locations used for crash recovery.

$ mkfs.ext4 -L data -m 0 -O has_journal,extent,huge_file,dir_nlink,extra_isize,metadata_csum /dev/sda1

mke2fs 1.47.0 (5-Feb-2023)
Creating filesystem with 26214400 4k blocks and 6553600 inodes
Filesystem UUID: 1a2b-3c4d-5678-9abc-def012345678
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208, 4096000
Allocating group tables: done
Writing inode tables: done
Creating journal (65536 blocks): done
Writing superblocks and filesystem accounting information: done

Mount options

Configuration changeext4 mount options— noatime disables access-time updates (3-5% throughput win on workloads with many small reads). errors=remount-ro remounts the filesystem read-only on errors - safer than continuing with a damaged filesystem.

$ mount -o noatime,errors=remount-ro /dev/sda1 /data

Tune ext4 for production

Changeable at any time with tune2fs:

-m 0 — no root-reserved space. Only safe for a dedicated data filesystem; leave the default 5% on /, where it is what lets root and syslogd keep working after the filesystem fills. This is not a format-time-only decision:
```
sudo tune2fs -m 1 /dev/sdb1     # online, no unmount, no data movement
tune2fs -l /dev/sdb1 | grep -i 'reserved block count'
```
On a 4 TB data volume the default 5% is 200 GB withheld from an application that will never be root, so this is worth changing — and worth knowing you can change it during a disk-full incident to buy time.

Fixed at format time:

-O has_journal,extent,huge_file,dir_nlink,extra_isize,metadata_csum for production defaults. metadata_csum enables journal and metadata checksums; extent and huge_file are required for modern features.
-i / -N, the inode count. See inode exhaustion.

Not a tuning knob at all:

-E lazy_itable_init and lazy_journal_init are enabled by default, and enabling them is what makes mkfs fast. Per man 8 mke2fs, lazy_itable_init “speeds up file system initialization noticeably, but it requires the kernel to finish initializing the file system in the background when the file system is first mounted.”

Passing =0 therefore does the opposite of “faster mkfs”: it forces the inode table to be written out synchronously now. That is occasionally what you want — it moves the cost off the first mount, which matters if the first thing you do is a benchmark and you do not want the background init distorting it — but it makes mkfs on a multi-terabyte volume take minutes instead of seconds. Leave the default unless you have that specific reason.

Operations

Resizing

Configuration changeresize2fs— resize2fs enlarges or shrinks an ext2/3/4 filesystem, and the order of operations is different for each direction. GROW is online: extend the block device first (lvextend, or grow the partition), then run resize2fs against the mounted filesystem. SHRINK is offline and the order is the exact opposite: umount, run e2fsck -f (resize2fs refuses to shrink without a clean forced check), run resize2fs DEVICE NEWSIZE, and only then lvreduce to a size equal to or larger than the new filesystem. Shrinking the block device before the filesystem truncates live data and is unrecoverable without a restore.

$ resize2fs /dev/sda1

resize2fs 1.47.0 (5-Feb-2023)
Resizing the filesystem on /dev/sda1 to 524288 (4k) blocks.
The filesystem on /dev/sda1 is now 524288 (4k) blocks long.

Shrinking safely

Growing is forgiving. Shrinking is not. The filesystem records its own size in the superblock and in the block group descriptors. If the block device becomes smaller than the size the filesystem believes it has, every block group past the new end of the device is gone. The filesystem will not mount, e2fsck reports superblock and group descriptor corruption, and the only recovery is a restore from backup.

Take (or verify) a backup. Shrink is the one resize direction with no undo.
Check how much space is actually in use with df -h. The new size must be comfortably larger than the used space.
Unmount the filesystem: umount /data. ext4 cannot shrink while mounted, in any mode.
Run a forced check: e2fsck -f /dev/vg0/data. resize2fs refuses to shrink a filesystem that has not just been checked.
Shrink the filesystem: resize2fs /dev/vg0/data 50G. Wait for it to finish and read the reported new block count.
Only now shrink the volume: lvreduce -L 50G /dev/vg0/data. Never give lvreduce a size smaller than the new filesystem size.
Remount and verify: mount /data, then df -h /data.

Do not shrink the LV before the filesystem

The wrong order is the most common self-inflicted total-loss storage incident on Linux:

lvreduce -L 50G /dev/vg0/data     # WRONG - filesystem is still 200G
resize2fs /dev/vg0/data 50G       # too late, the tail is already gone

lvreduce does not know or care that a filesystem is sitting on the volume. It simply returns the extents to the volume group. The filesystem metadata that lived in those extents is destroyed.

If you would rather not drive the sequence by hand, let LVM do it for you:

Data-loss risklvreduce -r— The -r (--resizefs) flag makes lvreduce call fsadm, which unmounts, checks, and shrinks the filesystem before it touches any extents. This is the safest way to shrink ext4 because the ordering is enforced for you. fsadm refuses to do this on XFS, because XFS cannot be shrunk at all.

# lvreduce -r -L 50G /dev/vg0/data

Do you want to unmount /data ? [Y|n] y
fsck from util-linux 2.39.3
/dev/mapper/vg0-data: 12345/6553600 files (0.1% non-contiguous), 234567/52428800 blocks
resize2fs 1.47.0 (5-Feb-2023)
Resizing the filesystem on /dev/mapper/vg0-data to 13107200 (4k) blocks.
The filesystem on /dev/mapper/vg0-data is now 13107200 (4k) blocks long.
Size of logical volume vg0/data changed from 200.00 GiB to 50.00 GiB.
Logical volume vg0/data successfully resized.

Illustrative output

Online defragmentation

Read-only / Safee4defrag— e4defrag is the online defragmenter for ext4. Most workloads do not need it - ext4's extent-based allocation fragments less than ext3. Use it when you have measured fragmentation causing performance issues.

$ e4defrag /data

e4defrag 1.47.0 (5-Feb-2023)
ext4 file system health check: 95% fragmented
extent-size    size  extents  before  after
/data/bigfile  1.0G      1     1024K  1
/data/other    2.0G    200     ...
...
Fragmented files: 12
Total extents: 12345
Improved extents: 5000
Files defragmented: 12

Filesystem check

Read-only / Safee2fsck -n— e2fsck -n is a read-only filesystem check. Use this on a live filesystem to verify metadata is consistent. -p is automatic repair. Run only on unmounted or read-only-mounted filesystems for full safety.

$ e2fsck -n /dev/sda1

e2fsck 1.47.0 (5-Feb-2023)
/dev/sda1: clean, 12345/6553600 files, 234567/26214400 blocks

Tuning with tune2fs

Read-only / Safetune2fs -l— tune2fs prints filesystem metadata. Check interval 0 disables forced fsck (production: keep at 0 for most hosts - rely on journaling). Maximum mount count -1 disables forced check at boot. Reserved 5% is the default for root, 0 for data.

$ tune2fs -l /dev/sda1 | grep -E 'Block size|Mount count|Check interval|Reserved'

Block size:               4096
Mount count:              47
Maximum mount count:      -1
Check interval:           0 (disabled)
Reserved block count:     1310720 (5.00%)