Filesystem concepts - journaling, allocation, and durability

A filesystem is the layer between the block device and the application. The kernel exposes the block device as a sequence of 512-byte sectors; the filesystem organises those sectors into files, directories, inodes, and free space.

What a filesystem does

A Linux filesystem has three responsibilities:

1. Allocate space for new files and free space when files are deleted. The allocation strategy affects fragmentation and performance.
2. Track metadata - file names, inodes, permissions, timestamps. The metadata is the data structure the filesystem must maintain consistently.
3. Recover from crashes - power loss, kernel panic, OOM kill. The journal is the mechanism.

The journal

There are three journaling modes:

The major filesystems

$ df -Th

Filesystem     Type  Size  Used Avail Use% Mounted on
/dev/sda1      ext4  100G   30G   70G  30% /
/dev/sda2      ext4  500G  120G  380G  24% /var
/dev/nvme0n1p1 ext4  1.0T  200G  800G  20% /opt
/dev/vg0/data  xfs   500G  100G  400G  20% /data

ext4

ext4 is the default filesystem for most Linux distributions. It is mature, well-understood, and supported by every recovery tool. Key features:

• Extent-based allocation (instead of block-based)
• Journal with ordered mode by default
• Online defragmentation (rarely needed)
• Online resize, grow only; shrink is possible but the filesystem must be unmounted
• Stable, well-tested

XFS

XFS is the default for RHEL-family enterprise distributions. It is designed for large filesystems (up to 8 EiB) and high throughput:

• Extent-based allocation
• B+tree for fast directory lookup
• Online defragmentation and online grow
• Allocates in groups for parallel I/O
• Cannot shrink at all - not online, not offline

btrfs

btrfs is a modern copy-on-write filesystem with advanced features:

• Snapshots (cheap, instant)
• Subvolumes
• Send/receive for incremental backup
• Built-in RAID
• Online defragmentation and scrub
• Compressed volumes
• Deduplication (off by default; expensive)

btrfs is mature but has had production issues. Use for specific workloads (snapshots, subvolumes) where the features matter, not as a default.

Growing and shrinking

Growing a filesystem is routine. Shrinking one is not, and the difference between the two directions is where filesystems get destroyed.

Filesystem maintenance

$ xfs_info /

meta-data=/dev/sda1              isize=512    agcount=4, agsize=65536 blks
data     =/dev/sda1              bsize=4096   blocks=26214400, imaxpct=25
=/dev/sda1              sectsz=512   sunit=0      blks, rw
naming   =version 2              bsize=4096   ascii-ci=0
log      =internal               bsize=4096   blocks=51200, version=2
=/dev/sda1              sectsz=512   sunit=0      blks, lazy-count=1
realtime =none                   extsz=4096   blocks=0, rtextents=0

$ tune2fs -l /dev/sda1 | head -10

tune2fs 1.47.0 (5-Feb-2023)
Filesystem volume name:   /boot
Last mounted on:          /
Filesystem UUID:          1a2b-3c4d-5678-9abc-def012345678
Filesystem magic number:  0xEF53
Filesystem revision #:    1 (dynamic)
Filesystem features:      has_journal ext_attr resize_inode dir_index filetype needs_recovery extent 64bit flex_bg sparse_super large_file huge_file dir_nlink extra_isize metadata_csum
Default mount options:    user_xattr acl
Filesystem state:         clean

Knowledge check