Analyzing File Layout

Each file system has a unique layout that features the structures that files need to manage the metadata of the file system. The following four sections provide examples of how to look at structures of Ext2/Ext3, JFS, ReiserFS, and XFS file systems. Although the utilities that come with the file systems for looking at the on-disk structures are used mainly by developers to view the different structures of file systems, they can also be used to find and resolve performance issues with each file system.

Ext2/Ext3 Layout

The following example shows some of the structures of an Ext2 file system. In the example, an Ext2 file system is used to format a floppy disk with the mkfs command.

 # mkfs /dev/fd0 mke2fs 1.32 (09-Nov-2002) Filesystem label= OS type: Linux Block size=1024 (log=0) Fragment size=1024 (log=0) 184 inodes, 1440 blocks 72 blocks (5.00%) reserved for the super user First data block=1 1 block group 8192 blocks per group, 8192 fragments per group 184 inodes per group Writing inode tables: 0/1 done Writing superblocks and filesystem accounting information: done 

The debugfs command produces output that is useful for analyzing a file system's on-disk structures. For example, the show_super_stats option displays the super block and disk group structures.

 # debugfs /dev/fd0 debugfs 1.32 (09-Nov-2002) debugfs: show_super_stats debugfs 1.32 (09-Nov-2002) debugfs:  Filesystem volume name:   <none> Last mounted on:  <not available> Filesystem UUID:  cb45e547-1618-4b70-bd91-22e651e19583 Filesystem magic number:  0xEF53 Filesystem revision #:    1 (dynamic) Filesystem features:      filetype sparse_super Default mount options:    (none) Filesystem state:         clean Errors behavior:          Continue Filesystem OS type:       Linux Inode count:              184 Block count:              1440 Reserved block count:      72 Free blocks:              1399 Free inodes:              173 First block:              1 Block size:               1024 Fragment size:            1024 Blocks per group:         8192 Fragments per group:      8192 Inodes per group:         184 Inode blocks per group:    23 Filesystem created:       Mon Jun  9 19:06:00 2003 Last mount time:          n/a Last write time:          Mon Jun  9 19:06:01 2003 Mount count:              0 Maximum mount count:       29 Last checked:             Mon Jun  9 19:06:00 2003 Check interval:           15552000 (6 months) Next check after:         Sat Dec  6 19:06:00 2003 Reserved blocks uid:      0 (user root) Reserved blocks gid:      0 (group root) First inode:              11 Inode size:               128 Directories:              2  Group  0: block bitmap at 3, inode bitmap at 4,            inode table at 5            1399 free blocks, 173 free inodes,            2 used directories debugfs: quit 

The block group information is displayed after the super block. The block group information shows the block numbers where various structures are located, such as block bitmap, inode bitmap, inode table, and free blocks. For example, the inode bitmap for block group 0 is at block 4. Use the dump2efs command to display further information about the block group.

 # dumpe2fs /dev/fd0 dumpe2fs 1.32 (09-Nov-2002) Filesystem volume name:   <none> Last mounted on: <not available> Filesystem UUID: cb45e547-1618-4b70-bd91-22e651e19583 Filesystem magic number:  0xEF53 Filesystem revision #:    1 (dynamic) Filesystem features:      filetype sparse_super Default mount options:    (none) Filesystem state:         clean Errors behavior:          Continue Filesystem OS type:       Linux Inode count:              184 Block count:              1440 Reserved block count:     72 Free blocks:              1399 Free inodes:              173 First block:              1 Block size:               1024 Fragment size:            1024 Blocks per group:         8192 Fragments per group:      8192 Inodes per group:         184 Inode blocks per group:   23 Filesystem created:       Mon Jun  9 19:06:00 2003 Last mount time:          n/a Last write time:          Mon Jun  9 19:06:01 2003 Mount count:              0 Maximum mount count:      29 Last checked:             Mon Jun  9 19:06:00 2003 Check interval:           15552000 (6 months) Next check after:         Sat Dec  6 19:06:00 2003 Reserved blocks uid:      0 (user root) Reserved blocks gid:      0 (group root) First inode:              11 Inode size:               128 Group 0: (Blocks 1-1439)   Primary superblock at 1, Group descriptors at 2-2   Block bitmap at 3 (+2), Inode bitmap at 4 (+3)   Inode table at 5-27 (+4)   1399 free blocks, 173 free inodes, 2 directories   Free blocks: 41-1439   Free inodes: 12-184 

One of the limits of the Ext2 file system is the static allocation of inodes. There are 184 inodes available on this Ext2 file system, which means that it can contain a total of only 184 files or directories. In the example, the file system runs out of inodes before it runs out of free space.

First, the mount point of /mnt/floppy mounts the floppy device /dev/fd0. Next, the create.sh script is run. create.sh creates one directory called "a" and then up to 300 files in that directory. When the script runs, it shows that the limit of the number of inodes is hit before the available free space is exhausted.

 # mount /dev/fd0 /mnt/floppy 

The create.sh script creates 300 files and returns an error after it has run out of inodes.

 #!/bin/sh for count in 'seq 1 1'; do   echo Count: $count   mkdir a   for i in 'seq 1 300';   do     echo  abcdefghijklmnopqrstuvwxyz > a/$i   done   done 

Use the df k command to determine the amount of free space available for each mounted file system. This command produces output similar to the following:

 # df k Filesystem   1K-blocks     Used Available Use% Mounted on /dev/hda2      3265260  1581308   1518084  52% / /dev/hda1       101089     9324     86546  10% /boot none            192292        0    192292   0% /dev/shm /dev/fd0          1412       14      1326   2% /mnt/floppy /dev/hdb1      3999504   659260   3340244  17% /jfs 

The output shows that the /dev/fd0 device, which is the floppy, has 2% of its space used. Output from the ls all command shows that there is now one file called create.sh and the file system's lost+found directory.

 # ls -all lost+found create.sh 

The df command with the -i option displays the number of free inodes, which is 172 in our example.

 # df -i Filesystem    Inodes   IUsed   IFree IUse% Mounted on /dev/hda2     415168   96813  318355   24% / /dev/hda1      26104      41   26063    1% /boot none           48073       1   48072    1% /dev/shm /dev/fd0         184      12     172    7% /mnt/floppy /dev/hdb1    6726720   44242 6682478    1% /jfs 

If create.sh is run on the floppy, the Ext2 file system runs out of inodes before it runs out of file system space. Note that although the following error message makes it look like the file system is out of space, it is really out of free inodes to create files or directories.

 # ./create.sh Count: 1 ./create.sh: line 9: a/172: No space left on device ./create.sh: line 9: a/173: No space left on device ./create.sh: line 9: a/174: No space left on device ./create.sh: line 9: a/175: No space left on device ... 

The df k command shows that the space used on the file system is only 15%.

 # df k Filesystem  1K-blocks    Used Available Use% Mounted on /dev/hda2     3265260 1581308   1518084  52% / /dev/hda1      101089    9324     86546  10% /boot none           192292       0    192292   0% /dev/shm /dev/fd0         1412     188      1152  15% /mnt/floppy /dev/hdb1     3999504  659280   3340224  17% /jfs 

The ls -R command shows that 171 files and one directory called "a" were created that used up the 172 free inodes.

 # ls -R .: a lost+found create.sh ./a: 1 10 100 101 102 103 104 105 106 107 108 109 11 110 111 112 113 114 115 116 117 118 119 12 120 121 122 123 124 125 126 127 128 129 13 130 131 132 133 134 135 136 137 138 139 14 140 141 142 143 144 145 146 147 148 149 15 150 151 152 153 154 155 156 157 158 159 16 160 161 162 163 164 165 166 167 168 169 17 170 171 18 19 2 20 21 22 23 24 25 26 27 28 29 3 30 31 32 33 34 35 36 37 38 39 4 40 41 42 43 44 45 46 47 48 49 5 50 51 52 53 54 55 56 57 58 59 6 60 61 62 63 64 65 66 67 68 69 7 70 71 72 73 74 75 76 77 78 79 8 80 81 82 83 84 85 86 87 88 89 9 90 91 92 93 94 95 96 97 98 99 ./lost+found: 

The df command with the -i option displays the number of free inodes, as shown here; we see the floppy device /dev/fd0 currently has the value 0.

 # df -i Filesystem   Inodes   IUsed   IFree IUse% Mounted on /dev/hda2    415168   96814  318354   24% / /dev/hda1     26104      41   26063    1% /boot none          48073       1   48072    1% /dev/shm /dev/fd0        184     184       0  100% /mnt/floppy /dev/hdb1   6726720   44242 6682478    1% /jfs 

These examples show that when using the Ext2/Ext3 file systems, there is a need to create enough inodes when using mkfs to create the file system because there is no way to increase the number of inodes after the file system has been formatted.

The other journaling file systems provide the dynamic inode creation feature that allows the file system to create inodes as needed.

The next step is to unmount the floppy device and format it again by using mkfs; then remount the floppy device.

 # umount /mnt/floppy # mkfs /dev/fd0 # mount /dev/fd0 /mnt/floppy 

Next, copy a file to the floppy device and then use the debugfs utility to view file system information about the file. In the following example, the file is named fstab. The inode for fstab is 12. In the example, the ls l option in debugfs gathers file system information, and the stat option in debugfs displays the inode for file fstab.

 # cp /etc/fstab /mnt/floppy/fstab # umount /mnt/floppy # debugfs /dev/fd0 debugfs : ls -l 1.32 (09-Nov-2002) debugfs:   2  40755 (2) 0 0  1024  9-Jun-2003 19:43 .   2  40755 (2) 0 0  1024  9-Jun-2003 19:43 ..  11  40700 (2) 0 0 12288  9-Jun-2003 19:06 lost+found  12 100644 (1) 0 0   697  9-Jun-2003 19:43 fstab debugfs:  stat <12> debugfs: Inode: 12   Type: regular    Mode:  0644 Flags: 0x0   Generation: 295695 User:     0   Group:     0   Size: 697 File ACL: 0    Directory ACL: 0 Links: 1   Blockcount: 2 Fragment:  Address: 0    Number: 0    Size: 0 ctime: 0x3ee537a8  Mon Jun  9 19:43:04 2003 atime: 0x3ee537a8  Mon Jun  9 19:43:04 2003 mtime: 0x3ee537a8  Mon Jun  9 19:43:04 2003 BLOCKS: (0):41 TOTAL: 1 

The Fragment information shown in the output is used to determine whether the file is contiguous. Fragmented files do not provide the best performance. However, the fstab file in the example is not fragmented.

The final step is to umount the floppy device.

 # umount /mnt/floppy 

Journaled File System (JFS) File Layout

The jfs_debugfs utility provides an examination of the structures of the Journaled File System (JFS) file system. The jfs_debugfs utility takes the device as the only parameter. The jfs_debugfs man page contains information on how to display the data structures for JFS. This section shows how to collect information on some of the key structures that are part of the file system.

In the examples, the /dev/hda1 device contains the JFS file system for which structures will be displayed.

 # jfs_debugfs /dev/hda1 

The su option of jfs_debugfs can be used to display the super block. The following example is sample output from a system:

 >su [1] s_magic:  'JFS1'      [15] s_ait2.addr1:      0x00 [2] s_version:  1         [16] s_ait2.addr2:      0x00000097 [3] s_size: 0x00000000007fa970  s_ait2.address:    151 [4] s_bsize: 4096         [17] s_logdev:          0x00000000 [5] s_l2bsize: 12         [18] s_logserial:       0x00000000 [6] s_l2bfactor:3         [19] s_logpxd.len:      4352 [7] s_pbsize: 512         [20] s_logpxd.addr1:    0x00 [8] s_l2pbsize: 9         [21] s_logpxd.addr2:    0x000ff581 [9] pad: Not Displayed         s_logpxd.address:  1045889 [10] s_agsize:0x00002000   [22] s_fsckpxd.len:     83 [11] s_flag:  0x10200900  [23] s_fsckpxd.addr1:   0x00 JFS_LINUX                 [24] s_fsckpxd.addr2:   0x000ff52e JFS_COMMIT  JFS_GROUPCOMMIT     s_fsckpxd.address: 1045806 JFS_INLINELOG              [25] s_time.tv_sec:     0x3f002d2d                           [26] s_time.tv_nsec:    0x00000000                           [27] s_fpack:           '        ' [12] s_state: 0x00000000              FM_CLEAN [13] s_compress:        0 [14] s_ait2.len:        4 display_super: [m]odify or e[x]it: x 

The following example uses /jfs as the mount point, mounts the file system, and copies over the fstab file, resulting in a file that is available to view on the JFS file system:

 # mount t jfs /dev/hda1 /jfs # cd /jfs # cp /etc/fstab . 

To look at the inode of a file, its inode number is required. Use the ls command with the -i option to determine the file's inode number.

 # ls -i 2 . 2.. 4 fstab 

In this example, the one file that is in this subdirectory is named fstab, and its inode number is 4.

 #cd .. # umount /jfs # jfs_debug /dev/hda1 

The i option in jfs_debugfs displays the inode information for the fstab file.

 >i 4 Inode 4 at block 155, offset 0x800: [1] di_inostamp:    0x3f002d2d      [19] di_mtime.tv_nsec: 0x00000000 [2] di_fileset:    16              [20] di_otime.tv_sec: 0x3f002f06 [3] di_number:      4               [21] di_otime.tv_nsec: 0x00000000 [4] di_gen:         1               [22] di_acl.flag: 0x00 [5] di_ixpxd.len:    4               [23] di_acl.rsrvd: Not Displayed [6] di_ixpxd.addr1:  0x00            [24] di_acl.size: 0x00000000 [7] di_ixpxd.addr2: 0x0000009b      [25] di_acl.len:        0     di_ixpxd.address:  155          [26] di_acl.addr1: 0x00 [8] di_size:0x00000000000003b4      [27] di_acl.addr2:  0x00000000 [9] di_nblocks: 0x0000000000000001       di_acl.address:    0 [10] di_nlink:      1              [28] di_ea.flag:  0x00 [11] di_uid:        0              [29] di_ea.rsrvd:  Not Displayed [12] di_gid:        0              [30] di_ea.size: 0x00000000 [13] di_mode:       0x000681a4      [31] di_ea.len:         0             0100644      -rw-      [32] di_ea.addr1:  0x00 [14] di_atime.tv_sec: 0x3f002f06    [33] di_ea.addr2:  0x00000000 [15] di_atime.tv_nsec: 0x00000000        di_ea.address:     0 [16] di_ctime.tv_sec:  0x3f002f06   [34] di_next_index:     0 [17] di_ctime.tv_nsec: 0x00000000   [35] di_acltype: 0x00000000 [18] di_mtime.tv_sec:   0x3f002f06 change_inode: [m]odify or e[x]it > x 

ReiserFS File Layout

This section starts by looking at the layout of the ReiserFS file system. The utility to view the structures of the ReiserFS file system is debugreiserfs. It takes the device as one of the parameters; additional parameters can be used to display the file system structures. The following example formats the file system and copies one file named fstab to the ReiserFS file system. The d option of debugreiserfs prints formatted nodes of the internal tree of the file system.

 # mkreiserfs /dev/hdb1 

The following example uses /reiserfs as the mount point, mounts the file system, and copies over the fstab file, resulting in a file that is available to view on the ReiserFS file system.

[View full width]
 # mount t reiserfs /dev/hdb1 /reiserfs # cd /reiserfs # cp /etc/fstab . # ls all total 6 drwxr-xr-x     4 root     root   104 Dec 19 06:26 . drwxr-xr-x    30 root     root  1824 Dec 20 12:10 .. -rw-r--r--     1 root     root   948 Dec 19 06:26 fstab # cd .. # umount /reiserfs # debugreiserfs d /dev/hdb1 debugreiserfs 3.6.4 Filesystem state: consistent Reiserfs super block in block 16 on 0x341 of format 3.6 with standard journal Count of blocks on the device: 1004054 Number of bitmaps: 31 Blocksize: 4096 Free blocks (count of blocks - used [journal, bitmaps, data, reserved] blocks): 995812 Root block: 8211 Filesystem is clean Tree height: 2 Hash function used to sort names: "r5" Objectid map size 2, max 972 Journal parameters:         Device [0x0]         Magic [0x431098f2]         Size 8193 blocks (including 1 for journal header) (first block 18)         Max transaction length 1024 blocks         Max batch size 900 blocks         Max commit age 30 Blocks reserved by journal: 0 Fs state field: 0x0 sb_version: 2 inode generation number: 0 UUID: 1f0d2fd3-6fd6-412c-982d-4a16f0a37de9 LABEL: Set flags in SB:         ATTRIBUTES CLEAN =================================================================== LEAF NODE (8211) contains level=1, nr_items=6, free_space=2692 rdkey (real items 6) - |###|type|ilen|f/sp| loc|fmt|fsck|                   key                      | |   |    |    |e/cn|    |   |need|                                            | - |  0|1 2 0x0 SD (0), len 44, location 4052 entry count 0, fsck need 0, format new| (NEW SD), mode drwxr-xr-x, size 104, nlink 4, mtime 12/19/2003 06:26:51 blocks 1, uid 0 |  1|1 2 0x1 DIR (3), len 104, location 3948 entry count 4, fsck need 0, format old| ###: Name           length  Object key      Hash   Gen number   0: ".              "(  1)  [1 2]          0       1, loc 96   1: "..             "(  2)  [0 1]          0       2, loc 88   2: "fstab          "(  5)  [2 4]     293528832    0, loc 80   3: ".reiserfs_priv  "( 14)   [2 3]    1105744768    0, loc 64 |  2|2 3 0x0 SD (0), len 44, location 3904 entry count 65535, fsck need 0, format new| (NEW SD), mode drwx, size 48, nlink 2, mtime 12/19/2003 06:26:18 blocks 1, uid 0 |  3|2 3 0x1 DIR (3), len 48, location 3856 entry count 2, fsck need 0, format old| ###: Name    length    Object key      Hash     Gen number   0: ".      "(  1)          [2 3]      0       1, loc 40   1: "..     "(  2)          [1 2]      0       2, loc 32 |  4|2 4 0x0 SD (0), len 44, location 3812 entry count 65535, fsck need 0, format new| (NEW SD), mode -rw-r--r--, size 948, nlink 1, mtime 12/19/2003 06:26:51 blocks 8, uid 0 |  5|2 4 0x1 DRCT (2), len 952, location 2860 entry count 65535, fsck need 0, format new| =================================================================== File system uses 0 internal + 1 leaves + 0 unformatted nodes = 1 blocks 

First the super block information is displayed for the file system, and then the leaf node 8211 is displayed. The highlighted information for the file fstab shows some common inode information for the file. The permissions are rw-r-r--, the size is 948, and the mtime is 12/19/2003 06:26:51.

The debugreiserfs man page contains information about how to display the key structures for ReiserFS. To display the debugreiserfs man page, type the following command:

 # man debugreiserfs 

XFS File Layout

The xfs_db enables the examination of XFS file system structures. The xfs_db utility takes the device as the parameter. The xfs_db man page contains information about how to display the data structures for XFS.

This section shows how to display an inode on an XFS system.

The XFS file system is on the device /dev/hda5.

 # mount -t xfs /dev/hda5 /xfs # cd /xfs 

Copy the fstab file located in the /etc directory onto the XFS file system.

 # cp /etc/fstab . # ls all total 12 drwxr-xr-x     2 root     root             18 Dec  8 10:57 . drwxr-xr-x    24 root     root           4096 Dec  8 10:54 .. -rw-r--r--     1 root     root            948 Dec  8 10:57 fstab 

To look at a file's inode, its inode number is required. Use the ls command with the -i option to determine this number. In the following example, the inode number for the fstab file is 131.

 # ls i     128 .        2 ..      131 fstab # cd .. # umount /xfs 

The xfs_db option to look at an inode is the inode command. The inode command uses the inode number as the parameter. To print the file system information about the inode, use the p command.

 # xfs_db /dev/hda5 xfs_db> inode 131 xfs_db> p core.magic = 0x494e core.mode = 0100644 core.version = 1 core.format = 2 (extents) core.nlinkv1 = 1 core.uid = 0 core.gid = 0 core.flushiter = 2 core.atime.sec = Mon Dec  8 10:57:53 2003 core.atime.nsec = 123719000 core.mtime.sec = Mon Dec  8 10:57:53 2003 core.mtime.nsec = 123943000 core.ctime.sec = Mon Dec  8 10:57:53 2003 core.ctime.nsec = 123943000 core.size = 948 core.nblocks = 1 core.extsize = 0 core.nextents = 1 core.naextents = 0 core.forkoff = 0 core.aformat = 2 (extents) core.dmevmask = 0 core.dmstate = 0 core.newrtbm = 0 core.prealloc = 0 core.realtime = 0 core.gen = 0 next_unlinked = null u.bmx[0] = [startoff,startblock,blockcount,extentflag] 0:[0,12,1,0] xfs_db> q