Journaling in Linux Filesystem and what is the use

Journaling is a feature of certain Linux filesystems (such as ext3, ext4, XFS, JFS, and Btrfs) that helps maintain the integrity of the filesystem by keeping a record (journal) of changes before they are actually written to the main file system.

How It Works

1. When a change is made (e.g., creating, deleting, or modifying a file), the change is first recorded in a special area of the disk called the journal.
2. Once the journal entry is successfully written, the system proceeds to apply the actual changes to the filesystem.
3. After the changes are completely written, the corresponding journal entry is marked as completed.
4. In case of a system crash or power failure, the system can use the journal to recover and apply incomplete changes, preventing file corruption.

Use of Journaling

1. Prevents Data Corruption – Helps protect against file system corruption caused by crashes or power failures.
2. Faster Recovery – Instead of checking the entire disk after a crash, only the journal needs to be checked, speeding up system recovery.
3. Enhanced Reliability – Ensures critical file system operations are not lost in case of unexpected failures.
4. Reduces Filesystem Check Time (fsck) – Since the journal keeps track of recent changes, the need for running extensive filesystem checks (fsck) is minimized.

Types of Journaling Modes

1. Journal Mode – Logs both metadata and actual data before committing changes. Provides the highest level of protection but is slower.
2. Ordered Mode (Default in ext3/ext4) – Logs metadata but ensures data is written before metadata updates. Good balance of performance and safety.
3. Writeback Mode – Logs only metadata, but data writes can be unordered, leading to potential data loss in crashes.

How to recover with journal with an example on RHEL 8

Recovering a Linux Filesystem Using Journaling in RHEL 8

If your system crashes or a power failure occurs, you can use the journal to recover your filesystem. On RHEL 8, most filesystems use journaling (e.g., ext4, XFS). Below is an example of how to recover using the journal.

---

Example: Recovering ext4 Filesystem with Journal

Let's assume your system has an ext4 partition at /dev/sdb1 that was affected by a crash.

Step 1: Check the Journal for Issues

Boot into rescue mode or use a Live CD/USB if your system cannot boot normally.

Run the following command to check the journal:

sudo e2fsck -fp /dev/sdb1

• -f → Force a check even if the filesystem is marked as clean.
• -p → Automatically fix simple problems.

---

Step 2: Recover the Filesystem

If there are errors, use the following command to attempt recovery:

sudo e2fsck -y /dev/sdb1

• -y → Automatically answer "yes" to all prompts.

This will use the journal to recover any incomplete transactions.

---

Step 3: Reboot the System

Once the recovery is complete, reboot your system:

sudo reboot

---

Example: Recovering XFS Filesystem with Journal

If your filesystem is XFS, you need to use xfs_repair instead.

Step 1: Unmount the Filesystem

You must unmount the filesystem before running the repair tool:

sudo umount /dev/sdb1

Step 2: Run XFS Repair

Run the XFS repair tool:

sudo xfs_repair /dev/sdb1

If the system cannot repair due to log corruption, clear the log and rerun:

sudo xfs_repair -L /dev/sdb1

⚠ Warning: The -L option clears the journal log, which may result in some data loss.

---

Step 3: Remount and Verify

After repair, remount the filesystem:

sudo mount /dev/sdb1 /mnt

Check if the files are intact.

---

Conclusion

• ext4 Filesystem → Use e2fsck to recover from the journal.
• XFS Filesystem → Use xfs_repair (but -L may be needed for log corruption).
• Reboot after recovery to ensure the filesystem is stable.

Would you like help with automating recovery on boot? 🚀