Top

A Linux User Reference

Search tips
  • search ignores words that are less than 4 characters in length
  • searches are case insensitve
  • if a search does not return anything try it in Boolean mode then Query expansion mode by checking the appropriate radio button e.g. searching for 'cron' in just the Administration category returns nothing - presumably because the 50% threshold is reached. Boolean mode ignores this threshold so a search for 'cron' returns several hits
  • in Boolean mode preceding a word with a '+' means the result must include that word, a '-' means it must not
  • in Boolean mode '+crontab -anacron' means match articles about crontab that DO NOT mention anacron
  • to match a phrase e.g. 'manage system' check the Boolean mode radio button and enclose the phrase in quotes "some phrase ..."
  • in Query expansion mode the search context is expanded beyond the keywords you entered - relevancy of hits may well be degraded

FILESYSTEMS

Maintenance

  • Report filesystem disk space usage
    /bin/df

    A shortage of free disk space or inodes will prevent a read/write filesystem from being written to.

    Reports mounted filesystem disk space usage

    df [options] [fs1] [fs2] ...
    
    Common options:
     -a           all filesystems
     -h           human readable
     -i           inodes
     -T           fstype
    

    Display filesystem space usage

    $ df -a -h -i -T
    Filesystem     Type            Inodes IUsed IFree IUse% Mounted on
    /dev/sda5      ext4              1.1M  186K  847K   18% /
    proc           proc                 0     0     0     - /proc
    sysfs          sysfs                0     0     0     - /sys
    none           fusectl              0     0     0     - /sys/fs/fuse/connections
    none           debugfs              0     0     0     - /sys/kernel/debug
    none           securityfs           0     0     0     - /sys/kernel/security
    
    $ df / /home
    Filesystem     1K-blocks     Used Available Use% Mounted on
    /dev/sda5       16809924  6013444   9942720  38% /
    /dev/sda9      288370016 28917084 244804512  11% /home
    

    Report only ext4 filesystem disk space usage

    $ df -t ext4
    Filesystem     1K-blocks     Used Available Use% Mounted on
    /dev/sda5       16809924  6013444   9942720  38% /
    /dev/sda8        1921036    35844   1787608   2% /tmp
    /dev/sda9      288370016 28917084 244804512  11% /home
    /dev/sda6        6054012  2392680   3353836  42% /var
    
  • Estimate file space usage
    /usr/bin/du

    Estimates file space usage

    du [options] [directories]
    
    Common options:
     -a           all
     -c           produce a grand total
     -h           reports sizes in G(gigabytes) M(megabytes) K(kilobytes)
     -S           do not include sub-dir sizes
     -s           a single summary
    

    Identify the five largest files in /home

    $ du -a -S /home | sort -nr | sed '1d' | head -5
    10662996    /home/mark/VirtualBox VMs/Kali
    10662968    /home/mark/VirtualBox VMs/Kali/Kali.vdi
    6203472 /home/mark/Downloads/WTE-AppSecUS-2012-training.vdi
    2518492 /home/mark/Downloads/WTE-AppSecUS-2012-training.vdi.rar
    2466740 /home/mark/Downloads/kali-linux-1.0.5-amd64.iso
    
  • Tune filesystem parameters
    /sbin/tune2fs
    tune2fs [options] device
    
    Common options:
     -l                   List contents of filesystem superblock
     -L <label>           Change volume label
     -r <int>             Set in blocks
     -m <int>             Set as a % - default is 5=5%
     -C <int>             Change mount count, 0=off
     -c <int>             Change max mount count, number of mounts between checks
     -i <int[d|m|w]>      Change check interval, interval between checks, default d(days)
     -j                   Add a journal for an ext2 filesystem
    

    The above were common for ext2 and ext3 - check man pages for ext4 support and all options.

    Display /dev/sda10's superblock - ext3

    # tune2fs -l /dev/sda10
    tune2fs 1.40.8 (13-Mar-2008)
    Filesystem volume name:   ubtmp
    Last mounted on:          <not available>
    .....
    Default mount options:    (none)
    Filesystem state:         clean
    Errors behavior:          Continue                   (Change with 'tune2fs -e [continue|remount-ro|panic]')
    Filesystem OS type:       Linux
    Inode count:              61440
    .....
    Filesystem created:       Mon Sep  8 14:23:02 2008
    Last mount time:          Fri May  8 10:54:36 2009
    Last write time:          Fri May  8 10:54:36 2009
    Mount count:              15                         (Change with 'tune2fs -C <mount-count>')
    Maximum mount count:      27                         (Change with 'tune2fs -c <max-mount-count>')
    Last checked:             Wed Apr 29 11:04:26 2009
    Check interval:           15552000 (6 months)        (Change with 'tune2fs -i <int> | <intw> | <intm>')
                                                                                 ( days | weeks  | months )
    Next check after:         Mon Oct 26 10:04:26 2009
    .....
    

    If Mount count: > Maximum mount count: 'fsck' will run on next boot.

    Maximum mount count: increases or decreases the interval between checks based on the number of mounts. If 0 or -1 Mount count is ignored by the kernel and 'e2fsck'

    Filesystems will be fsck'd every Check interval or Maximum mount count, whichever comes first.

  • Check and repair supported filesystems
    /sbin/fsck
    • A front-end for a number of more narrow fsck.* tools: e.g. fsck.ext2, fsck.ext3, fsck.reiser.
    • Checks and repairs supported filesystems.
    • Defaults to checking filesystems listed in /etc/fstab serially - equivalent to '-As'.
    • Options not understood by fsck are passed to the fs specific checker (e.g. e2fsck, fsck.ext2).
    • Options and arguments which follow the '--' are treated as file system-specific options.
    fsck [options] [-t fstype] 
         [filesystem [...]] [--] 
         [fs-specific-options]
    
    Options:
     -s                Serialise fsck operations
     -A                Walk through the /etc/fstab file and try to check all file
                       systems in one run
     -C [fd]           Display completion/progress bars for filesystem checkers 
                       (only for ext2 and ext3)
     -M                Do not check mounted filesystems and return an exit code of
                       0 for mounted filesystems
     -N                Don't execute, just show what would be done
     -P                If -A flag set, check the root filesystem in parallel with
                       the other filesystems
     -R                If -A flag set, skip the root file system (may be already 
                       mounted rw)
     -T                Don't show the title on startup.
     -V                Produce verbose output, including all file system-specific
                       commands that are executed
    
    Generally supported FS specific options:
     -a                Try to fix everything it can automatically.
     -n                For some filesystem-specific checkers, avoid attempting to
                       repair any problems, report instead e.g.
                       fsck.reiserfs will not report corruption if given this option
                       fsck.minix does not support the -n option at all
     -r                Interactively repair the filesystem (ask for confirmations)
     -y                For some filesystem-specific checkers, always attempt to fix
    
    Common fs-specific-options:
     -b <int>          Use alternative superblock
     -c                Check bad clocks
     -f                Force check
     -p                Auto repair
     -y                Yes to all prompts
    

    Options will have changed over time - always check with the man pages.

    Check an unmounted filesystem by mentioning its raw device

    # fsck /dev/hda8
    

    Check a 'rooted' filesystem but only if the filesystem is already mounted as read-only

    # fsck /home
    
  • Check a file system
    /sbin/e2fsck

    Back-end to 'fsck'. Usually called via 'fsck'.

    Check a Linux ext2/ext3/ext4 file system

    e2fsck [-pacnyrdfkvtDFV] 
           [-b superblock] [-B blocksize] 
           [-l|-L bad_blocks_file]
           [-C fd] [-j external-journal]
           [-E extended_options] device
    
    Some options:
     -a                 Same thing as the -p option, suggested that people use -p
     -b superblock      Use an alternative superblock specified by superblock.  Backup
                        superblocks can be found at
                        with 1k blocksizes at block 8193
                        with 2k blocksizes at block 16384
                        with 4k blocksizes at block 32768.
                        additional backup superblocks can be determined with 'mke2fs -n'
     -B blocksize       Forces e2fsck to try locating the superblock at a particular blocksize
     -c                 Use 'badblocks' to do a read-only scan to find any bad blocks
     -C fd              Write completion information to the specified file descriptor so can 
                        monitor progress
     -d                 Debugging output
     -E ext_options     Use extended options.  valid ones are
                        ea_ver       (extended_attribute_version)
                        fragcheck    During pass 1, print report on discontiguous blocks in
                                     the filesystem
     -f                 Force checking even if the file system seems clean.
     -j ext-journal     Pathname where the external-journal for this filesystem can be found.
     -k                 Used with '-c', preserve bad blocks in badblocks list.  New bad 
                        blocks are added to list
     -n                 Open the fs read-only and assume an answer of ‘no’ to all questions.
     -p                 Automatically repair ("preen") the fs
     -y                 Assume an answer of 'yes' to all questions
    
    EXIT CODES:
     0   - No errors
     1   - File system errors corrected
     2   - File system errors corrected, system should be rebooted
     4   - File system errors left uncorrected
     8   - Operational error
     16  - Usage or syntax error
     32  - e2fsck canceled by user request
     128 - Shared library error
    
  • Output information about an ext2,3 or 4 filesystem
    /sbin/dumpe2fs

    Prints the super block and blocks group information for the filesystem present on device.

    dumpe2fs [-bfhixV] 
             [-ob superblock]
             [-oB blocksize] device
    
    Options:
     -b                Print the blocks which are reserved as bad in the filesystem.
     -ob superblock    Use the block superblock when examining the filesystem
     -oB blocksize     Use blocks of blocksize bytes when examining the filesystem
     -f                Force a display of a filesystem even if it may have some 
                       filesystem feature flags which dumpe2fs may not understand
     -h                Only display the superblock information
     -i                Display the filesystem data from an image file created by 
                       e2image, using device as the pathname to the image file
     -x                Print detailed group information block numbers in hex format
     -V                Print version number of dumpe2fs and exit.
    

    Display the first 5 lines of /dev/sda10's superblock

    # dumpe2fs -h /dev/sda10 | head -5
    dumpe2fs 1.40.8 (13-Mar-2008)
    Filesystem volume name:   ubtmp
    Last mounted on:          <not available>
    Filesystem UUID:          9c9406c8-f885-4349-b539-9b9a84c1de16
    Filesystem magic number:  0xEF53
    Filesystem revision #:    1 (dynamic)
    
  • Fine tune and examine a filesystem
    /sbin/debugfs

    Interactively fine-tune and examine an ext2 filesystem. Also known as debuge2fs. Supports ext2,3 and 4 filesystems.

    debugfs [options] [device]
    
    Some options:
     -w                    Opened in read-write mode, without option file system is 
                           opened in read-only mode.
     -c                    Opened in catastrophic mode, the inode and group bitmaps
                           are not read initially.  Can be useful for filesystems
                           with significant corruption - opened read-only
     -f cmd_file           Read in commands from cmd_file, execute them and exit
    

    Examine a filesystem - /boot on /dev/sda1

    $ sudo debugfs
    [sudo] password for mark: 
    debugfs 1.42.5 (29-Jul-2012)
    debugfs:  pwd
    pwd: Filesystem not open                        
    debugfs:  open /dev/sda1                      (read only, use -w for read/write)
    debugfs:  pwd
    [pwd]   INODE:      2  PATH: /
    [root]  INODE:      2  PATH: /
    debugfs:  cd grub
    debugfs:  pwd
    [pwd]   INODE:  59641  PATH: /grub
    [root]  INODE:      2  PATH: /
    debugfs:  ls
      2  (12) .    2  (12) ..    11  (20) lost+found    59641  (12) grub   
     12  (36) System.map-3.5.0-17-generic    13  (28) abi-3.5.0-17-generic   
     14  (32) config-3.5.0-17-generic    17  (36) initrd.img-3.5.0-17-generic   
     15  (24) memtest86+.bin    20  (32) memtest86+_multiboot.bin   
     18  (32) vmlinuz-3.5.0-17-generic    19  (32) vmlinuz-3.5.0-37-generic   
     21  (32) config-3.5.0-37-generic    22  (104) System.map-3.5.0-37-generic   
     16  (28) abi-3.5.0-37-generic    24  (552) initrd.img-3.5.0-37-generic   
    (END)
    q
    debugfs:  stat gfxblacklist.txt
    Inode: 59643   Type: regular    Mode:  0644   Flags: 0x0
    Generation: 311005021    Version: 0x00000000
    User:     0   Group:     0   Size: 896
    File ACL: 0    Directory ACL: 0
    Links: 1   Blockcount: 2
    Fragment:  Address: 0    Number: 0    Size: 0
    ctime: 0x52691d6c -- Thu Oct 24 14:15:24 2013
    atime: 0x52691d6c -- Thu Oct 24 14:15:24 2013
    mtime: 0x52691d6c -- Thu Oct 24 14:15:24 2013
    BLOCKS:
    (0):128127
    TOTAL: 1
    
    (END)
    q
    debugfs:  cat gfxblacklist.txt
    # GRUB gfxpayload blacklist.  The format is a sequence of lines of the
    # following form, using lower-case hexadecimal for all ID components:
    #
    .....
    v15add0710.*
    v15add0405.*
    v1002d6738.*
    debugfs:  close -a
    debugfs:  q
    $ 
    

    'debugfs: ?' displays list of available commands.

  • Recover an ext2 deleted file
    - /sbin/debugfs

    Debugfs can be used to restore deleted files as long as the file's blocks have not been reused. You should never rely on this method to recover files - it is not guaranteed - always backup your data.

    When I first did this 'debugfs' only supported restoring ext2 files. It now supports recovery of ext3 This example includes converting an ext3 fs to ext2.

    Unmount the ext3 filesystem - /dev/sda11 mounted on /archives

    # umount /dev/sda11
    

    Convert to ext2 - remove fs 'has_journal' option

    # tune2fs -O ^has_journal /dev/sda11
    tune2fs 1.40.8 (13-Mar-2008)
    

    Check the filesystem

    # e2fsck -y /dev/sda11
    e2fsck 1.40.8 (13-Mar-2008)
    .....
    Pass 5: Checking group summary information
    arch: 43018/946560 files (0.1% non-contiguous), 564168/3773259 blocks
    

    Remove the journal file

    # mount /archives
    # cd /archives
    # rm -f .journal
    

    Creating a testfile which will be deleted

    # echo -e "3 line test file\n3 line test file\n3 line test file\n" > testfile.txt
    

    Delete file after getting its inode - cheating

    # stat testfile.txt
    File: 'testfile.txt'
    Size: 51            Blocks: 8     IO Block: 4096   regular file
    Device: 80bh/2059d  Inode: 13     Links: 1
    .....
    
    # rm testfile.txt
    # stat testfile.txt
    stat: cannot stat testfile.txt: No such file or directory
    

    Recover testfile.txt

    # umount /archives
    
    # debugfs -w /dev/sda11
     debugfs 1.40.8 (13-Mar-2008)
     debugfs:  lsdel
     Inode  Owner  Mode    Size      Blocks   Time deleted
        12      0 100600  12288      3/     3 Fri May  8 15:19:06 2009
        13      0 100644     51      1/     1 Fri May  8 15:20:09 2009
    2 deleted inodes found.
    (END)
    debugfs:  undelete <13> recovered-testfile.txt          (must use <>, save as file-name)
    debugfs:  ^d                                            (quit debugfs)
    

    Check fs even if clean and optimise directories

    # e2fsck -pDf /dev/sda 
    

    Check an rename recovered file

    # mount /archives; cd /archives
    # stat recovered-testfile.txt
    File: 'recovered-testfile.txt'
      Size: 51          Blocks: 8     IO Block: 4096   regular file
    Device: 80bh/2059d  Inode: 13     Links: 1
    .....
    
    # cat recovered-testfile.txt
    3 line test file
    3 line test file
    3 line test file
    
    # mv recovered-testfile.txt testfile.txt
    

    Convert /archives back to an ext3

    # tune2fs -j /dev/sda11
    tune2fs 1.40.8 (13-Mar-2008)
    Creating journal inode: done
    This filesystem will be automatically checked every 23 mounts or
    180 days, whichever comes first.  Use tune2fs -c or -i to override.
    
  • Recover an ext3 deleted file
    /sbin/debugfs, /usr/bin/extundelete
    • neither of these methods are guaranteed to successfully recover one or more deleted files.
    • the blocks used by the deleted files must still exist i.e. none have been reused.

    There are several 3rd. party solutions out there - extundelete is one, it can be installed via distribution repositories:

    The easy way - 'extundelete'

    Mount, populate with sacrificial data then delete a file

      $ sudo mount -t ext3 /dev/sda10 /testtmp
      $ sudo cp /home/mark/linuxref/dbs/*.txt .; ls -al
      $ ls -al
      .....
      -rw-r--r--  1 root root 11452 Nov 25 13:08 dbs-lite.txt
      -rw-r--r--  1 root root 11315 Nov 25 13:08 dbs-proc.txt
      -rw-r--r--  1 root root 20499 Nov 25 13:08 dbs-qry.txt
      -rw-r--r--  1 root root 23449 Nov 25 13:08 dbs-sql.txt
      drwx------  2 root root 16384 Nov 25 13:04 lost+found
    
      $ sudo rm dbs-sql.txt 
    
    

    Recover 'dbs-sql.txt' using 'extundelete'

      $ sudo umount /testtmp
      $ sudo extundelete --restore-file dbs-sql.txt /dev/sda10
      WARNING: Extended attributes are not restored.
      Loading filesystem metadata ... 8 groups loaded.
      Loading journal descriptors ... 16 descriptors loaded.
      Restored inode 15 to file RECOVERED_FILES/dbs-sql.txt
    
    

    Check things out and complete recovery steps

      $ cmp /RECOVERED_FILES/dbs-sql.txt ~/linuxref/dbs/dbs-sql.txt; echo $?
      0
    
      $ sudo e2fsck -pDf /dev/sda10
      ext3fs: 14/64000 files (0.0% non-contiguous), 8455/256000 blocks
    
      $ sudo mount /dev/sda10 /testtmp
      $ cd /testtmp; sudo cp /RECOVERED_FILES/dbs-sql.txt .
      $ ls -al
      .....
      -rw-r--r--  1 root root 11452 Nov 25 13:08 dbs-lite.txt
      -rw-r--r--  1 root root 11315 Nov 25 13:08 dbs-proc.txt
      -rw-r--r--  1 root root 20499 Nov 25 13:08 dbs-qry.txt
      -rw-r--r--  1 root root 23449 Nov 25 13:53 dbs-sql.txt
      drwx------  2 root root 16384 Nov 25 13:04 lost+found
    
    
    The not so easy - debugfs

    I have seen one example that crops up a few times on the net, the problem with it, is for it to work you need to have identified the deleted files data blocks before the file is deleted e.g. something like ..
    Identify a file's data blocks

      .....
      debugfs:  logdump -i <20>
      .....
         mtime: 0x00000000 -- Thu Jan  1 01:00:00 1970
      Size of extra inode fields: 0
         Blocks:                                            (no blocks so ..)
      No magic number at block 31: end of journal.
    
      debugfs:  blocks <20>                                 (use the blocks command)
      28672 28673 28674
    
    

    Armed with the files inode number, it's data block range the example file is deleted and then recovered with something like ..

      sudo dd if=/dev/sda10 of=data.txt bs=4096 count=3 skip=28672
    

    based on the above example

    Okay, you do not need to know the inode of a deleted file as this can be determined via Determine a deleted file's inode

      $ sudo debugfs /dev/sda10
      debugfs 1.42.5 (29-Jul-2012)
      debugfs:  ls
         2  (12) .    2  (12) ..    11  (20) lost+found    12  (48) a.txt   
         15  (4004) d.txt
      (END)  
      debugfs:  ls -d
         2  (12) .    2  (12) ..    11  (20) lost+found    12  (48) a.txt   
       <13> (16) b.txt   <14> (16) c.txt    15  (4004) d.txt   
      (END)     
    

    where <inode> is the inode of a deleted file

    When the file exists, finding the it's data blocks is no problem. When it is deleted though .. Try and get the data blocks for a deleted file

       debugfs:  blocks <15>
       24584 
       debugfs:  q
       tmp $
       tmp $ sudo rm d.txt
       tmp $ sudo stat d.txt
       stat: cannot stat `d.txt': No such file or directory
       tmp $ sudo debugfs /dev/sda10
       debugfs 1.42.5 (29-Jul-2012)
       debugfs:  blocks <15>
    
       debugfs:
    

    inode pointers zeroed on file deletion.

    It can be done though, with the help of some forensics tools e.g. sleuthkit, ... and some low-level filesystem knowledge. Data block location maybe recoverable from the journal. Follow the two links below if you are interested in more ..

    Ext3 file recovery

    Whitepaper on ext3 forensic invetigation

  • Test the quality of a block device
    /sbin/badblocks
    • Undertakes a lower-level test of the quality of a block device (or partition) than 'fsck' does.
    • Informs - does not repair.
    • Performs destructive and non-destructive testing by writing and reading test patterns.
    badblocks [options] device
    
    Options:
     -n                    Default, a slower mode that preserves existing data.  Non-destructive
     -w                    For a brand-new partition, no existing files, write-mode test
     -v                    Verbose, progress reports
     -b blksize            Use 'tune2fs -l' or 'dumpe2fs -h' to get correct blocksize
     -c count              Number of blocks to check at a time.  Consider memory requirements.
                           1024x4096=14MB
     -i in-file            Skips checking know bad blocks listed in 'in-file'.
                           'dumpe2fs -b' lists blocks marked as bad
     -o out-file           Write list of bad blocks to 'out-file', can then pass to 'fsck'
     -s                    Show scan progress by displaying blocks as they are checked
    

    Identify bad blocks and pass results to fsck

    # badblocks -c 4096 -n -v -v -b 1024 -o /tmp/sd12-badblock-list /dev/sda12
    # e2fsck -l /tmp/sd12-badblock-list /dev/sda12
    

    May be better to us fsck.<fstype> badblock-checking wrapper ('e2fsck') with the '-c option' to find and mark the same badblocks that badblocks can detect. 'reiserfsck' has similar --check and --badblocks options.

  • Resize a ext2/ext3/ext4 filesystem
    /sbin/resize2fs

    If no [size] option given the filesystem is resized to use whole of the partition/device. If no units are specified then the filesystem's block size is used as the unit.

    resize2fs [options] device [new size]
    
    Options:
     -f                    Forces, overrides some safety checks which it normally enforces
     -F                    Flush the device's buffer caches before begining
     -p                    Print percentage completion bars for each resize2fs operation
     -P                    Print the minimum size of the filesystem and exit
     -M                    Shrink filesystem to minimum size
     -S RAID-stride        Can specify the raid-stride explicitly
     size[s|K|M|G]         512 byte sectors | Kilobytes | Megabytes | Gigabytes
                           e.g. 600M, 2.4G
    

    Report minimum size for /dev/sda10

    $ sudo resize2fs -P /dev/sda10
    [sudo] password for mark: 
    resize2fs 1.42.5 (29-Jul-2012)
    Estimated minimum size of the filesystem: 4688
    

    Get current size

    $ sudo parted -l /dev/sda | grep '^10'
    10      109GB   110GB   1049MB  logical   ext3
    

    Resize fs to fill partition

    $ sudo e2fsck -f /dev/sda10
    e2fsck 1.42.5 (29-Jul-2012)
    Pass 1: Checking inodes, blocks, and sizes
    Pass 2: Checking directory structure
    Pass 3: Checking directory connectivity
    Pass 4: Checking reference counts
    Pass 5: Checking group summary information
    ext3fs: 14/64000 files (0.0% non-contiguous), 8458/256000 blocks
    
    $ sudo resize2fs  /dev/sda10
    resize2fs 1.42.5 (29-Jul-2012)
    Resizing the filesystem on /dev/sda10 to 256000 (4k) blocks.
    The filesystem on /dev/sda10 is now 256000 blocks long.
    
    

    May be prompted to run 'e2fsck' first.

    Shrink back to its minimum size

    $ sudo resize2fs -M /dev/sda10
    resize2fs 1.42.5 (29-Jul-2012)
    Resizing the filesystem on /dev/sda10 to 4688 (4k) blocks.
    The filesystem on /dev/sda10 is now 4688 blocks long.
    
    
  • Create an ext2/ext3/ext4 filesystem
    /sbin/mke2fs

    If called as 'mkfs.ext3' a journal is created as if the '-j' option was specified.

    The defaults of the parameters for the newly created filesystem, if not overridden by the options listed below, are controlled by the /etc/mke2fs.conf configuration file.

    mke2fs [-c | -l filename] 
           [-b block-size] 
           [-f fragment-size]
           [-g blocks-per-group] 
           [-G number-of-groups]
           [-i bytes-per-inode] 
           [-I inode-size] 
           [-j] [-J journal-options] 
           [-N number-of-inodes]
           [-n] [-m reserved-blocks-percentage] 
           [-o creator-os]
           [-O feature[,...]] 
           [-q] [-r fs-revision-level 
           [-E extended-options]
           [-v] [-F] [-L volume-label] 
           [-M last-mounted-directory] 
           [-S] [-t fs-type] [-T usage-type] 
           [-U UUID] [-V] device [blocks-count]
    
    mke2fs -O journal_dev [-b block-size] 
           [-L volume-label] 
           [-n] [-q]
           [-v] external-journal [blocks-count]
    
    Some options:
     -b block-size                   Specify the size of blocks in bytes.
     -c                              Check for bad blocks before creating the file system.
     -E extended-options             Set extended options - see man page
     -F                              Force mke2fs to create a filesystem
     -j                              Create the filesystem with an ext3 journal.
     -J journal-options              See man page for options
     -L new-volume-label             Set volume label to new-volume-label, max 16 bytes
     -m reserved-blocks-percentage   % of blocks reserved for the super-user, default 5%.
     -n                              DO not create a filesystem, but display what it would.  
                                     Can be used to determine location of backup superblocks
                                     (use same params as used when making the original fs)
     -N number-of-inodes             Specify the number of desired inodes directly
     -t fs-type                      Specify the fs type (i.e. ext2, ext3, ext4, etc.)
     -U UUID                         Create the filesystem with the specified UUID
    

    See the man page

    Create a new ext4 fs on /dev/sda10 using default parameters

    $ sudo mke2fs -t ext4 /dev/sda10
    mke2fs 1.42.5 (29-Jul-2012)
    Filesystem label=
    OS type: Linux
    Block size=4096 (log=2)
    Fragment size=4096 (log=2)
    Stride=0 blocks, Stripe width=0 blocks
    64000 inodes, 256000 blocks
    12800 blocks (5.00%) reserved for the super user
    First data block=0
    Maximum filesystem blocks=264241152
    8 block groups
    32768 blocks per group, 32768 fragments per group
    8000 inodes per group
    Superblock backups stored on blocks: 
        32768, 98304, 163840, 229376
    
    Allocating group tables: done                            
    Writing inode tables: done                            
    Creating journal (4096 blocks): done
    Writing superblocks and filesystem accounting information: done
    
  • Display primary and backup superblocks

    Linux uses blocks (ext4 usese extents) for two purposes, one to store data and the other to store metadata. Metadata is descriptive data that defines whatever it relates to.

    • The metadata for a filesystem is contained within the superblock of that filesystem.
    • Each file system has multiple (duplicate) superblocks.
    • Superblock metadata describes the layout of the particular filesystem it belongs to i.e. filesystem type, size, status, inodes, directories, other metadata ...
    • A primary superblock is the first superblock within a filesystem and is used by default by many filesystem utilities. If this gets damaged then problems will arise.
    • Problems with the superblock generally result in mount failures or if mounted strange behaviour (garbled display, reboots, system hangs).

    Display superblocks

    $ sudo dumpe2fs /dev/sda10 | grep -i superblock 
    dumpe2fs 1.42.5 (29-Jul-2012)
      Primary superblock at 0, Group descriptors at 1-1
      Backup superblock at 32768, Group descriptors at 32769-32769
      Backup superblock at 98304, Group descriptors at 98305-98305
      Backup superblock at 163840, Group descriptors at 163841-163841
      Backup superblock at 229376, Group descriptors at 229377-229377
    

    These tally with the superblocks reported by 'mke2fs' in the previous article.

  • Using a backup superblock

    There location within a filesystem is dependent on the block size being used. One way of determining this is via 'mke2fs' with '-n' in which case you need to pass the same parameters that were used in creating the original filesystem or use 'dumpe2fs' as in the previous article.

    The examples below use three different blocksizes.

    Create loopback device and determine where the backup superblocks are located

    $ dd if=/dev/zero of=/tmp/file bs=1k count=100000
    100000+0 records in
    100000+0 records out
    102400000 bytes (102 MB) copied, 0.548646 s, 187 MB/s
    
    $ sudo losetup /dev/loop0 /tmp/file
    
    $ sudo mke2fs -n -t ext2 /dev/loop0 100000
    mke2fs 1.41.4 (27-Jan-2009)
    .....
    Block size=1024 (log=0)
    .....
    Superblock backups stored on blocks:
        8193, 24577, 40961, 57345, 73729
    
    $ sudo losetup -d /dev/loop0
    

    Display superblocks for 2k and 4k blocksizes

    $ sudo mke2fs -n -t ext2 -b 2048 /dev/loop0 100000
    .....
    Block size=2048 (log=1)
    .....
    Superblock backups stored on blocks:
        16384, 49152, 81920
    
    $ sudo mke2fs -n -t ext2 -b 4096 /dev/loop0 100000
    .....
    Block size=4096 (log=2)
    .....
    Superblock backups stored on blocks:
        32768, 98304
    

    For 2k and 4k blocksizes - 'dd' command was run with 'bs=2k' and then 'bs=4k'

    Use a backup superblock

    # e2fsck -f -b 32768 /dev/sda8
    

    '-f' force the check even if the filesystem is clean.

  • Disk monitoring
    SMART
    • Self-Monitoring, Analysis and Reporting Tool.
    • Hard disk must be smart capable.
    • OS must read smart commands and must have smart capable software installed.

    Start daemon via init.d

    # /etc/init.d/smartd start
    

    Enable/Disable SMART support

    # smartctl -i /dev/sda | grep SMART
    SMART support is: Available - device has SMART capability.
    SMART support is: Disabled
    

    Enable, disable smart on /dev/sda

    smartctl -s [on|off] /dev/sda
    
  • ReiserFS utilities

    NOTE: I have not used these commands for real - double/triple check and use at own risk.

    Some possible 'reiserfstune' and 'reiserfsck' usage scenarios:

    ReiserFS on /dev/sda6 with it's journal on another device /dev/journal

    # umount /dev/sda6
    # reiserfstune /dev/sda6 --journal-new-device /dev/journal -f
    # mount /dev/sda6
    

    Revert back to the standard journal location

    # umount /dev/sda6
    # reiserfstune /dev/sda6 -j /dev/journal --journal-new-device /dev/sda6 --make-journal-standard
    # mount /dev/sda6
    

    Switch between different journals one being in the standard location, the other on /dev/sda1

    # mkreiserfs /dev/sda6
    # reiserfstune --journal-new-device /dev/sda1 -f /dev/sda6
    

    Change max transaction size to 512 blocks

    # reiserfstune -t 512 /dev/sda6
    

    Shell exit codes - returned after running reiserfsck

    0 - No errors.
    1 - Errors found, resierfsck --fix-fixable needs to be launched.
    2 - Errors found, resierfsck --rebuild-tree needs to be launched.
    8 - Operational error.
    16 - Usage or syntax error.
    

    Check a reiserfs filesystem

    # reiserfsck --check --logfile check.log /dev/sda6
    

    If returned 1 then

    # reiserfsck --fix-fixable --logfile fixable.log /dev/sda6
    

    If returned 2 then backup partition before running, could be a bug that should be reported

    # reiserfsck --rebuild-tree --logfile rebuild.log /dev/hda1
    

    Device containing non-standard location of journal fails

    # reiserfsck --no-journal-available /dev/sda6       
    

    Will run when no journal is available.

    Alternatively can rebuild the reiserfs tree then add a new journal in the standard location

    # reiserfsck --rebuild-tree --no-journal-available /dev/sda6
    # reiserfstune --no-journal-available --journal-new-device /dev/sda6 /dev/sda6