Speaking UNIX: It is all about the inode

Have you ever wondered what Iused and %Iused mean in UNIX® commands like df or what people are talking about when the say inode? UNIX and Linux® systems both use inodes, and IBM® AIX® is no different. Discover what an inode is and why inodes are important to UNIX, the structure of an inode, and commands for working with inodes.       An inode is a data structure in UNIX operating systems that contains important information pertaining to files within a file system. When a file system is created in UNIX, a set amount of inodes is created, as well. Usually, about 1 percent of the total file system disk space is allocated to the inode table. Sometimes, people interchange the terms inode and inumber. The terms are similar and do correspond to each other, but they don't refer to the same things. Inode refers to the data structure; the inumber is actually the identification number of the inode—hence the term inode number, or inumber. The inumber is only one important item of information for a file. Some of the other attributes in an inode are discussed in the next section. The inode table contains a listing of all inode numbers for the respective file system. When users search for or access a file, the UNIX system searches through the inode table for the correct inode number. When the inode number is found, the command in question can access the inode and make the appropriate changes if applicable. Take, for example, editing a file with vi. When you type vi <filename>, the inode number is found in the inode table, allowing you to open the inode. Some attributes are changed during the edit session of vi, and when you have finished and typed :wq, the inode is closed and released. This way, if two users were to try to edit the same file, the inode would already have been assigned to another user ID (UID) in the edit session, and the second editor would have to wait for the inode to be released. The inode structure The inode structure is relatively straightforward for seasoned UNIX developers or administrators, but there may still be some surprising information you don't already know about the insides of the inode. The following definitions provide just some of the important information contained in the inode that UNIX users employ constantly: Inode number Mode information to discern file type and also for the stat C function Number of links to the file UID of the owner Group ID (GID) of the owner Size of the file Actual number of blocks that the file uses Time last modified Time last accessed Time last changed Basically, the inode contains all information about a file outside of the actual name of the file and the actual data content of the file. The full inode structure can be found in the header file /usr/include/jfs/ino.h in AIX or on the Web at http://publib.boulder.ibm.com/infocenter/systems/index.jsp?topic=/com.ibm.aix.files/doc/aixfiles/inode.h.htm. The information listed above is important to files and is used heavily in UNIX. Without with this information, a file would appear corrupt and unusable. Directories and files may appear different on UNIX systems compared to other operating systems, but they aren't. In UNIX, directories are actually files that have a few additional settings in their inodes. A directory is basically a file containing other files. Also, the mode information has flags set to inform the system that the file is actually a directory.   Working with inodes Knowing how to work with inodes in UNIX can save a lot of time and frustration. You can use the following commands to alleviate some of the headaches you may have when you don't know about inodes. The df command As mentioned earlier, when you create a file system in UNIX, about 1 percent of the total disk space is allocated to the inode table. Every time you create a file in the file system, an inode is allocated to the file. Typically, there is an adequate number of inodes associated with a file system, but running out of inodes is always a possibility. To monitor this, you can view the output of the df. Using the df command, you can look at all mounted file systems or specific file systems. In this view, you can see the number of inodes used already in the respective file system as well as the percentage used overall in the file system, as Listing 1 shows. Listing 1. Using df to monitor inode use   # df -k|head -6 Filesystem 1024-blocks Free %Used Iused %Iused Mounted on /dev/hd4 229376 138436 40% 4730 13% / /dev/hd2 8028160 962692 89% 110034 33% /usr /dev/hd9var 1835008 366400 81% 25829 24% /var /dev/hd3 524288 523564 1% 98 1% /tmp /dev/hd1 32768 32416 2% 5 1% /home   If for some reason a file system did reach 100 percent of its inodes used, you won't be able to create additional files, devices, directories, and so on in the file system. One solution is to add more space to the file system through the smitty chfs command, as shown in Figure 1. Another solution is to create smaller inode extents. IBM AIX 5L now allows for inode extends smaller than the default size of 16KB on enhanced journal file systems. Please keep in mind, though, that if you use this option in AIX 5L, the file system will not be accessible from previous versions of AIX. Figure 1. The result of the smitty chfs command   istat and stat A quick way to examine an inode in AIX is by using the istat command. With this command, you can find the inumber of the specific file as well as other inode items like permissions; file type; UID; GID; number of links (not symbolic links); file size; and time stamps for last updated, last modified, and last accessed. Listing 2 shows inode information for the file /usr/bin/ksh in AIX. Listing 2. Inode information for /usr/bin/ksh   # istat /usr/bin/ksh Inode 18150 on device 10/8 File Protection: r-xr-xr-x Owner: 2(bin) Group: 2(bin) Link count: 5 Length 237804 bytes Last updated: Wed Oct 24 17:37:10 EDT 2007 Last modified: Wed Apr 18 23:58:06 EDT 2007 Last accessed: Mon Apr 28 11:25:35 EDT 2008   In addition to showing the standard information from istat, you now know what the inumber is for /usr/bin/ksh. If you also find the logical volume in which the file resides, you can display even more information. One way to find this information is by looking at the mounted file system in which the file resides with the df command: # df /usr/bin Filesystem 512-blocks Free %Used Iused %Iused Mounted on /dev/hd2 16056320 1925384 89% 110034 33% /usr   The file /usr/bin/ksh resides in the directory /usr/bin. Looking at the output of the df command, you can tell that the directory /usr/bin is contained in the /usr file system and that the /usr file system is inside the logical volume /dev/hd2. Now that you know both the inumber and the logical volume name, using istat with both items of information as arguments, you can determine the hexadecimal addresses of the disk blocks that make up the file, as shown in Listing 3. Listing 3. Determining the hexadecimal addresses of the file blocks   # istat 18150 /dev/hd2 Inode 18150 on device 10/8 File Protection: r-xr-xr-x Owner: 2(bin) Group: 2(bin) Link count: 5 Length 237804 bytes Last updated: Wed Oct 24 17:37:10 EDT 2007 Last modified: Wed Apr 18 23:58:06 EDT 2007 Last accessed: Mon Apr 28 11:44:20 EDT 2008 Block pointers (hexadecimal): 11620 ef8c0   Linux has its own version of istat: stat. The Linux stat command shows similar information and also includes some switches not available in the AIX istat command: # stat /bin/bash File: `/bin/bash' Size: 722684 Blocks: 1432 IO Block: 4096 regular file Device: fd00h/64768d Inode: 12799859 Links: 1 Access: (0755/-rwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2008-04-06 19:13:50.000000000 -0400 Modify: 2006-07-12 03:11:53.000000000 -0400 Change: 2007-11-22 04:05:30.000000000 -0500   The ls command At one time or another in your career, you've had to worry about removing or managing files with dashes or other special characters in the file name or file names that appear not to have a file name at all. Most likely, someone mistakenly named the respective file. Because most commands in UNIX include switches, or options, that begin either with a hyphen (-) or a double hyphen (--), it can be difficult to manipulate these files with commonly used commands such as rm, mv, and cp. Thankfully, there are options in commands to show the inumber of the inode associated with the file in question. The ls command has such an option: # ls - -- -p fileA fileB fileC fileD fileE fileF fileG fileH fileI fileJ fileK fileL   Using the ls -i command, you can view the inumber next to the file name, as shown in Listing 4. Now that you know the inumber, you can easily manipulate the file. Listing 4. Viewing the inumber of the file   # ls –i 38988 38991 -p 38984 fileC 38982 fileF 38977 fileI 38978 fileL 38989 - 38980 fileA 38986 fileD 38983 fileG 38987 fileJ 38990 -- 38979 fileB 38976 fileE 38985 fileH 38981 fileK   The find command Using the UNIX find command, you can finish what you started with the ls command. Now that you know the inumber for the respective files that you must manipulate, you can start! To remove the file that looks like it has no name, simply use find with the -inum switch to locate the inumber and file. Then, when the file has been found, use find with the -exec switch to remove the file: # find . -inum 38988 -exec rm {} \;   To rename the file, do the same again, but this time use mv rather than rm: # find . -inum 38989 -exec mv {} fileM \;   To verify that you're getting the expected results, simply use the ls -i command again: # ls -i 38990 -- 38979 fileB 38976 fileE 38985 fileH 38981 fileK 38991 -p 38984 fileC 38982 fileF 38977 fileI 38978 fileL 38980 fileA 38986 fileD 38983 fileG 38987 fileJ 38989 fileM   The fsck command Unfortunately, hardware doesn't last forever, and systems can fail over years of continued use. When this happens and the operating system shuts down abnormally because of a power failure or another issue, you may encounter files when you bring the system back up that were open during the crash and now need assistance. During times like this, you may run into messages that inodes need to be repaired or that an error exists. If this happens, the fsck command can be a lifesaver! Rather than restoring the system or even rebuilding the operating system, you can use fsck to repair file systems or correct damaged inodes. The following command attempts to repair the logical volume /dev/hd1: # fsck –p /dev/hd1 –y   By using the fsck command, you can narrow the search for damaged inodes, as well. If you're searching for a specific inode, you can use the -ii-NodeNumber switch with fsck.   Conclusion Files and directories would be nearly useless in UNIX without the helping hand of the inode. Hopefully, after reading this article, you understand inodes better, their importance to AIX, and also how to manage them. You may never look at df the same way again.