FS-File system

FS-File system


A file system is a hierarchical tree structure of files and directories. Some tasks are performed more efficiently on a file system than on each directory within the file system. For example, you can back up, move, or secure an entire file system.

File systems are associated with devices (logical volumes) represented by special files in /dev. When a file system is mounted, the logical volume and its contents are connected to a directory in the hierarchical tree structure. You can access both local and remote file systems using the mount command.

AIX supports these file system types:
JFS      Journaled File System which exists within a Logical Volume on disk
JFS2     Enhanced Journaled File System which exists within a Logical Volume on disk
CDRFS    CD-ROM File System on a Compact Disc
UDF      Universal Disk Format (DVD ROM media)
SMBFS    Server Message Block Filesystem (cifs_fs, samba share)
PROCFS   Proc File System
NFS      Network File System accessed across a network

some extra:
GPFS     General Parallel Filesystem
AHAFS    Autonomic Health Advisor File System
------------------------

System-Created File Systems in AIX
The six standard file systems in AIX Versions 5 and higher are /, /home, /usr, /proc, /tmp, and /var. Each of these file systems is always associated with a logical volume name:

Logical Volume          File System or Description
------------------------------------------------------
hd1                     /home    (users' home dir)   
hd2                     /usr     (operating system commands, libraries and application programs)
hd3                     /tmp     (temporary space for all users)
hd4                     /        (critical files for system operations, programs that complete the boot process)
hd5                     <boot logical volume>
hd6                     <primary paging space>
hd8                     <primary JFS or JFS2 log>
hd9var                  /var     (variable spool and log files)
hd10opt                 /opt     (freeware programs)
/proc                   /proc    (pseudo fs kept in memory to support threads)

------------------------

/etc/filesystems

All of the information about the file system is centralized in the /etc/filesystems file. Most of the file system maintenance commands take their defaults from this file. The file is organized into stanza names that are file system names and contents that are attribute-value pairs specifying characteristics of the file system.

/tmp:                           <-- names the directory where the file system is normally mounted
        dev      = /dev/hd3     <-- for local mounts identifies the block special file where the file system reside
                                    for remote mounts, it identifies the file or directory to be mounted
        vfs      = jfs2         <-- specifies the type of mount. For example, vfs=nfs
        log      = /dev/hd8     <-- full path name of the filesystem logging logical volume (only for jfs and jfs2)
        mount    = automatic    <-- used by the mount command to determine whether this file system should be mounted by default
        type     = nas          <-- several file systems can be mounted by giving the value as an argument to the -t flag (mount -t nas)
        check    = false        <-- used by the fsck command to determine the default file systems to be checked
        vol      = /tmp         <-- used by the mkfs command when initiating the label on a new file system
        free     = false        <-- it is there because of unix traditions only (It is totally ignored by any and all AIX commands)
                                    (df command in traditional UNIX would use it to determine which file systems to report)

For the option mount, these are valid entries: automatic, true, false, removable, and readonly:
automatic    fs is to be mounted at boot; this is usually used for system-defined file systems.
true         mount all is allowed to mount this file system.
false        mount will only occur when the file system is specified as an argument to the mount command, or the type is used for mount.

The asterisk (*) is the comment character used in the /etc/filesystems file.

------------------------

mount

The mount command is the glue that logically connects file systems to the directory hierarchy. When a file system is mounted, the logical volume and its contents are connected to a directory in the hierarchical tree structure.

mount /dev/bblv /home/bb       mounts the given lv (bblv) to the given dir (/home/bb)
mount /home/bb                 usually mount used this way, same as above (because /etc/filesystems contains lv and mount points)

------------------------


imfs

All filesystem related commands (crfs/rmfs..) are managing /etc/filesystems file automatically, so usually /etc/filesystems should not be edited manually. (However it is possible with vi.) There is another method which updates /etc/filesystems and this is the command 'imfs', which is not documented, but exists with AIX since the 90s.

If /etc/filesystems file has been removed or some parts have been deleted/overwritten accidentally imfs can create (or remove) filesystem related stanzas.

imfs -x <vgname>                <--remove all filesystems related to the given vg from /etc/filesystems
imfs -xl <lvname>               <--remove a filesystem (logical volume) stanza from /etc/filesystems

imfs <vgname>                   <--it recreates all filesystems in /etc/filesystems which are in the given vg
imfs -l <lvname>                <--it recreates one filesystem in /etc/filesystem

(I think this command is using the vg and lv data on the disk and in the odm to recreate info in /etc/filesystems.)

------------------------------------------------------ 

Superblock
In a JFS, the superblock is the first addressable block (and a backup at the thirty-first addressable block) on a file system. It is 4096 bytes in size. The superblock is very important because a file system cannot be mounted if the superblock is corrupted. This is why there is a secondary or backup superblock at block 31. The superblock contains the following: size of the filesystem, number of datablocks in the fs, state of the fs...

# dd count=1 bs=4k skip=31 seek=1 if=/dev/hd4 of=/dev/hd4     <--this will restore the superblock from block #31
# fsck -p <fs>                                                <--this will copy also the superblock from #31
# dumpfs /usr                                                 <--shows the superblock, i-node map, and disk map information
# od -x -N 64 /dev/hd1 +0xF000                                <--display first superblock (JFS2)
# od -x -N 64 /dev/hd1 +0x8000                                <--display second superblock (JFS2)

------------------------

i-node (index node)
A file system has a fixed number of i-nodes that are located following the superblock. i-nodes contain information about files, including the location of the data on the disk. They contain all of the identifying information about files (file type, size, permissions, user/group/owner, create/modification and last access dates) except for the file name, which is stored in the directory, and the contents of the file, which are stored in the data blocks. Each file or directory has an i-node associated with it. AIX reserves a number of i-nodes for files and directories every time a file system is created, and if all the available inodes are used, no more files can be created, even if the fs has free space.

------------------------

jfslog
AIX uses a journaled file system, meaning that certain i-node information is stored in a transaction log during writes. Its real value is in maintaining the integrity of the file system. Journaled file systems enable faster system reboots after system crashes. Each volume group has a jfslog file that is automatically created when the first file system is created in that volume group. The jfslog ensures the integrity of a file system by immediately writing all meta-data information to itself. Meta-data is information about the file system, such as changes to the i-nodes and the free lists. The jfslog keeps track of what is supposed to happen to the file system and whether it gets done. You are allowed to have a separate log for each filesystem.

(If a jfslog has been created manually, the logform command should be used to activate it as the jfslog for that vg.)

------------------------

Special or device files
A special file, sometimes called device file is associated with a particular hw device or other resource of the computer system. AIX uses them to provide file I/O access to character and block device drivers. Special files are distinguished from other files by having a "c" or "b" stored in the i-nodes, and they are located under the /dev directory. Character and block I/O requests are performed by issuing a read or write request on the device file:
- Character device file: Character devices (tape drives, tty devices) are capable of doing sequential I/O.                   
- Block device file: Block devices can only do random I/O, such as disk devices.

mknod: creates new special files (i-node and the file type (c or b) sould be set), major minor numbers will be written into the i-node

------------------------

Directories
The directory entry contains an index number associated with the file's i-node, the file name....
Every well formed directory contains the entries: . and ..
-.: points to the i-node for the directory itself
-..: points to the i-node for the parent directory

Because directory entries contain file names paired with i-nodes, every directory entry is a link.

------------------------

Links
Links are connection between a file name and an i-node. The i-node number actually identifies the file not the filename. By using links, any i-node or file can be known by many different names.
-hard link: Hard links can be created only between files that are in the same fs.
(when the last hard link is removed , the i-node and its data are deleted)
           
# ls -li: (bello is a hard link, and link count 2 shows it)
4 -rw-r--r--    2 root     system            0 Jul  8 23:27 bello

-symbolic link: Allow access to data in other filesystems from a new filename.

# ls -li: (bello is a sym. link, and  the first character "l" shows this)
lrwxrwxrwx    1 root     system           15 Jul  8 23:30 bello -> /test_fs1/hello

------------------------

NameFS (Name File System)
A NameFS is a pseudo-file system that lets you access a directory through two different path names. With a NameFS you can create a second path and you don't have to change permissions, copy, move, rename or even touch the original file system.

You could use a Name File System to set up a directory with:
-an alternate path (so it’s like a shortcut)
-different permissions (e.g. when some applications or users should have read-only access)
-other mount attributes such as Direct I/O (dio) or Concurrent I/O (cio)

How to setup NameFS:

1. mkdir -p /shortcut                                <--create a dir, which will be the mount point for the new Name file System

2.:
mount -v namefs /some/long/path /shortcut            <--with this you got access to the files via 2 paths
mount -v namefs -o ro /data/report /data_reports     <--with this you can make a read only mount of a dir
mount -v namefs -o cio /db2/W01/redo /deb2redo       <--with this you can mount a dir with CIO to improve I/O

------------------------

crfs                                                       creates a file system (crfs can create lv as well if needed)
crfs -v jfs2 -m /bb -a size=1G -g bbvg                     creates fs and lv (fslv00)(after that lv can be renamed if needed: chlv -n...)
crfs -v jfs2 -d bblv -m /bb -A yes -p rw -a options=cio    creates fs on the given lv with many parameters.
                                                           (lv can be created: mklv -t jfs2 -y bblv bbvg 80 hdiskX hdiskY)

mkfs                           creates an fs over an already created lv (lv must already exist)

mount                          displays information about all the currently mounted file systems
mount dir_name                 mount the file system according to the entry in /etc/filesystems
mount lv_name dir_name         mount the file system to another lv than  in /etc/filesystems
umount dir_name                umount the filesystem
mount -a or mount -all         mounts all the file systems at one time

lsfs                           displays the characteristics of file systems
lsfs -q                        more detailed info about the fs (lv size...) (it queries the superblock)
                               (-v: list filesytems belonging to given fs type (jfs2, nfs); -u: lists filesystems in the given mount group)
rmfs /test                     removes a file system
rmfs -r /test                  removes the mount point also
chfs -a size=+5G /shadowtemp   it will increase by 5G the fs (-5G can be used as well, or 5G will set tthe size of the fs to 5GB)
                               (if fs was reduced but space is not freed up defragfs could help)
chfs -a options='rw' /shadow   shows with lsfs rw (I think rw is the deafault anyway)

imfs -x -l <lvname>            remove a file system data from /etc/filesystems


fsck                           checks file system consistency (should not run on a mounted file system)
defragfs /home                 improves or reports the status of contiguous space within a file system

ls -ldi <dir>                  shows inode number in the first column
istat /etc/passwd              display information regarding a particular inode (last updated, modified, accessed)
                               (update: change in the inode (file name, owner...); modified: change in the content of the file or dir)

df                             monitor file system growth
du dir_name                    (disk usage), to find which files are taking up the most space
du -sm * | sort -rn | head     shows every dir size in MB (du -sk * the same in KB), the first 10 largest

skulker                        cleans up file systems by removing unwanted or obsolete files
fileplace <filename>           displays the placement of file blocks within logical or physical volumes, it will show if a file fragmented

fuser /etc/passwd              lists the process numbers of local processes using the /etc/passwd file
fuser -cux /var                shows which processes are using the given filesystem
fuser -cuxk /var               it will kill the above processes   
fuser -dV /tmp                 shows deleted files (inode) with process ids which were open by a process (so its space could not be freed up)
                               (-V: verbose will show the size of the files as well)
                               if we rm a file, while it is opened by a process its space will not free up.
                               solution: kill the process, wait for the process to finish or reboot the system
---------------------------------------

HOW TO FIND FILES AFTER A SPECIFIC DATE:
touch mmddhhmm filename        creates a file at a specific date
find /var -xdev -newer filename -ls

---------------------------------------

CREATING FS with commands:

1. mkvg -y oravg -s 128 hdiskpower62                                 <--creates vg with 128MB pp
2. mklv -y oraloglv -t jfs2log -a e -r n oravg 1 hdiskpower62        <--creates loglv (-a: allocation (e:edge), -r: relocatable (n:no))
3. mklv -y oralv -t jfs2 -a e oravg 500 hdiskpower62                 <--creates lv (-a: allocation (e:edge))
4. crfs -v jfs2 -a logname=oraloglv -d oralv -m /ora                 <--creates fs with specified loglv (set auto mount if needed)
5. mount /ora                                                        <--mount fs
6. chown -R oracle.dba /ora_backup                                   <--set owner/permission

---------------------------------------

EXTENDING FS with commands:

1. extendvg oravg hdiskpower63                                       <--extends vg with hdisk
2. chlv -x 1024 oralv                                                <--set the maximum number of logical partitions if needed
3. extendlv oralv 20 hdiskpower63                                    <--extends lv to the specified hdisk
4. lslv -m oralv                                                     <--check allocations if needed
5. lsfs -q /ora                                                      <--shows new size of the lv (copy value of 'lv size')
6. chfs -a size=146800640 /ora                                       <--use the 'lv size' value to enlarge fs

--------------------------------------------

HOW TO CORRECT CORRUPTED FS:
1. fsck /fs1                <--checks fs consistency (should not run on a mounted file system)
2. umount /fs1              <--umounts fs

If umount fails:
fuser -cux /fs1             <--shows processes running in the fs
fuser -kcux  /fs1           <--kills the above processes (kill -9 works as well) (inittab/repawn processes will be there again)
umount /fs1

3. fsck -y /fs1             <--corrects errors

--------------------------------------------

HOW TO CORRECT CORRUPTED ROOTVG FS:

1. on NIM server setup client for network boot: nim -o maint_boot -a spot=spot-6100-09-01 <client>       
(smitty nim --> nim admin. tasks --> machines --> perform operations on machines --> maint_boot (if needed choose spot))

2. boot into SMS (set ip, and network boot)
NOTE: Although you will be going into maintenance mode on the NIM client, you DO NOT want to select “Service Mode Boot”. That is a very limited shell, and will not always allow you to do everything you would like to do in maintenance mode. Select “Normal Mode Boot.

3. Choose "Access Root VG" --> "Access this Volume Group and start a shell before mounting filesystems"

4. fsck needed fs (lv):
   fsck /dev/hd4
   fsck /dev/hd2
   fsck /dev/hd3
   fsck /dev/hd9var
   fsck /dev/hd1

NOTE: The -y option automatically repairs file system corruption. This flag can be used to avoid having to manually answer multiple confirmation prompts, however, use of this flag can cause permanent, unnecessary data loss in some situations.

5. To format the default jfslog for the rootvg: /usr/sbin/logform /dev/hd8
(Answer yes when asked if you want to destroy the log.)

6. Reboot system into normal mode: sync;sync;sync;reboot

(If /etc/filesystems is corrupted, follow this docu from point #10: http://www-01.ibm.com/support/docview.wss?uid=isg3T1000131)

--------------------------------------------

CANNOT UNMOUNT FILE SYSTEMS:

umount: 0506-349 Cannot unmount /dev/fslv00: The requested resource is busy.

-files are open or a user is using a directory in the fs:
fuser                       <--determines the PIDs for all processes that have open references within the fs
kill                        <--these processes can be killed

-loaded kernel extension:
genkex                      <--reports all loaded kernel extension

-file systems are still mounted within that file system:
umount                      <--umount first the embedded file systems!!!!!

-you can check processes using it with lsof:
lsof /home                  <--it will show the pids what should be terminated (kill <pid>)

-file system is an nfs4 exported fs:
cat /etc/exports            <--check if fs is listed there as an nfs4 exported fs (-vers=4)
exportfs -u <fs>            <--removes export, after umount is possible. (after exportfs <fs> will re-export)

--------------------------------------------

HOW TO COPY A FILESYSTEM:

cp: good for smaller filesystems (less than 10GB) with not so many files, can be done online
tar: good for lots of small files and if it has to be done online (if files are greater than 2GB use GNU tar utility)
cplv: this is better with large filesystems, with many files (it is copying at pp (lv) level, not file by file (filesystem level) (umount is needed)

--------------

cp:
cp -prh /origfs/* /destfs/                     <--this is good if small number of files need to be copied online (verify after copy: ls -lR|wc -l)

--------------

tar:
cd /origfs                                    <--cd to the directory what you want to copy
tar cvf - . | (cd <destfs> && tar xvf -)      <--it copies everything from here to destfs (file size limit? 6GB OK)
                                              Ibm site I saw this: tar cpf - . | (cd /opt/pluto_bak; tar xpf - )
ls -lR | wc -l                                <--check if everything is identical, for both dir

--------------

cplv:
(In the first example both the original and the copied filesystems can be mounted after copying finished if needed.)
(As lv names are unique system wide, lvs can be in different vg and cplv can understand them.)

original fs: /origfs (origlv)
destination fs: /destfs (destlv)

0. create destination fs: /destfs              <--if destination fs does not exist create it (min. size as origfs, can be in different vg)
1. umount /origfs; umount /destfs              <--umount both filesystems (cplv works only if fs is not mounted)
2. chlv -t copy destlv                         <--type of destination lv should be changed from jfs/jfs2 to copy (otherwise cplv gives error)
3. cplv -e destlv origlv                       <--copy to an existing logical volume (-e) (it will change type of destlv to jfs2)
4. mount /origfs; mount /destfs                <--check if everything is OK
5. umount /destfs; fsck /dev/destlv            <--good habit to do an fsck


(In the second example fs will be moved, both origfs and destfs cannot be mounted at the same time.)
0. no destination fs (lv) is needed            <--as fs (lv) will be moved (migrated) no destination fs is needed, cplv will create new lv
1. umount /origfs                              <--umount is needed, cplv works only if fs is not mounted
2. cplv -v VGname -y newLV origlv              <--if VGname (-v) omitted lv is created in the same vg
3. chfs –a dev=/dev/newLV –a log=/dev/[logdev] /origfs    <--lv and logdevice of /origfs should be changed to show new parameters (lsvg -l vg|grep log)
                                               (instead chfs, /etc/filesystems can be edited: change "dev" and "log" lines to new values)
4. mount /origfs                               <--check if everything is OK
5. umount /origfs; fsck /dev/newLV             <--good habit to do an fsck
6. rmlv origlv                                 <--origlv can be removed (or if you want fallback, chfs to original values)



--------------------------------------------

BACKUP/RECREATE/RESTORE FILESYSTEM:

1. cd /filesystem
2. tar -cvf /tmp/filesystem.tar ./*                        <--it creates a backup of all the files in the fs
3. cd /
4. umount /filesystem
5. mkfs /filesystem
6. mount /filesystem
7. cd /filesystem
8. tar -xvf /tmp/filesystem.tar > /dev/null                <--restores the data (output redirected, as displaying is time consuming)

--------------------------------------------

CHANGING THE LOG LOGICAL VOLUME:
If an fs is write extensive, the use of the log logical volume can cause io bottleneck if it is placed on the same disk.
(e.g. data-fs is located on hdisk2)

1. umount /data-fs                                         <--umount the fs for which you want to create the new log logical volume
2. mlv -t jfs2log -y datafsloglv datavg 1 hdisk1           <--create a new log logical volume
3. logform /dev/datafsloglv                                <--format the log
4. chfs -a log=/dev/datafsloglv /data-fs                   <--it will modify /etc/filesystems to consist the new settings
5. getlvcb -ATdatalv                                       <--just for checking if lvcb is updated
6. mount /data-fs                                          <--mount back the changed filesystem

--------------------------------------------

REMOVING A FILE WITH SPECIAL CHARACTERS:

1. find inode number
root@bb_lpar: /tmp/bb # ls -i
   49                <--the name of the file is empty
   35 commands              
   47 lps.txt


2.  remove file by inode number
root@bb_lpar: /tmp/bb # find . -inum 49 -exec rm '{}' \;

--------------------------------------------

FILESYSTEM CLEANUP HINTS:

find large files:

find /var -size +10000 -mtime -1 -exec ls -ltr {} \;       <--files > 5MB (10000x 512bytes) and modification date is less than a day
find . -xdev -size +4000000c -exec ls -l {} \;             <--it will list files larger than 4MB in the fs
find . -type f | xargs ls -s | sort -rn | head             <--10 largest file (if there is another fs under it, it will search there too)
find . -type f -size +10000 | while read X ; do du -sm "$X" ; done | sort -n | tail -n 15        <--15 largest file


/etc:

/etc/perf/daily/                                           <--xmdaily logs can be removed if not needed
                                                           (can be removed from inittab and xm processes can be killed)

who /etc/security/failedlogin                              <--lists failed logins
> /etc/security/failedlogin                                <--clears that file


/usr:

/usr/websm/pc_client                                       <--windows, exe files can be removed


/var:

/var/adm/wtmp:
who /var/adm/wtmp                                          <--shows the contents of that file
/usr/sbin/acct/fwtmp < /var/adm/wtmp | tail -5000 > /tmp/wtmp.asc   <--converts wtmp to ascii, saves last 500 lines
/usr/sbin/acct/fwtmp -ic < /tmp/wtmp.asc > /var/adm/wtmp            <--converts back to original format
rm /tmp/wtmp.asc                                           <--delete the ascii file


/var/adm/cron/log:
> /var/adm/cron/log                                        <--this can be cleared
   
/var/spool/lpd:
stopsrc -s qdaemon                                         <--stops qdaemon
rm /var/spool/lpd/qdir/*                                   <--clears dir
rm /var/spool/lpd/stat/*                       
rm /var/spool/qdaemon/*
startsrc -s qdaemon                                        <--starts qdaemon

/var/spool/mail                                            <--under this dir, not needed mails can be cleared as well
/var/adm/sulog                                             <--this file can be reduced (cleared) as well

--------------------------