Friday, October 15
Shadow

Inodes in Linux

Everything in Linux considered as file. This is just to maintain the consistency. Everything means keyboard, mouse, printers, monitor, hard disk, processes, even the folder or directories are treated as file in Linux. The regular files contain data such as text files, mp3, multimedia files, configuration files.

Files contain some administrative information about them, such as their size, ownership, permissions. This metadata about a file in managed with a data structure known as an inode i.e. index node.

There are three times in the inode:

  • contents of the file last modified (write)
  • file was last used (read or execute)
  • inode itself was last changed

Changing the contents of a file does not affect its usage time. Changing the permission affects only the inode change time.

For example:
When you install RHEL, you get a file anaconda-ks.cfg in /root directory with the installation. I will be taking the same file for this scenario.

  • The file was created on Feb 19, 2019.
  • I changed the permission of the file to -rw-rw-rw- on Feb 16, 2021, at 02:24 AM.
  • Read the file using vi editor on Feb 16, 2021, at 02:25 AM.

The below screenshot shows the same combination.

  • ls -lu command shows, when was the last file was read or executed.
  • ls -lc command shows, when was the last file permissions were changed.
  • ls -l command shows, when was the last file written.

The -t option to ls, which sorts the files according to time, by default that of last modification, can be combined with -c or -u to report the order in which inodes were changed or files were read.

The system’s internal name for a file is its inode number: the number of the inode holding the file’s information.
ls -li reports the inode number in decimal.
The first column represents the inode.

The information about inode, you can also see using stat command. You need to provide the filename to get the full information.

It is the inode number in the first two bytes of a directory, before the name. The first two bytes in each directory entry are the only connection between the name of a file and its contents. A filename in a directory is therefore called a link because it links a name in the directory hierarchy to the inode.

The same inode number can appear in more than one directory. The rm command does not actually remove inodes, it removes directory entries or links. Only when the last link to a file disappears does the system remove the inode, and hence the file itself.

If the inode number in a directory entry is zero, it means that the link has been removed, but not necessarily the contents of the file. You can verify that the inode number goes to zero by removing the file using the rm command.

The next file created in this directory will go into the unused slot, although it will probably have a different inode number. The integer between the permissions and the owner is the number of links to the file.

If you create a hard link, the inode will be the same. You can create a hard link using the command: ln old_file new_file


If you create a soft link (shortcut), the inode will be different. You can create a soft link using the command: ln -s old_file new_file

The inode number of file inode and inode_copy is different, because they are different files, even though they contain the same contents.

Total inodes

To check how many inodes are available and how many you have used, you can use df -i or df -ih command.

What happen if all inodes are used?

If you exhaust all the available inodes, then you won’t be able to create a new file. Inodes are not dependent on hard disk space, even if you have space left in hard disk but inodes are finished, it’s next to impossible to create a new file in Linux.

Additional ways Inodes are used

The way inodes work in Linux makes it impossible to have conflicting inode numbers. You can use soft links across different file systems, but for hard links, it is not possible. You can delete the original files and still have the data available through a hard link.

By deleting a file, all you have done is remove one of the names pointing to a specific inode number. The data will remain until you delete all names associated with the same inode number. Linux systems update without requiring a system reboot in large part because of the way inodes work. Users don’t interact directly with inodes, but they do represent a fundamental component of Linux file structures.

Leave a Reply

Your email address will not be published. Required fields are marked *

error

Enjoy this blog? Please spread the word :)