29

I am asking this question on behalf of another user who raised the issue in the Ubuntu chat room.

Do journaling filesystems guarantee that no corruption will occur if a power failure occurs?

If this answer depends on the filesystem, please indicate which ones do protect against corruption and which ones don't.

Nathan Osman
  • 6,170
  • 10
  • 40
  • 51

5 Answers5

23

There are no guarantees. A Journaling File System is more resilient and is less prone to corruption, but not immune.

All a journal is is a list of operations which have recently been done to the file system. The crucial part is that the journal entry is made before the operations take place. Most operations have multiple steps. Deleting a file, for example might entail deleting the file's entry in the file system's table of contents and then marking the sectors on the drive as free. If something happens between the two steps, a journaled file system can tell immediately and perform the necessary clean up to keep everything consistent. This is not the case with a non-journaled file system which has to look at the entire contents of the volume to find errors.

While this journaling is much less prone to corruption than not journaling, corruption can still occur. For example, if the hard drive is mechanically malfunctioning or if writes to the journal itself are failing or interrupted.

The basic premise of journaling is that writing a journal entry is much quicker, usually, than the actual transaction it describes will be. So, the period between the OS ordering a (journal) write and the hard drive fulfilling it is much shorter than for a normal write: a narrower window for things to go wrong in, but there's still a window.

Further reading

Andrew Lambert
  • 2,358
  • 1
  • 16
  • 17
  • Could you please elaborate a little bit on why this is true? Perhaps you could give an example of how corruption would occur in a certain scenario. – Nathan Osman May 06 '11 at 02:57
  • 1
    @George Edison See my expanded answer. – Andrew Lambert May 06 '11 at 03:21
  • 4
    That last bit is incorrect; there is no window for things to go wrong. Since it records what it is about to do before it starts doing it, the operation can be restarted after the power failure, no matter at what point it occurs during the operation. It is a matter of ordering, not timing. – psusi May 06 '11 at 17:58
  • 1
    @psusi there is still a window for the write to the journal to be interrupted. Journal writes may appear atomic to the OS but they're still writes to the disk. – Andrew Lambert May 06 '11 at 21:23
  • 10
    @Amazed they are atomic because they have sequence numbers and/or checksums, so the journal entry is either written entirely, or not. If it is not written entirely, it is simply ignored after the system restarts, and no further changes were made to the fs so it remains consistent. – psusi May 07 '11 at 01:57
19

No.

The most common type of journaling, called metadata journaling, only protects the integrity of the file system, not of data. This includes xfs, and ext3/ext4 in the default data=ordered mode.

If a non-journaling file system suffers a crash, it will be checked using fsck on the next boot. fsck scans every inode on the file system, looking for blocks that are marked as used but are not reachable (i.e. have no file name), and marks those blocks as unused. Doing this takes a long time.

With a metadata journaling file system, instead of doing an fsck, it knows which blocks it was in the middle of changing, so it can mark them as free without searching the whole partition for them.

There is a less common type of journaling, called data journaling, which is what ext3 does if you mount it with the data=journal option.

It attempts to protect all your data by writing not just a list of logical operations, but also the entire contents of each write to the journal. But because it's writing your data twice, it can be much slower.

As others have pointed out, even this is not a guarantee, because the hard drive might have told the operating system it had stored the data, when it fact it was still in the hard drive's cache.

For more information, take a look at the Wikipedia Journaling File System article and the Data Mode section of the ext4 documentation.

Mikel
  • 56,387
  • 13
  • 130
  • 149
  • 1
    +1 for the distinction between file system corruption and data corruption. That little distinction is quite the doozy in practice. – SplinterReality May 06 '11 at 08:03
  • Excuse my utter ignorance, but doesn't `data=journal` as a feature make no sense at all? – boehj May 06 '11 at 10:57
  • 1
    Again, the OS knows when the drive caches data and forces it to flush it when needed in order to maintain a coherent fs. Your data file of course, can be lost or corrupted if the application that was writing it when the power failed was not doing so carefully, and that applies whether or not you use data=journal. – psusi May 06 '11 at 18:11
  • @psusi doesn't matter how careful the program is in writing the data, plenty of hard drives silently corrupt the data on READING http://stackoverflow.com/q/34141117/3338098 – user3338098 Aug 01 '16 at 16:30
  • 1
    @user3338098, drives that silently corrupt data are horribly broken and should not ever be used, and are an entirely different conversation than corruption caused by software doing the wrong thing. – psusi Aug 21 '16 at 03:22
  • @psusi *all* hard drives eventually become "horribly broken" (by manufacturer fault or by age) therefore I must not *ever* (?) use hard drives... so where should I store my data??? – user3338098 Sep 07 '16 at 16:19
  • 1
    @user3338098, drives may fail in old age, but they are never, ever, ever supposed to silently corrupt data. The only time I have ever seen a drive do that was with an OCZ SSD and as a result I will never trust OCZ with my data again. – psusi Oct 07 '16 at 17:46
  • 1
    @psusi It seems that the way things are *supposed* to be are rarely the way things *actually* are. https://en.wikipedia.org/wiki/Data_corruption#SILENT `As another example, a real-life study performed by NetApp on more than 1.5 million HDDs over 41 months found more than 400,000 silent data corruptions, out of which more than 30,000 were not detected by the hardware RAID controller. Another study, performed by CERN over six months and involving about 97 petabytes of data, found that about 128 megabytes of data became permanently corrupted.` – user3338098 Mar 07 '17 at 20:06
  • @user3338098, technically there is a snowballs chance in hell of the drive causing silent corruption ( many of the articles linked there blame faulty raid controllers and other sources rather than the individual drive ). The probability however is so low, that you won't see it until after you win the lottery, and get struck by lightning... on the same day. – psusi Mar 13 '17 at 19:45
8

A filesystem cannot guarantee the consistency of its filesystem if a power failure occurs, because it does not know what the hardware will do.

If a hard drive buffers data for write but tells the OS that it has written the data and does not support the appropriate write barriers, then out-of-order writes can occur where an earlier write has not hit the platter, but a later one has. See this serverfault answer for more details.

Also, the position of the head on a magnetic HDD is controlled with electro-magnets. If power fails in the middle of a write, it is possible for some data to continue to be written while the heads move, corrupting data on blocks that the filesystem never intended to be written.

Community
  • 1
camh
  • 38,261
  • 8
  • 74
  • 62
  • Isn't the drive's firmware smart enough to suspend writing when retracting the head? – Nathan Osman May 06 '11 at 06:43
  • @George: It's going to depend on the drive. There's a lot out there and you don't know how well your (cheap) drive does things. – camh May 06 '11 at 07:54
  • 3
    The hard drive tells the OS if it uses a write behind cache, and the OS takes measures to ensure they are flushed in the correct order. Also drives are designed so that when the power fails, they stop writing. I have seen some cases where the sector being written at the time of power loss becomes corrupt because it did not finish updating the ecc ( but can be easily re-written correctly ), but never heard of random sectors being corrupted on power loss. – psusi May 06 '11 at 18:05
3

ZFS, which is close but not exactly a journaling filesystem, is guaranteeing by design against corruption after a power failure.

It doesn't matter if an ongoing write is interrupted in the middle as in such case, its checksum will be certainly incorrect so the block will be ignored. As the file system is copy on write, the previous correct data (or meta-data) is still on disk and will be used instead.

jlliagre
  • 60,319
  • 10
  • 115
  • 157
2

The answer is in most cases no:

  • As already mikel said, most journaling file systems can only protect file metadata (information like the name of a file, its size, its permissions, etc.), not file data (the file's contents). This is happening because protecting file data results in a very slow (in practice useless) file system.
  • Since the journal is also a special kind of file stored on the hard disk, it can be damaged after a power failure. Thus if the journal is corrupted the file system cannot complete any incomplete transactions that were taking place when the power failure occured.
Community
  • 1
sakisk
  • 2,863
  • 21
  • 18