prevent inode reuse

Question

We are using Logstash to ingest our logs and we are facing some issues due inodes being reused. We tried all possible options on Logstash side so we are exploring the OS side.

As far as I can see, if I create a file, drop it and later on I create a new one, most of the time it will get the same inode

[root@XXXX~]# touch a.txt
[root@XXXX~]# stat -c%i a.txt
671092802
[root@XXXX~]# rm a.txt
rm: remove regular empty file ‘a.txt’? y
[root@XXXX~]# touch a.txt
[root@XXXX~]# stat -c%i a.txt
671092802
[root@XXXX~]#  rm a.txt
rm: remove regular empty file ‘a.txt’? y
[root@XXXX~]# touch b.txt
[root@XXXX~]# stat -c%i b.txt
671092802

How can I prevent OS with XFS to reuse recently used inodes for new files?

Ideally, we would like to define a period of time between the file is deleted until the inode is being reused. The disk is big so we don't expect issue reaching inode limits.

Thanks

Answer 1

The only way to prevent the creation of a file with a given inode number is if there is already one (or if the inode value is one that the filesystem won't use, of course). You can't reserve an inode value. This is true through generic interfaces (i.e. through interfaces that aren't specific to a particular filesystem type), this is true of most filesystems (i.e. most don't have a proprietary means of reserving an inode number), and as far as I can tell this is, unsurprisingly, true of XFS in particular.

If you create a new file immediately after deleting one, on many filesystems, most of the time, the new file will have the same inode as the just-deleted file. But this is never guaranteed.

If you want the inode to remain in use, don't delete the file. You can truncate it (e.g. truncate -s0 /path/to/file or : >|/path/to/file) to save disk space if you want. You can move it to another directory on the same filesystem if some tool is exploring a directory and you don't want that tool to see the file anymore.