9

I shut down my computer the hard way and next startup there was message on boot for several seconds saying recovering journal. Four startups later and the message was not there - only the first time. Looks like there are no consequences or side effects. Thanks to this question I know why it happened but nowhere on the internet says what the journal is. There are no problems with it, I'm just interested in what it is.

0

2 Answers 2

8

Does someone knows what journal is?

Part of a modern day filesystem is a feature called "journaling". We use "ext4" as a filesystem. (ext3, ext2 are older versions. NTFS is a Microsoft equivalent.)

A journaling file system is a file system that keeps track of changes not yet committed to the file system's main part by recording the intentions of such changes in a data structure known as a "journal", which is usually a circular log. In the event of a system crash or power failure, such file systems can be brought back online more quickly with a lower likelihood of becoming corrupted

Source: Wikipedia - Journaling file system, cites: IBM - Anatomy of Linux journaling file systems

Basically the message means the system did an integrity check on this part of your filesystem. It is forced by the system, so generally there is nothing to worry about. When you have power cutoffs, the journal can get damaged and, unless your harddisk is really busted, tends to get repaired during this check.

6
  • 1
    Is it correct to say, that journaling is used to protect the filesystems integrity, but not necessarily the integrity of the files (their content)?
    – Ralf
    Jan 12, 2019 at 20:15
  • 2
    @Ralf: That depends solely on what is being journaled. JFFS2, for example, journals every write, thus, it protects the integrity of all data. Apple's HFS+ only journals filesystem metadata, thus it only protects filesystem metadata, but not file data. Ext4 is configurable: you can journal everything, nothing, or only filesystem metadata. The default setting is to journal, but only filesystem metadata. In that case, it only protects filesystem metadata, but not file data. The main reason for making this choice is that journaling means writing twice. Jan 12, 2019 at 21:37
  • 2
    The other extreme are so-called log-structured filesystems, which have only a journal. In other words, they only ever append to a journal, but they don't have a regular data area. That way, they avoid the "double write" of a journaling filesystem, but they now have the problem that the filesystem never shrinks, because even deletions are just appended to the journal. So, they need kind-of a "garbage collector" to clean out redundant journal entries and compact the journal again. (Some of those FS call this "vacuuming".) Jan 12, 2019 at 21:41
  • 1
    @JörgWMittag Thank you. I think it is important to understand, that journaling FS doesn't generally mean, that you can't loose data.
    – Ralf
    Jan 12, 2019 at 21:45
  • 1
    @Ralf: Yes, journaling does not protect you from data loss, only from data corruption. It only ensures that an operation either completely succeeds or does not happen at all, it does not guarantee that an operation always succeeds. And secondly, journaling only protects that which is journaled, which for most common implementations is only FS metadata. Jan 12, 2019 at 21:47
5

Many modern file systems employ a journal including NTFS, Ext3/4, XFS, HFS+, and others. The journal helps with two things, avoiding file system corruption and speeding up recovery after a failure such as a power loss or system crash. There are two major components to a file system, the data and the metadata. The data is the contents of a file, image, video, documents, and ultimately it is what gives the file system it's value. The metadata is what describes the structure of the filesystem including how files are named, stored in directories, access permissions, file modification times, and recording areas of the disk that are in use or are free to be allocated to other files as they grow or are created. If the metadata becomes corrupted because of a system crash, it could lead to further data loss/corruption. For example, part of the disk might be selected for allocation to a file, but if it's not recorded correctly before a crash, it might be added to the file's list of data blocks, but still in the list of free data blocks and allocated to a second file later on. Now, there are two files that are sharing the same data blocks/content.

The journal is a place on the disk reserved for recording changes to the file system. The exact details of what is being changed it written first to the journal located in a single location on disk, then, after the journal is updated, the changes are applied to the appropriate locations on the disk which might require several writes. One the updates are done, the journal entry is marked as complete. After a crash, the system only need to examine the journal for incomplete entries and complete them to fix the file system. This speeds recovery and ensures a change is made entirely or not at all. If a block is allocated to a growing file, it will be added to the file's block list and also marked as in use.

Also, on file systems that support journalling, most often it's only metadata journalling to preserve the structure, but not the data itself. Full data journalling is normally quite expensive and slow, but less crucial than metadata. It's possible to enable for data as well if needed.

Also, to complete this, there are some file systems that don't currently offer journalling including FAT32, exFAT, Ext2, and UDF. If there's a crash during an update, a full scan of the filesystem needs to be done to track down any errors or corruption.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .