Filesystem Corruption and Checking

Although there are potentially many things that will prevent a system from booting, these problems can be generally categorized as either hardware problems or software and configuration problems. The most common hardware-related problem you will probably encounter is a bad hard drive; like all mechanical devices with moving parts, these have a finite lifetime and will eventually fail. Fortunately, the Red Hat exams do not require you to address hardware failures.

Software and configuration problems, however, can be a little more difficult. At first glance, they can look just like regular hardware problems.

In addition to knowing how to mount disk partitions, edit files, and manipulate files, you will need to know how to use several other commands to fix problems from rescue mode or single-user mode. The most useful of these are the df, fdisk, and the fsck commands. To diagnose a problem, you need to know how these commands work at least at a rudimentary level.

df
The Linux df command was covered briefly in Chapter 4. When you use df, you can find mounted directories, the capacity of each partition, and the percentage of each partition that's filled with files. The result shown back in Figure 16-8 illustrates the result in kilobytes. There are a couple of simple variations; the following commands provide output in megabytes and inodes:

# df -m
# df -i

fdisk and parted
The Linux fdisk and parted utilities were covered briefly in Chapter 4. When you use fdisk or parted, you can find the partitions you have available for mounting. For example, the fdisk -l /dev/hda (or parted /dev/hda print) command lists available partitions on the first IDE hard disk:

# fdisk -l /dev/hda

Disk /dev/hda: 15.0GB, 15020457984 bytes
240 heads, 63 sectors/track, 1940 cylinders
Units = cylinders of 15120 * 512 = 7741440 bytes
   Device    Boot   Start     End     Blocks    Id  System
/dev/hda1    *      1         949    7174408+   b   Win95 FAT32
/dev/hda2           950       963    105840     83  Linux
/dev/hda3           964       1871   6864480    83  Linux
/dev/hda4           1872      1940   521640     f   Win95 Ext'd (LBA)
/dev/hda5           1872      1940   521608+    82  Linux swap

Looking at the output from fdisk, it's easy to identify the partitions configured with a Linux format, /dev/hda2, /dev/hda3, and /dev/hda5. Given the size of each partition, it is reasonable to conclude that /dev/hda2 is associated with /boot, and /dev/hda3 is associated with root (/). Here's a fairly complex output from parted:

# parted /dev/sda print

Model: ATA HDS728080PLA380 (scsi)
Disk /dev/sda: 82.3GB
Sector size (logical/physical): 512B/512B
Partition Table: msdos

Number Start   End     Size    Type     File system  Flags
 1     32.3kB  197MB   197MB   primary  ext3         boot
 2     197MB   15.2GB  15.0GB  primary  ext3
 3     15.2GB  16.2GB  1003MB  primary  linux-swap
 4     16.2GB  82.3GB  66.1GB  extended
 5     16.2GB  16.3GB  107MB   logical  ext3
 6     16.3GB  26.8GB  10.5GB  logical  ext3
 7     26.8GB  41.8GB  15.0GB  logical  fat32        lba
 8     41.8GB  51.8GB  10.0GB  logical  ext3
 9     51.8GB  82.3GB  30.5GB  logical  ext3

Information: Don't forget to update /etc/fstab, if necessary.


In this example, it's easy to identify the Linux swap partition. Since /boot partitions are small and normally configured toward the front of a drive (with a boot flag), it's reasonable to associate it with /dev/sda1.

For simple partitioning schemes, this is easy. It gets far more complicated when you have lots of partitions. You should always have some documentation available that clearly identifies your partition layout within your filesystem:

# fdisk -l /dev/hda
Disk /dev/hda: 26.8 GB, 26843545600
255 heads, 63 sectors/track, 3263 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device   Boot   Start      End     Blocks     Id  System
/dev/hda1   *      1          13      104391     83  Linux
/dev/hda2          14         268     2048287+   b   Win95 FAT32
/dev/hda3          269        396     1028160    83  Linux
/dev/hda4          397        3263    23029177+  f   Win95 Ext'd (LBA)
/dev/hda5          397        1097    5630751    83  Linux
/dev/hda6          1098       1734    5116671    83  Linux
/dev/hda7          1735       1989    2048256    83  Linux
/dev/hda8          1990       2244    2048256    83  Linux
/dev/hda9          2245       2372    1028218+   83  Linux
/dev/hda10         2373       2499    1020096    82  Linux swap
/dev/hda11         2500       2626    1020096    83  Linux
/dev/hda12         2627       2753    1020096    83  Linux
/dev/hda13         2754       2880    1020096    83  Linux
/dev/hda14         2881       3007    1020096    83  Linux
/dev/hda15         3008       3134    1020096    83  Linux
/dev/hda16         3135       3236    1020096    83  Linux

In this example, it's easy to identify the Linux swap partition. Since /boot partitions are small and normally configured toward the front of a drive, it's reasonable to associate it with /dev/hda1.

However, that is just a guess; some trial and error may be required. For example, after mounting /dev/hda2 on an empty directory, you would want to check the contents of that directory for the typical contents of /boot.

e2label
Based on the previous output from fdisk -l, you could probably use a little help to identify the filesystems associated with the other partitions. The e2label command can help. When you set up a new filesystem, the associated partition is normally marked with a label. For example, the following command tells you that the /usr filesystem is normally mounted on /dev/hda5.

# e2label
Usage: e2label device [newlabel]

# e2label /dev/hda5
/usr

dumpe2fs
You can get a lot more information on each partition with the dumpe2fs command, as shown in Figure 16-9.

 
Figure 16-9: The dumpe2fs command provides a lot of information.
The dumpe2fs command not only does the job of e2label but also tells you about the format, whether it has a journal, and the block size. Proceed further through the output, and you'll find the locations for backup superblocks, which can help you use the fsck or e2fsck command to select the appropriate superblock for your Linux partition.

 On the Job  fsck is a "front end" for e2fsck, which is used to check partitions formatted to the ext2 and ext3 filesystems.
 

Filesystem Check-fsck
You should also know how to use the fsck command. This command is a front end for most of the filesystem formats available in Linux, such as ext2, ext3, reiserfs, vfat, and more. This command is used to check the filesystem on a partition for consistency. In order to use the fsck command effectively, you need to understand something about how filesystems are laid out on disk partitions.

When you format a disk partition under Linux using the mkfs command, it sets aside a certain portion of the disk to use for storing inodes, which are data structures that contain the actual disk block addresses that point to file data on a disk. The mkfs command also stores information about the size of the filesystem, the filesystem label, and the number of inodes in a special location at the start of the partition called the superblock. If the superblock is corrupted or destroyed, the remaining information on the disk is unreadable. Because the superblock is so vital to the integrity of the data on a partition, the mkfs command makes duplicate copies of the superblock at fixed intervals on the partition, which you can find with the dumpe2fs command described earlier.

The fsck command checks for and corrects problems with filesystem consistency by looking for things such as disk blocks that are marked as free but are actually in use (and vice versa), inodes that don't have a corresponding directory entry, inodes with incorrect link counts, and a number of other problems. The fsck command will also fix a corrupted superblock. If fsck fails due to a corrupt superblock, you can use the fsck command with the -b option to specify an alternative superblock. For example, the following command performs a consistency check on the filesystem on disk partition /dev/hda5, using the superblock located at disk block 8193:

# fsck -b 8193 /dev/hda5