Detailed Introduction to Inode Nodes in Linux File System

1. What is an inode?

To understand an inode, we must start with file storage.
Files are stored on the hard disk, and the smallest storage unit on the hard disk is called a ‘sector’. Each sector stores 512 bytes (equivalent to 0.5KB).

When the operating system reads the hard disk, it does not read sector by sector, as that would be inefficient. Instead, it reads multiple sectors at once, which is called a ‘block’. This ‘block’, made up of multiple sectors, is the smallest unit for file access. The most common size for a ‘block’ is 4KB, which consists of eight consecutive sectors.

Since file data is stored in ‘blocks’, we also need a place to store the metadata of the file, such as the file’s creator, creation date, file size, and so on. This area that stores file metadata is called an inode, which is translated into Chinese as ‘索引节点’.

2. Contents of an inode

An inode contains the metadata of a file, specifically including the following:

* File size in bytes
    * User ID of the file owner
    * Group ID of the file
    * Read, write, execute permissions of the file
    * Timestamps, which include three: ctime (last inode change time), mtime (last file content change time), and atime (last file access time).
    * Link count, which indicates how many file names point to this inode
    * Location of the data blocks

You can use the stat command to view the inode information of a specific file:

stat example.txt

In short, all file information except the file name exists within the inode. The reason why the file name is not included will be explained in detail later.

3. Size of an inode

An inode also consumes hard disk space, so when the hard disk is formatted, the operating system automatically divides the disk into two areas. One is the data area, which stores file data; the other is the inode area (inode table), which stores the information contained in the inodes.
The size of each inode is typically 128 bytes or 256 bytes. The total number of inodes is determined at formatting, usually set to one inode per 1KB or 2KB. Assuming a 1GB hard disk, with each inode being 128 bytes and one inode per 1KB, the size of the inode table would reach 128MB, occupying 12.8% of the entire hard disk.

You can use the df command to check the total number of inodes and how many have been used in each partition.

df -i

To check the size of each inode, you can use the following command:

sudo dumpe2fs -h /dev/hda | grep 'Inode size'

Since each file must have an inode, it is possible for the inodes to run out while the hard disk is not full. In this case, new files cannot be created on the hard disk.

4. Inode numbers

Each inode has a number, and the operating system uses the inode number to identify different files.

It is worth repeating that Unix/Linux systems do not use file names internally but use inode numbers to identify files. For the system, the file name is merely an alias or nickname for the inode number. On the surface, users open files by file names. In reality, this process is divided into three steps: first, the system finds the inode number corresponding to the file name; second, it retrieves the inode information using the inode number; finally, it locates the block where the file data is stored based on the inode information and reads the data.

Using the ls -i command, you can see the inode number corresponding to a file name:

ls -i example.txt

5. Directory files

In Unix/Linux systems, a directory is also a type of file. Opening a directory is essentially opening a directory file.

The structure of a directory file is very simple, consisting of a list of directory entries (dirents). Each directory entry consists of two parts: the file name of the contained file and the inode number corresponding to that file name.

The ls command only lists all the file names in the directory file:

ls /etc

The ls -i command lists the entire directory file, including both file names and inode numbers:

ls -i /etc

To view detailed information about a file, you must access the inode node based on the inode number and read the information. The ls -l command lists detailed information about the file.

ls -l /etc

6. Hard links

In general, there is a ‘one-to-one’ relationship between file names and inode numbers, where each inode number corresponds to one file name. However, Unix/Linux systems allow multiple file names to point to the same inode number. This means that different file names can access the same content; modifying the file content will affect all file names; however, deleting one file name does not affect the access of another file name. This situation is called a ‘hard link’.

The ln command can create a hard link:

ln source_file target_file

After running the above command, the source file and target file will have the same inode number, pointing to the same inode. The inode information includes a field called ‘link count’, which records the total number of file names pointing to this inode, and this will increase by 1. Conversely, deleting one file name decreases the ‘link count’ in the inode node by 1. When this value reaches 0, it indicates that no file names point to this inode, and the system will reclaim this inode number and its corresponding block area.

It is worth mentioning the ‘link count’ of directory files. When creating a directory, two directory entries are generated by default: ‘.’ and ‘..’. The inode number of the former is the inode number of the current directory, equivalent to a ‘hard link’ to the current directory; the inode number of the latter is the inode number of the parent directory, equivalent to a ‘hard link’ to the parent directory. Therefore, the total number of ‘hard links’ for any directory is always equal to 2 plus the total number of its subdirectories (including hidden directories), where the 2 accounts for the ‘hard link’ from the parent directory and the ‘hard link’ from the current directory’s ‘.’ entry.

7. Soft links

In addition to hard links, there is another special case. Although file A and file B have different inode numbers, the content of file A is the path to file B. When reading file A, the system automatically redirects the access to file B. Therefore, regardless of which file is opened, the content read is always that of file B. In this case, file A is referred to as a ‘soft link’ or ‘symbolic link’ to file B.

This means that file A depends on file B for its existence; if file B is deleted, opening file A will result in an error: ‘No such file or directory’. This is the biggest difference between soft links and hard links: file A points to the file name of file B, not the inode number of file B, so the ‘link count’ of file B’s inode does not change.

The ln -s command can create a soft link.

ln -s source_file_or_directory target_file_or_directory

8. Special functions of inodes

Because inode numbers are separated from file names, this mechanism leads to some Unix/Linux system-specific phenomena.
1. Sometimes, file names contain special characters that cannot be deleted normally. In this case, directly deleting the inode node can effectively delete the file.
2. Moving or renaming a file only changes the file name and does not affect the inode number.
3. After a file is opened, the system recognizes this file by its inode number, without considering the file name. Therefore, generally speaking, the system cannot know the file name from the inode number.
This third point simplifies software updates, allowing updates to occur without shutting down the software and without needing to restart. Because the system identifies running files through inode numbers, not file names. During updates, the new version of the file is created with the same file name, generating a new inode, which does not affect the currently running file. The next time this software is run, the file name will automatically point to the new version, while the old version’s inode will be reclaimed.

9. Practical problem

When creating files in the /data partition of a low-configured Linux server (with limited memory and hard disk), the system prompts that there is insufficient disk space. After using the df -h command to check the disk usage, it was found that only 66% of the /data partition was used, with 12GB of remaining space, which should not cause this problem. Later, using df -i to check the index nodes (inodes) of the /data partition, it was found that they were already full (IUsed=100%), preventing the system from creating new directories and files.

To find the cause:
The /data/cache directory contained a very large number of small byte cache files, which did not occupy much block space but consumed a lot of inodes.

Solution:
1. Delete some files in the /data/cache directory to free up some inodes in the /data partition.
2. Use a soft link to connect the free partition /opt’s newcache directory to /data/cache, using /opt partition’s inodes to alleviate the inode shortage in the /data partition:

ln -s /opt/newcache /data/cache