Live data from Hacker News

What is the purpose of the lost+found folder in Linux and Unix? (2014)

unix.stackexchange.com

61–70 of 95 posts

Re: What is the purpose of the lost+found folder in Linux and Unix? (2014)

#61

lost+found is the Thumbs.db and .DS_Store of Linux

Not really, as it's only once per file system mount, whereas those Windows and MacOS files are sprinkled in most directories with images and almost every non-network drive directory respectively.

I think it’s more akin to the Recovered Items (or something like that) folder that shows up in your home directory sometimes (but maybe not anymore?)

Re: What is the purpose of the lost+found folder in Linux and Unix? (2014)

#62
post #21

I have a book on my bookshelf, Eric Foxley's Unix for Super-Users . It was published in 1985, and it answers this question on page 52, the first page listed for the entry 'lost+found' in its index. This is surely not the earliest book mention, is it? (It'll be in earlier man pages, of course.) Google Books does not give me an earlier one, although it does yield another 1985 book. Fun fact: Foxley cautioned that lost+…

How do you size a directory? Just by creating entries in it and then unlinking them?

From memory mklost+found did exactly this

Re: What is the purpose of the lost+found folder in Linux and Unix? (2014)

#63
post #45

Earlier quoted context omitted.

"check forced", as though the machine is advising me to go look at some daemon named forced.

Forced sounds like a systemd service for Jedi stuff.

These are not the inodes you're fscking for.

Re: What is the purpose of the lost+found folder in Linux and Unix? (2014)

#64

lost+found is the Thumbs.db and .DS_Store of Linux

More like a FOUND.000 folder or a root directory filled with .CHK files

I was thinking that it’s been a while since I saw those file names… but I guess your username checks out :)

Re: What is the purpose of the lost+found folder in Linux and Unix? (2014)

#65
post #54
post #42

Earlier quoted context omitted.

XFS as implemented in RHEL8+ (the only places i've used it in anger) tends to handle being full very badly, leading to system lockups and blocked tasks necessitating a hard reboot. Worse yet is when it's in this state the journal fills and nothing can be done with the volume. To recover from this on a volume mounted at boot mandates going to either a live disk, or stopping boot in initramfs and running xfs_repair the…

XFS tip: If you truncate a file it doesn't update metadata. That's how you can get back space for the journal log to start cleaning up crap without rebooting the box and/or taking services down.

Thank you, I’ll keep this in my hat for the next time.

Re: What is the purpose of the lost+found folder in Linux and Unix? (2014)

#66
post #54
post #42

Earlier quoted context omitted.

XFS as implemented in RHEL8+ (the only places i've used it in anger) tends to handle being full very badly, leading to system lockups and blocked tasks necessitating a hard reboot. Worse yet is when it's in this state the journal fills and nothing can be done with the volume. To recover from this on a volume mounted at boot mandates going to either a live disk, or stopping boot in initramfs and running xfs_repair the…

XFS tip: If you truncate a file it doesn't update metadata. That's how you can get back space for the journal log to start cleaning up crap without rebooting the box and/or taking services down.

My initialisation script creates five 100M files in /root (which is on /) to give something to manually delete for breathing room.

Re: What is the purpose of the lost+found folder in Linux and Unix? (2014)

#67
post #62

Earlier quoted context omitted.

How do you size a directory? Just by creating entries in it and then unlinking them?

From memory mklost+found did exactly this

It did.

Foxley gives the manual procedure for sizing the lost+found directory on the aforementioned page 52.

I have the 1986 edition of Fielder's and Hunter's UNIX System Administration and it does not mention any such command in its discussion of lost+found in chapter 3. It references AT&T Unix System 5 Release 2 (or 'UNIX 5.2' as the book puts it).

But Google Books tells me that their later 1991 update, referencing Release 4 and with an updated title to match, does indeed mention mklost+found. So that looks like something that appeared in Release 3 or 4.

Re: What is the purpose of the lost+found folder in Linux and Unix? (2014)

#68
post #43

Why can't a filesystem create the lost+found folder only when it needs to store files in it? That would be a much cleaner approach, imho. Added benefit is that you'd immediately see it if something is wrong with a disk.

Chicken and egg problem.

On the UFS and suchlike filesystems, at the point that fsck is rescuing orphaned i-nodes, it still has not fully gone through the process of checking and correcting free list information, or indeed fully eliminating errors from the i-node table. Creating a directory involves allocating a new i-node from an unused slot, and free blocks off the free block list.

Ironically, because they are slightly or grossly different to Unix filesystem formats, on HPFS and FAT this is less of an issue. (FAT usually has unused slots in the root directory that it is sane to use at that point, for example.) CHKDSK on OS/2 did create its \FOUND.nnn files on the fly.

Re: What is the purpose of the lost+found folder in Linux and Unix? (2014)

#69
post #42

Earlier quoted context omitted.

XFS filesystems do not have a "/lost+found" directory in their normal state. In the very rare occasions when one has to run "xfs_repair", it will create a "/lost+found" directory, if it is required for recovered files. After the repair and after investigating whether the recovered files contain useful data or not (and after moving the useful files elsewhere), one should normally delete the "/lost+found" directory, be…

XFS as implemented in RHEL8+ (the only places i've used it in anger) tends to handle being full very badly, leading to system lockups and blocked tasks necessitating a hard reboot. Worse yet is when it's in this state the journal fills and nothing can be done with the volume. To recover from this on a volume mounted at boot mandates going to either a live disk, or stopping boot in initramfs and running xfs_repair the…

The last time when I have used RHEL was decades ago, so I do not have any idea about what happens there.

On the other hand, I have been using XFS since 2005 (since when I have transitioned from 32-bit Linux to 64-bit Linux), on a great variety of hardware systems, servers, desktops, mini-PCs, laptops.

My file systems are typically mostly full and from time to time I had incidents when some job failed by filling completely the file system and no longer having any space left for writing the remainder of the files being written.

Filling completely the HDD or SSD has never caused any problems. I have always just deleted some files or moved some files to other file systems, and I have continued working. Sometimes I had some downloading in progress, which was halted by the browser because of full disk, and in such cases, after making space, I just resumed the download in the browser.

So I am puzzled by your experience, but I am not very surprised because in Linux there are many obscure configuration options, so the behavior can vary a lot between distributions (I typically use Gentoo). Perhaps your problems were caused by certain daemons that were continuing to make write attempts in the background, which I do not have.

The only problems that I have ever encountered in XFS happened only in early XFS, i.e. 2 decades ago, which was extremely sensitive to power failures, despite being a journaled filesystem. In early XFS, after a power failure, some previously open files were erased, even if they had been open only for reading. Because of this, a power failure frequently bricked the system, by erasing "/etc/fstab".

However, this stupid XFS feature has been corrected many years ago and nowadays power failures normally do not have any effect on XFS, i.e. xfs_repair is normally not needed, even after power failures. That was a bug at the conceptual level, not at the programming level, because the erasure of some files in early XFS was intentional, because it wrongly concluded that they might have been corrupted.

While early XFS was notorious for its fragility against power failures, at that time none of the competing file systems was significantly better, all were buggy. Around the same time, more than two decades ago, I have seen a lot of other filesystems corrupted by power failures, regardless whether they were Windows NTFS or Linux EXT3 or JFS, despite the fact that all were advertised as being resistant to power failures by being journaled. At that time, only one filesystem was completely impervious to power failures, and it was non-journaled, the FreeBSD UFS with "soft updates" (i.e. with a careful ordering of the disk writes, to maintain a consistent state across power failures).

Re: What is the purpose of the lost+found folder in Linux and Unix? (2014)

#70

Earlier quoted context omitted.

More like a FOUND.000 folder or a root directory filled with .CHK files

I was thinking that it’s been a while since I saw those file names… but I guess your username checks out :)

You can even tell which operating systems xe has used. Both of those are very specific. The \FOUND.nnn directories are something that IBM/Microsoft introduced when they re-did CHKDSK for OS/2, which was what Windows NT inherited. FILEnnnn.CHK in the root directory was the old Microsoft CHKDSK, and also Symantec/Norton SCANDISK, for MS/PC/DR-DOS.
Post reply on HN