31

I understand what an inode is but what is the exact definition of an orphaned inode? I don't really get what that means.

UPDATE

There was a time that a server I was managing ran out of inodes but when I would do a df -h it showed me that the server only had 60% space used up. I'm guessing this is because of orphaned inodes. How can all the inodes be used up but there's still "space" left on the server? Can you address this in your answers?

ninjacoder
  • 411
  • 3
    Your update is a separate question really, to do with the difference between a filesystem's storage capacity and the number of inodes it can contain; you should ask it as a separate question. – Stephen Kitt Jun 16 '16 at 10:51
  • Running df -i will show the corresponding info for inodes. – Kusalananda Jun 16 '16 at 12:11
  • Disk free/used space is only slightly correlated with free/used inodes. A disk with many small files will run out of inodes before it runs out of space. – Kusalananda Jun 16 '16 at 12:15

3 Answers3

28

An orphaned inode is an inode which isn't attached to a directory entry in the filesystem, which means it can't be reached.

Orphaned inodes can appear for a number of reasons:

  • temporary files which are deleted but kept open (a common practice) occupy inodes on the filesystem; if the system reboots without shutting down properly, these inodes remain and are orphaned
  • filesystem corruption may corrupt a directory without affecting the inodes of the files the directory contains; these inodes are then orphaned

fsck creates new directory entries for orphaned inodes in lost+found.

Stephen Kitt
  • 434,908
  • Thanks for your answer @stephen-kitt. There was a time that a server I was managing ran out of inodes but when I would do a df -h it showed me that the server only had 60% space used up. I'm guessing this is because of orphaned inodes. How can all the inodes be used up but there's still "space" left on the server? – ninjacoder Jun 16 '16 at 10:14
8

An orphaned inode is a file that is “semi-deleted”: it has no more directory entry, but it's still open in some process, so the data is still present on the disk. When the last process that has this file open closes it, the file will be fully deleted and the orphaned inode will disappear.

An orphaned inode uses both an inode and the disk space to store the file, so both df and df -i count it as used. Thus, if the disk is reported as full but df shows some space left, this can't be related to orphaned inodes. Orphaned inodes are one of the reasons why the filesystem usage reported by df and the total file size reported by du can differ; see Why are there so many different ways to measure disk usage? for more details on this topic.

Many filesystems reserved a fixed number of inodes when the filesystem is created, meaning that you can have at most that many files on the filesystem. The number of inodes is a compromise between the space used by the inodes and the ability to create many files. If there is no more space on the filesystem, then you can't grow existing files or create new files (perhaps you can still create some empty files in existing directories, as long as they're only filling up partially-used blocks and not requiring a new block to be allocated). If there is no more free inode, you can grow existing files but you can't create a new file.

The kernel reports the same error to applications whether a filesystem is full due to a lack of data space or due to a lack of inodes. So you can get a “disk full” error even if there's some data space left, if the operation required a new inode and the inode table is full. Run df -i to know how many inodes are used and how many are left.

Community
  • 1
Gilles 'SO- stop being evil'
  • 829,060
1

  • An orphaned inode is one that has been unlinked but is still open in another process. For example running tail -f {file} in one shell followed by rm {file} in another. The filesystem keeps track of these so they can be cleaned up when the process quits.

  • It's perfectly normal whenever you have an unclean dismount. They are simply files that had been deleted, but were still open when the fs was remounted read only. They are not the cause, but merely a symptoms.

For inode issue, run this query to get the list of how much inodes being used in all directories 

for i in `find . -type d `; do echo `ls -a $i | wc -l` $i; done | sort -n

You can refer to this and this for more method to check.

Community
  • 1
Rahul
  • 13,589