Ext3 Journal

[mohit.saha]

Hi Everybody,

Can anyone tell me how to view the journal file in an ext3 file system?
Or how to see its size?

Thank you in advance..

[gauravbajaj]

I m not sure wheather  u can able to see journilising file................., Anyways ext3 is a filesysytem and u cn see the partotions from /etc/fstab file

/etc/fstab contains all the partitions with the file system type information...........

you can see the size of any ext3 type partions, from df -h commad

[mohit.saha]

I m not sure wheather  u can able to see journilising file................., Anyways ext3 is a filesysytem and u cn see the partotions from /etc/fstab file

/etc/fstab contains all the partitions with the file system type information...........

you can see the size of any ext3 type partions, from df -h commad

I was not asking about the ext3 filesystems information. I was asking about the .journal file and how to view its contents..

Anyways, What i have done is

Code: [Select]

$tune2fs -l /dev/hda2            (This is where i have my ext3 partition)

and through that i found out the inode number of the journal file i.e 8. The following is the output of tune2fs

Code: [Select]

tune2fs 1.39 (29-May-2006)
Filesystem volume name:   /ext3fs1
Last mounted on:          <not available>
Filesystem UUID:          18f47a23-d12e-4206-8a0c-e15e1abf5936
Filesystem magic number:  0xEF53
Filesystem revision #:    1 (dynamic)
Filesystem features:      has_journal ext_attr resize_inode dir_index filetype needs_recovery sparse_super large_file
Default mount options:    user_xattr acl
Filesystem state:         clean
Errors behavior:          Continue
Filesystem OS type:       Linux
Inode count:              6469056
Block count:              6468170
Reserved block count:     323408
Free blocks:              6221533
Free inodes:              6469045
First block:              0
Block size:               4096
Fragment size:            4096
Reserved GDT blocks:      1022
Blocks per group:         32768
Fragments per group:      32768
Inodes per group:         32672
Inode blocks per group:   1021
Filesystem created:       Wed May  7 10:02:02 2008
Last mount time:          Wed May  7 10:43:34 2008
Last write time:          Wed May  7 10:43:34 2008
Mount count:              5
Maximum mount count:      -1
Last checked:             Wed May  7 10:02:02 2008
Check interval:           0 (<none>)
Reserved blocks uid:      0 (user root)
Reserved blocks gid:      0 (group root)
First inode:              11
Inode size:               128
Journal inode:            8
Default directory hash:   tea
Directory Hash Seed:      79e25347-d41b-4f7b-9de4-7966af814566
Journal backup:           inode blocks


as can be seen from the output the inode of the journal is given as 8. So then i used debug and stat command

Code: [Select]

$debugfs /dev/hda2
debugfs 1.39 (29-May-2006)
debugfs:  stat <8>
Inode: 8   Type: regular    Mode:  0600   Flags: 0x0   Generation: 0
User:     0   Group:     0   Size: 134217728
File ACL: 0    Directory ACL: 0
Links: 1   Blockcount: 262416
Fragment:  Address: 0    Number: 0    Size: 0
ctime: 0x482139b0 -- Wed May  7 10:40:08 2008
atime: 0x00000000 -- Thu Jan  1 05:30:00 1970
mtime: 0x482139b0 -- Wed May  7 10:40:08 2008
BLOCKS:
(0-11):2054-2065, (IND):2066, (12-1035):2067-3090, (DIND):3091, (IND):3092, (1036-2059):3093-4116, (IND):4117, (2060-3083):4118-5141, (IND):5142, (3084-4107)
:5143-6166, (IND):6167, (4108-5131):6168-7191, (IND):7192, (5132-6155):7193-8216, (IND):8217, (6156-7179):8218-9241, (IND):9242, (7180-8203):9243-10266, (IND
):10267, (8204-9227):10268-11291, (IND):11292, (9228-10251):11293-12316, (IND):12317, (10252-11275):12318-13341, (IND):13342, (11276-12299):13343-14366, (IND
):14367, (12300-13323):14368-15391, (IND):15392, (13324-14347):15393-16416, (IND):16417, (14348-15371):16418-17441, (IND):17442, (15372-16395):17443-18466, (
IND):18467, (16396-17419):18468-19491, (IND):19492, (17420-18443):19493-20516, (IND):20517, (18444-19467):20518-21541, (IND):21542, (19468-20491):21543-22566
, (IND):22567, (20492-21515):22568-23591, (IND):23592, (21516-22539):23593-24616, (IND):24617, (22540-23563):24618-25641, (IND):25642, (23564-24587):25643-26
666, (IND):26667, (24588-25611):26668-27691, (IND):27692, (25612-26635):27693-28716, (IND):28717, (26636-27659):28718-29741, (IND):29742, (27660-28683):29743
-30766, (IND):30767, (28684-29707):30768-31791, (IND):31792, (29708-30682):31793-32767, (30683-30731):34816-34864, (IND):34865, (30732-31755):34866-35889, (I
ND):35890, (31756-32768):35891-36903
TOTAL: 32802

from here i get the size in bytes i.e. 134217728 which comes out to be 128MB...

1st Question: Is there any way to see the contents of the blocks directly?

Now comes the dumping of journal... I dumped it using logdump inside debugfs and following is the output..

Code: [Select]

debugfs 1.39 (29-May-2006)
debugfs:  logdump
Journal starts at block 1, transaction 2
Found expected sequence 2, type 1 (descriptor block) at block 1
Found expected sequence 2, type 2 (commit block) at block 3
Found expected sequence 3, type 1 (descriptor block) at block 4
Found expected sequence 3, type 2 (commit block) at block 6
Found expected sequence 4, type 1 (descriptor block) at block 7
Found expected sequence 4, type 2 (commit block) at block 9
Found expected sequence 5, type 1 (descriptor block) at block 10
Found expected sequence 5, type 2 (commit block) at block 12
Found expected sequence 6, type 1 (descriptor block) at block 13
Found expected sequence 6, type 2 (commit block) at block 15
Found expected sequence 7, type 1 (descriptor block) at block 16
Found expected sequence 7, type 2 (commit block) at block 18
Found expected sequence 8, type 1 (descriptor block) at block 19
Found expected sequence 8, type 2 (commit block) at block 21
Found expected sequence 9, type 1 (descriptor block) at block 22
Found expected sequence 9, type 2 (commit block) at block 24
Found expected sequence 10, type 1 (descriptor block) at block 25
Found expected sequence 10, type 2 (commit block) at block 35
Found expected sequence 11, type 1 (descriptor block) at block 36
Found expected sequence 11, type 2 (commit block) at block 44
Found expected sequence 12, type 1 (descriptor block) at block 45
Found expected sequence 12, type 2 (commit block) at block 47
Found expected sequence 13, type 2 (commit block) at block 48
Found expected sequence 14, type 1 (descriptor block) at block 49
Found expected sequence 14, type 2 (commit block) at block 51
Found expected sequence 15, type 1 (descriptor block) at block 52
Found expected sequence 15, type 2 (commit block) at block 54
Found expected sequence 16, type 1 (descriptor block) at block 55
Found expected sequence 16, type 2 (commit block) at block 57
Found expected sequence 17, type 1 (descriptor block) at block 58
Found expected sequence 17, type 2 (commit block) at block 61
Found expected sequence 18, type 1 (descriptor block) at block 62
Found expected sequence 18, type 2 (commit block) at block 65
No magic number at block 66: end of journal.

Now the 2nd question: How to interpret the journal dump?

[dragoncity99]

You cant basically see this ext3 journal "files" as if it is a file.

It's not a file, but a metadata (stored in a defined data structure) in binary format which only the ext3 module itself can understand. Simply to say, if u want to know inside the meaning of it as equivalent to ur first 512bytes in the bootsector MBR, sorry to say that, it's quite tough, unless u have gone through the code and documentation of ext3 specs.

For 512bytes in MBR, we will need to refer to the documentation and specs right?

Same goes here for ext3 file system. I looked at the partimage.org sourced before which uses ext3 and other filesystems code and datastructure and how it is implemented. Probably u can take a look there too.

Hope that helps. Cheers.