TIBCO LogLogic LMI - Explanation for why some directories possess a size of 4KB based on ls -la output
book
Article ID: KB0077073
calendar_today
Updated On:
Products
Versions
TIBCO LogLogic Enterprise Virtual Appliance
all versions
Description
When running an ls -la command in a particular directory, you will generally see output like the following, obviously dependent on where you run it:
Logapp root:/loglogic/data 0$ ls -la total 188800 drwxr-xr-x 37 mysql users 4096 Sep 12 14:59 . drwxrwxr-x 35 root root 4096 Sep 12 14:57 .. drwxr-xr-x 2 logapp root 4096 Aug 30 2018 archive -rw-r----- 1 mysql users 56 Aug 29 11:15 auto.cnf drwxr-xr-x 6 logapp root 4096 Aug 30 2018 backup_preparation drwxr-xr-x 2 logapp logapp 4096 Aug 30 2018 bkup -rw------- 1 mysql users 1680 Aug 30 2018 ca-key.pem -rw-r--r-- 1 mysql users 1075 Aug 30 2018 ca.pem -rw-r--r-- 1 mysql users 1079 Aug 30 2018 client-cert.pem -rw------- 1 mysql users 1676 Aug 30 2018 client-key.pem drwxr-xr-x 2 root root 4096 Aug 30 2018 client_queue drwxr-x--- 2 mysql users 4096 Aug 30 2018 correlation ... ... ... -rw-r--r-- 1 root root 10 Aug 30 2018 ipaddress drwxr-x--- 2 mysql users 12288 Sep 20 00:02 ll_auth_logs drwxr-x--- 2 mysql users 4096 Aug 30 2018 ll_cached_results drwxr-x--- 2 mysql users 4096 Aug 30 2018 ll_files drwxr-x--- 2 mysql users 4096 Aug 30 2018 ll_files_in drwxr-x--- 2 mysql users 32768 Aug 30 2018 ll_firewall_logs drwxr-x--- 2 mysql users 4096 Aug 30 2018 ll_ids_logs drwxr-x--- 2 mysql users 16384 Sep 20 02:30 ll_misc_logs drwxr-x--- 2 mysql users 4096 Aug 30 2018 ll_postupgrade drwxr-x--- 2 mysql users 40960 Sep 20 00:00 ll_stats drwxr-x--- 2 mysql users 4096 Aug 30 2018 ll_temp_results drwxr-x--- 2 mysql users 4096 Aug 30 2018 ll_vpn_logs drwxr-x--- 2 mysql users 4096 Aug 30 2018 ll_www_logs drwxr-x--- 2 mysql users 20480 Sep 20 14:41 logappconfig drwxr-x--- 2 mysql users 4096 Aug 30 2018 logapplogu -rw-r----- 1 mysql users 6 Sep 12 14:59 logappmysqld.pid drwxr-x--- 2 mysql users 69632 Sep 20 16:29 logapprtrpt
The highlighted entries are directories and, as you can see, the majority have a listed size of 4096 bytes, or 4KB. Why is this?
Issue/Introduction
This article explains why the vast majority of directories show as being 4KB in size on the filesystem.
Resolution
On an ext3 or ext4 filesystem, the default inode size is 256 bytes, whilst the default block size is 4096 bytes. A directory is just a special file which contains an array of filenames and the inodes they reference, an inode being a structure on the disk that contains file attributes, metadata, and so on. When a directory is created, all it contains is one filename (actually the directory name itself), pointing to one inode (that of the directory). That inode points to a single data block, which is the minimum space that can be allocated which, as we have seen, is 4096 bytes. This is why most directories show a size of 4096 bytes when an ls -la is run - they do not contain enough data structures to require more space than the minimum amount that's allocated.
What you can see from the ls -la output above is that some directories are showing as larger than 4096 bytes, e.g.:
drwxr-x--- 2 mysql users 32768 Aug 30 2018 ll_firewall_logs drwxr-x--- 2 mysql users 16384 Sep 20 02:30 ll_misc_logs drwxr-x--- 2 mysql users 40960 Sep 20 00:00 ll_stats drwxr-x--- 2 mysql users 69632 Sep 20 16:29 logapprtrpt
What this shows is that the data structure referenced inside them requires more space than the minimum size can contain. Note as well that all the size values are multiples of the minimum block size (4096 bytes) as these are the smallest chunks that can be allocated. Checking the size of directories can be a useful troubleshooting tool, especially if you have a baseline to compare against. For example, we have often seen that file collection problems can cause the size of ll_files to grow by orders of magnitude. If we are aware of the size that it SHOULD be, it is easy to diagnose that this is an area we should focus on.