Skip to content

Chapter 6 of 8

Storage, Filesystems, and Memory

Disk management starts with discovery. lsblk lists block devices in a tree (disks, partitions, and their mount points), and lsblk -f adds the filesystem type and UUID. df -h reports free space across mounted filesystems in human-readable units, df -T includes the filesystem type, and df -i exposes inode consumption. The companion du -sh /path summarizes a directory, du -h --max-depth=1 / sizes every top-level entry, and du -ah | sort -rh | head -20 hunts for the largest files; the interactive ncdu browser provides the same data with arrow-key navigation. Mounting is performed with mount /dev/sdb1 /mnt/data (optionally specifying a type via -t ext4) and undone with umount; persistent mounts belong in /etc/fstab, whose columns are device specifier, mount point, filesystem type, options, dump flag, and fsck pass (1 for root, 2 for other, 0 to skip). The device specifier is best given as UUID= (found with blkid) because it survives drive reordering, and a syntax test runs via mount -a.

Partition tables divide a disk. MBR permits four primary partitions and tops out near 2 TiB, while GPT (GUID Partition Table) supports 128 partitions, spans 8 ZiB, includes a backup header at the disk's tail, and is required for UEFI booting. The legacy fdisk (and the modern gdisk dedicated to GPT) handles both; parted offers scriptable partitioning (parted /dev/sdb mklabel gpt followed by mkpart primary ext4 0% 100%). A fresh kernel view follows partprobe, after which mkfs.ext4, mkfs.xfs, or mkfs.btrfs formats the partition. UEFI installs additionally require an ESP (EFI System Partition) — a FAT32 partition of roughly 256–512 MB flagged as esp. When problems surface, fsck /dev/sda1 checks ext-family filesystems (with the family-specific fsck.ext4 for explicitness), xfs_repair handles XFS, and btrfs scrub start /mnt verifies all data on a btrfs filesystem. A corrupted ext4 superblock can be recovered by listing alternates with mkfs.ext4 -n /dev/sda1 and then running fsck.ext4 -b 32768 /dev/sda1 against one of them.

Three mature filesystems dominate Linux. ext4 is the default on many distributions, supports extents and journaling, can be resized online, and is maintained with e4defrag and tune2fs -l. XFS, default on RHEL, is a 64-bit high-performance journaling filesystem that excels at large files and parallel I/O; it can be grown online but cannot be shrunk. btrfs brings copy-on-write, subvolumes (btrfs subvolume create), snapshots, compression, and an integrated btrfs scrub data verifier. All three can be snapshotted independently through LVM, which abstracts physical storage into a stack of physical volumes (PVs), volume groups (VGs), and logical volumes (LVs). Setup runs pvcreate /dev/sdb, vgcreate vg0 /dev/sdb, lvcreate -L 50G -n data vg0, and finally mkfs.ext4 /dev/vg0/data; later changes include lvextend -L +10G -r /dev/vg0/data (the -r flag resizes the filesystem in lock-step), vgextend/vgreduce to add or remove disks, and status checks with pvs, vgs, and lvs. RAID complements LVM for redundancy: mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sdb /dev/sdc builds a mirror, RAID 5 tolerates one disk failure with single parity, RAID 6 with double parity, RAID 10 stripes mirrors for both speed and safety, and cat /proc/mdstat plus mdadm --detail /dev/md0 report status; mdadm --detail --scan >> /etc/mdadm/mdadm.conf persists the array layout.

Inodes track file metadata — permissions, timestamps, and block pointers — separate from filenames. df -i checks inode usage, an entirely independent constraint from blocks. When df -h shows free space yet new files cannot be created, inodes are exhausted, typically by millions of empty files in caches or session directories. Locate them with find / -xdev -type d -exec sh -c 'echo $(find "\$1" | wc -l) "\$1"' _ {} \; | sort -rn | head. Adjacent to inodes, two RAM-based filesystems offer alternatives to disk. tmpfs uses both RAM and swap, has a configurable size (mount -t tmpfs -o size=512m tmpfs /mnt/tmp), honors ownership, and shows up in df; common examples are /run, /tmp, and /dev/shm. ramfs has no size cap at all — it grows until memory is exhausted — so it must be used only where unbounded growth is genuinely safe.

Swap extends virtual memory onto disk and serves a second purpose on laptops: enabling suspend to disk. A swap file is created by allocating space (fallocate -l 2G /swapfile), restricting permissions (chmod 600), formatting (mkswap /swapfile), and activating (swapon /swapfile), with persistence added through /etc/fstab. swapon --show and free -h report current usage. The kernel's vm.swappiness tunable (read/written via /proc/sys/vm/swappiness, default 60) biases the kernel toward retaining pages in RAM or pushing them out aggressively; on servers with abundant memory, lower values are usually preferable. When memory is genuinely exhausted, the kernel relies on overcommit heuristics (vm.overcommit_memory=0) and, in the worst case, activates the OOM killer, which scores every process by oom_score_adj (range -1000 to 1000 in /proc/[pid]/oom_score_adj) and delivers SIGKILL to the worst offender; logs of the event surface in dmesg | grep -i oom or journalctl -k | grep -i oom.

All chapters
  1. 1Core Command-Line Tools and Text Processing
  2. 2The Filesystem Layout, Permissions, and Ownership
  3. 3Processes, systemd, and Scheduled Jobs
  4. 4User Administration, Security, and the Boot Process
  5. 5Networking, SSH, and Firewalls
  6. 6Storage, Filesystems, and Memory
  7. 7Shell Scripting and Package Management
  8. 8System Observability, Performance Tuning, and Containers

Drill it

Reading is not remembering. These come from the Linux Administration deck:

Q

What does the ls command do in Linux?

The ls command lists directory contents. Common flags:-l long format with permissions, owner, size, date-a show hidden files (dotfiles)-h human-readable sizes-R...

Q

How does grep search for patterns in files?

grep searches text using patterns.Usage: grep [options] pattern [file...]Key flags:-i case-insensitive-r recursive search-n show line numbers-v invert match-E e...

Q

How do you use the find command to locate files?

find searches the directory tree.Examples:find /home -name "*.txt" — find by namefind . -type f -mtime -7 — files modified in last 7 daysfind / -size +100M — fi...

Q

What is awk and how is it used for text processing?

awk is a powerful text-processing language that operates on fields and records.Examples:awk '{print $1, $3}' file — print columns 1 and 3awk -F: '{print $1}' /e...