The SGI XFS Filesystem¶
XFS is a high performance journaling filesystem which originatedon the SGI IRIX platform. It is completely multi-threaded, cansupport large files and large filesystems, extended attributes,variable block sizes, is extent based, and makes extensive use ofBtrees (directories, extents, free space) to aid both performanceand scalability.
Refer to the documentation athttps://xfs.wiki.kernel.org/for further details. This implementation is on-disk compatiblewith the IRIX version of XFS.
Mount Options¶
When mounting an XFS filesystem, the following options are accepted.
- allocsize=size
Sets the buffered I/O end-of-file preallocation size whendoing delayed allocation writeout (default size is 64KiB).Valid values for this option are page size (typically 4KiB)through to 1GiB, inclusive, in power-of-2 increments.
The default behaviour is for dynamic end-of-filepreallocation size, which uses a set of heuristics tooptimise the preallocation size based on the currentallocation patterns within the file and the access patternsto the file. Specifying a fixed
allocsizevalue turns offthe dynamic behaviour.- discard or nodiscard (default)
Enable/disable the issuing of commands to let the blockdevice reclaim space freed by the filesystem. This isuseful for SSD devices, thinly provisioned LUNs and virtualmachine images, but may have a performance impact.
Note: It is currently recommended that you use the
fstrimapplication todiscardunused blocks rather than thediscardmount option because the performance impact of this optionis quite severe.- grpid/bsdgroups or nogrpid/sysvgroups (default)
These options define what group ID a newly created filegets. When
grpidis set, it takes the group ID of thedirectory in which it is created; otherwise it takes thefsgidof the current process, unless the directory has thesetgidbit set, in which case it takes thegidfrom theparent directory, and also gets thesetgidbit set if it isa directory itself.- filestreams
Make the data allocator use the filestreams allocation modeacross the entire filesystem rather than just on directoriesconfigured to use it.
- inode32 or inode64 (default)
When
inode32is specified, it indicates that XFS limitsinode creation to locations which will not result in inodenumbers with more than 32 bits of significance.When
inode64is specified, it indicates that XFS is allowedto create inodes at any location in the filesystem,including those which will result in inode numbers occupyingmore than 32 bits of significance.
inode32is provided for backwards compatibility with oldersystems and applications, since 64 bits inode numbers mightcause problems for some applications that cannot handlelarge inode numbers. If applications are in use which donot handle inode numbers bigger than 32 bits, theinode32option should be specified.- largeio or nolargeio (default)
If
nolargeiois specified, the optimal I/O reported inst_blksizebystat(2) will be as small as possible to allowuser applications to avoid inefficient read/modify/writeI/O. This is typically the page size of the machine, asthis is the granularity of the page cache.If
largeiois specified, a filesystem that was created with aswidthspecified will return theswidthvalue (in bytes)inst_blksize. If the filesystem does not have aswidthspecified but does specify anallocsizethenallocsize(in bytes) will be returned instead. Otherwise the behaviouris the same as ifnolargeiowas specified.- logbufs=value
Set the number of in-memory log buffers. Valid numbersrange from 2-8 inclusive.
The default value is 8 buffers.
If the memory cost of 8 log buffers is too high on smallsystems, then it may be reduced at some cost to performanceon metadata intensive workloads. The
logbsizeoption belowcontrols the size of each buffer and so is also relevant tothis case.- lifetime (default) or nolifetime
Enable data placement based on write life time hints providedby the user. This turns on co-allocation of data of similarlife times when statistically favorable to reduce garbagecollection cost.
These options are only available for zoned rt file systems.
- logbsize=value
Set the size of each in-memory log buffer. The size may bespecified in bytes, or in kilobytes with a “k” suffix.Valid sizes for version 1 and version 2 logs are 16384 (16k)and 32768 (32k). Valid sizes for version 2 logs alsoinclude 65536 (64k), 131072 (128k) and 262144 (256k). Thelogbsize must be an integer multiple of the logstripe unit configured atmkfs(8) time.
The default value for version 1 logs is 32768, while thedefault value for version 2 logs is MAX(32768, log_sunit).
- logdev=device and rtdev=device
Use an external log (metadata journal) and/or real-time device.An XFS filesystem has up to three parts: a data section, a logsection, and a real-time section. The real-time section isoptional, and the log section can be separate from the datasection or contained within it.
- max_atomic_write=value
Set the maximum size of an atomic write. The size may bespecified in bytes, in kilobytes with a “k” suffix, in megabyteswith a “m” suffix, or in gigabytes with a “g” suffix. The sizecannot be larger than the maximum write size, larger than thesize of any allocation group, or larger than the size of aremapping operation that the log can complete atomically.
The default value is to set the maximum I/O completion sizeto allow each CPU to handle one at a time.
- max_open_zones=value
Specify the max number of zones to keep open for writing on azoned rt device. Many open zones aids file data separationbut may impact performance on HDDs.
If
max_open_zonesis not specified, the value is determinedby the capabilities and the size of the zoned rt device.- noalign
Data allocations will not be aligned at stripe unitboundaries. This is only relevant to filesystems createdwith non-zero data alignment parameters (
sunit,swidth) bymkfs(8).- norecovery
The filesystem will be mounted without running log recovery.If the filesystem was not cleanly unmounted, it is likely tobe inconsistent when mounted in
norecoverymode.Some files or directories may not be accessible because of this.Filesystems mountednorecoverymust be mounted read-only orthe mount will fail.- nouuid
Don’t check for double mounted file systems using the filesystem
uuid. This is useful to mount LVM snapshot volumes,and often used in combination withnorecoveryfor mountingread-only snapshots.- noquota
Forcibly turns off all quota accounting and enforcementwithin the filesystem.
- uquota/usrquota/uqnoenforce/quota
User disk quota accounting enabled, and limits (optionally)enforced. Refer toxfs_quota(8) for further details.
- gquota/grpquota/gqnoenforce
Group disk quota accounting enabled and limits (optionally)enforced. Refer toxfs_quota(8) for further details.
- pquota/prjquota/pqnoenforce
Project disk quota accounting enabled and limits (optionally)enforced. Refer toxfs_quota(8) for further details.
- sunit=value and swidth=value
Used to specify the stripe unit and width for a RAID deviceor a stripe volume. “value” must be specified in 512-byteblock units. These options are only relevant to filesystemsthat were created with non-zero data alignment parameters.
The
sunitandswidthparameters specified must be compatiblewith the existing filesystem alignment characteristics. Ingeneral, that means the only valid changes tosunitareincreasing it by a power-of-2 multiple. Validswidthvaluesare any integer multiple of a validsunitvalue.Typically the only time these mount options are necessary ifafter an underlying RAID device has had its geometrymodified, such as adding a new disk to a RAID5 lun andreshaping it.
- swalloc
Data allocations will be rounded up to stripe width boundarieswhen the current end of file is being extended and the filesize is larger than the stripe width size.
- wsync
When specified, all filesystem namespace operations areexecuted synchronously. This ensures that when the namespaceoperation (create, unlink, etc) completes, the change to thenamespace is on stable storage. This is useful in HA setupswhere failover must not result in clients seeinginconsistent namespace presentation during or after afailover event.
Deprecation of V4 Format¶
The V4 filesystem format lacks certain features that are supported bythe V5 format, such as metadata checksumming, strengthened metadataverification, and the ability to store timestamps past the year 2038.Because of this, the V4 format is deprecated. All users should upgradeby backing up their files, reformatting, and restoring from the backup.
Administrators and users can detect a V4 filesystem by running xfs_infoagainst a filesystem mountpoint and checking for a string containing“crc=”. If no such string is found, please upgrade xfsprogs to thelatest version and try again.
The deprecation will take place in two parts. Support for mounting V4filesystems can now be disabled at kernel build time via Kconfig option.These options were changed to default to no in September 2025. InSeptember 2030, support will be removed from the codebase entirely.
Note: Distributors may choose to withdraw V4 format support earlier thanthe dates listed above.
Deprecated Mount Options¶
Name | Removal Schedule |
|---|---|
Mounting with V4 filesystem | September 2030 |
Mounting ascii-ci filesystem | September 2030 |
Removed Mount Options¶
Name | Removed |
|---|---|
delaylog/nodelaylog | v4.0 |
ihashsize | v4.0 |
irixsgid | v4.0 |
osyncisdsync/osyncisosync | v4.0 |
barrier | v4.19 |
nobarrier | v4.19 |
ikeep/noikeep | v6.18 |
attr2/noattr2 | v6.18 |
sysctls¶
The following sysctls are available for the XFS filesystem:
- fs.xfs.stats_clear (Min: 0 Default: 0 Max: 1)
Setting this to “1” clears accumulated XFS statisticsin /proc/fs/xfs/stat. It then immediately resets to “0”.
- fs.xfs.xfssyncd_centisecs (Min: 100 Default: 3000 Max: 720000)
The interval at which the filesystem flushes metadataout to disk and runs internal cache cleanup routines.
- fs.xfs.filestream_centisecs (Min: 1 Default: 3000 Max: 360000)
The interval at which the filesystem ages filestreams cachereferences and returns timed-out AGs back to the free streampool.
- fs.xfs.speculative_prealloc_lifetime
(Units: seconds Min: 1 Default: 300 Max: 86400)The interval at which the background scanning for inodeswith unused speculative preallocation runs. The scanremoves unused preallocation from clean inodes and releasesthe unused space back to the free pool.
- fs.xfs.error_level (Min: 0 Default: 3 Max: 11)
A volume knob for error reporting when internal errors occur.This will generate detailed messages & backtraces for filesystemshutdowns, for example. Current threshold values are:
XFS_ERRLEVEL_OFF: 0XFS_ERRLEVEL_LOW: 1XFS_ERRLEVEL_HIGH: 5
- fs.xfs.panic_mask (Min: 0 Default: 0 Max: 511)
Causes certain error conditions to call
BUG(). Value is a bitmask;OR together the tags which represent errors which should cause panics:XFS_NO_PTAG 0XFS_PTAG_IFLUSH 0x00000001XFS_PTAG_LOGRES 0x00000002XFS_PTAG_AILDELETE 0x00000004XFS_PTAG_ERROR_REPORT 0x00000008XFS_PTAG_SHUTDOWN_CORRUPT 0x00000010XFS_PTAG_SHUTDOWN_IOERROR 0x00000020XFS_PTAG_SHUTDOWN_LOGERROR 0x00000040XFS_PTAG_FSBLOCK_ZERO 0x00000080XFS_PTAG_VERIFIER_ERROR 0x00000100
This option is intended for debugging only.
- fs.xfs.inherit_sync (Min: 0 Default: 1 Max: 1)
Setting this to “1” will cause the “sync” flag setby thexfs_io(8) chattr command on a directory to beinherited by files in that directory.
- fs.xfs.inherit_nodump (Min: 0 Default: 1 Max: 1)
Setting this to “1” will cause the “nodump” flag setby thexfs_io(8) chattr command on a directory to beinherited by files in that directory.
- fs.xfs.inherit_noatime (Min: 0 Default: 1 Max: 1)
Setting this to “1” will cause the “noatime” flag setby thexfs_io(8) chattr command on a directory to beinherited by files in that directory.
- fs.xfs.inherit_nosymlinks (Min: 0 Default: 1 Max: 1)
Setting this to “1” will cause the “nosymlinks” flag setby thexfs_io(8) chattr command on a directory to beinherited by files in that directory.
- fs.xfs.inherit_nodefrag (Min: 0 Default: 1 Max: 1)
Setting this to “1” will cause the “nodefrag” flag setby thexfs_io(8) chattr command on a directory to beinherited by files in that directory.
- fs.xfs.rotorstep (Min: 1 Default: 1 Max: 256)
In “inode32” allocation mode, this option determines how manyfiles the allocator attempts to allocate in the same allocationgroup before moving to the next allocation group. The intentis to control the rate at which the allocator moves betweenallocation groups when allocating extents for new files.
Deprecated Sysctls¶
None currently.
Removed Sysctls¶
Name | Removed |
|---|---|
fs.xfs.xfsbufd_centisec | v4.0 |
fs.xfs.age_buffer_centisecs | v4.0 |
fs.xfs.irix_symlink_mode | v6.18 |
fs.xfs.irix_sgid_inherit | v6.18 |
fs.xfs.speculative_cow_prealloc_lifetime | v6.18 |
Error handling¶
XFS can act differently according to the type of error found during itsoperation. The implementation introduces the following concepts to the errorhandler:
- -failure speed:
Defines how fast XFS should propagate an error upwards when a specificerror is found during the filesystem operation. It can propagateimmediately, after a defined number of retries, after a set time period,or simply retry forever.
- -error classes:
Specifies the subsystem the error configuration will apply to, such asmetadata IO or memory allocation. Different subsystems will havedifferent error handlers for which behaviour can be configured.
- -error handlers:
Defines the behavior for a specific error.
The filesystem behavior during an error can be set viasysfs files. Eacherror handler works independently - the first condition met by an error handlerfor a specific class will cause the error to be propagated rather than reset andretried.
The action taken by the filesystem when the error is propagated is contextdependent - it may cause a shut down in the case of an unrecoverable error,it may be reported back to userspace, or it may even be ignored becausethere’s nothing useful we can with the error or anyone we can report it to (e.g.during unmount).
The configuration files are organized into the following hierarchy for eachmounted filesystem:
/sys/fs/xfs/<dev>/error/<class>/<error>/
- Where:
- <dev>
The short device name of the mounted filesystem. This is the same devicename that shows up in XFS kernel error messages as “XFS(<dev>): ...”
- <class>
The subsystem the error configuration belongs to. As of 4.9, the definedclasses are:
“metadata”: applies metadata buffer write IO
- <error>
The individual error handler configurations.
Each filesystem has “global” error configuration options defined in their toplevel directory:
/sys/fs/xfs/<dev>/error/
- fail_at_unmount (Min: 0 Default: 1 Max: 1)
Defines the filesystem error behavior at unmount time.
If set to a value of 1, XFS will override all other error configurationsduring unmount and replace them with “immediate fail” characteristics.i.e. no retries, no retry timeout. This will always allow unmount tosucceed when there are persistent errors present.
If set to 0, the configured retry behaviour will continue until allretries and/or timeouts have been exhausted. This will delay unmountcompletion when there are persistent errors, and it may prevent thefilesystem from ever unmounting fully in the case of “retry forever”handler configurations.
Note: there is no guarantee that fail_at_unmount can be set while anunmount is in progress. It is possible that the
sysfsentries areremoved by the unmounting filesystem before a “retry forever” errorhandler configuration causes unmount to hang, and hence the filesystemmust be configured appropriately before unmount begins to preventunmount hangs.
Each filesystem has specific error class handlers that define the errorpropagation behaviour for specific errors. There is also a “default” errorhandler defined, which defines the behaviour for all errors that don’t havespecific handlers defined. Where multiple retry constraints are configured fora single error, the first retry configuration that expires will cause the errorto be propagated. The handler configurations are found in the directory:
/sys/fs/xfs/<dev>/error/<class>/<error>/
- max_retries (Min: -1 Default: Varies Max: INTMAX)
Defines the allowed number of retries of a specific error beforethe filesystem will propagate the error. The retry count for a givenerror context (e.g. a specific metadata buffer) is reset every timethere is a successful completion of the operation.
Setting the value to “-1” will cause XFS to retry forever for thisspecific error.
Setting the value to “0” will cause XFS to fail immediately when thespecific error is reported.
Setting the value to “N” (where 0 < N < Max) will make XFS retry theoperation “N” times before propagating the error.
- retry_timeout_seconds (Min: -1 Default: Varies Max: 1 day)
Define the amount of time (in seconds) that the filesystem isallowed to retry its operations when the specific error isfound.
Setting the value to “-1” will allow XFS to retry forever for thisspecific error.
Setting the value to “0” will cause XFS to fail immediately when thespecific error is reported.
Setting the value to “N” (where 0 < N < Max) will allow XFS to retry theoperation for up to “N” seconds before propagating the error.
Note: The default behaviour for a specific error handler is dependent on boththe class and error context. For example, the default values for“metadata/ENODEV” are “0” rather than “-1” so that this error handler defaultsto “fail immediately” behaviour. This is done because ENODEV is a fatal,unrecoverable error no matter how many times the metadata IO is retried.
Workqueue Concurrency¶
XFS uses kernel workqueues to parallelize metadata update processes. Thisenables it to take advantage of storage hardware that can service many IOoperations simultaneously. This interface exposes internal implementationdetails of XFS, and as such is explicitly not part of any userspace API/ABIguarantee the kernel may give userspace. These are undocumented features ofthe generic workqueue implementation XFS uses for concurrency, and they areprovided here purely for diagnostic and tuning purposes and may change at anytime in the future.
The control knobs for a filesystem’s workqueues are organized by task at handand the short name of the data device. They all can be found in:
/sys/bus/workqueue/devices/${task}!${device}
Task | Description |
|---|---|
xfs_iwalk-$pid | Inode scans of the entire filesystem. Currently limited tomount time quotacheck. |
xfs-gc | Background garbage collection of disk space that have beenspeculatively allocated beyond EOF or for staging copy onwrite operations. |
For example, the knobs for the quotacheck workqueue for /dev/nvme0n1 would befound in /sys/bus/workqueue/devices/xfs_iwalk-1111!nvme0n1/.
The interesting knobs for XFS workqueues are as follows:
Knob | Description |
|---|---|
max_active | Maximum number of background threads that can be started torun the work. |
cpumask | CPUs upon which the threads are allowed to run. |
nice | Relative priority of scheduling the threads. These are thesame nice levels that can be applied to userspace processes. |
Zoned Filesystems¶
For zoned file systems, the following attributes are exposed in:
/sys/fs/xfs/<dev>/zoned/
- max_open_zones (Min: 1 Default: Varies Max: UINTMAX)
This read-only attribute exposes the maximum number of open zonesavailable for data placement. The value is determined at mount time andis limited by the capabilities of the backing zoned device, file systemsize and the max_open_zones mount option.
- zonegc_low_space (Min: 0 Default: 0 Max: 100)
Define a percentage for how much of the unused space that GC should keepavailable for writing. A high value will reclaim more of the spaceoccupied by unused blocks, creating a larger buffer against writebursts at the cost of increased write amplification. Regardlessof this value, garbage collection will always aim to free a minimumamount of blocks to keep max_open_zones open for data placement purposes.