The Accounting Ledger Analogy
Think of a bank ledger. Before a teller moves money between accounts, they write the intended transaction in a log: "Transfer $500 from Account A to Account B." If the bank loses power mid-transfer, the auditor reads the log and either completes or rolls back the transaction. No money is lost or invented.
Most modern Linux filesystems — ext4, XFS, JFS — use the same principle. They are journaling filesystems. Before making any change to the real filesystem, they write a record of the intended change to a special circular buffer called the journal (also called a write-ahead log, or WAL). This is the same concept used by databases like PostgreSQL.
How Journaling Works
The sequence for any filesystem operation (say, creating a file) is:
- Journal Write: The kernel writes a transaction record to the journal: "I intend to allocate Inode 42, update directory block 7, and write data to Block 500."
- Commit: The journal entry is flushed to disk. At this point, the intent is durable.
- Checkpoint: The kernel performs the actual filesystem changes — writes data to Block 500, updates the inode table, updates the directory.
- Journal Free: The transaction is marked complete and the journal space is reclaimed.
Crash recovery is now trivial. On reboot, the filesystem driver reads the journal:
- If a transaction has a commit record but no completion marker, it replays the transaction (redo).
- If a transaction has no commit record, it was never fully written — it is discarded (undo).
Either way, recovery takes seconds regardless of disk size, because only the journal needs to be read, not the entire disk.
Ext4 Journal Modes
Ext4 exposes three journaling modes, configurable via the data= mount option in /etc/fstab:
| Mode | What is Journaled | Safety | Performance |
|---|---|---|---|
journal |
Data AND metadata | Highest | Slowest |
ordered |
Metadata only; data written before metadata | Good (default) | Moderate |
writeback |
Metadata only; data write order uncoordinated | Lower | Fastest |
The default ordered mode is the right choice for almost all workloads. It guarantees that data blocks are written to disk before the metadata that references them, preventing the "metadata says file exists, data is garbage" scenario — without the overhead of journaling every data byte.
Interviewers sometimes ask: "What is the difference between ext3 and ext4?" A strong answer covers journaling improvements, but the deeper answer is that ext4 added extents (contiguous block ranges replacing indirect block maps), delayed allocation (batching block assignments to reduce fragmentation), and a larger maximum file/filesystem size. Journaling itself existed in ext3 — ext4 refined it and added the has_journal feature flag in the superblock.