Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Has a file system been developed that is completely safe from power failure based corruption? If we assume critical data is being stored without a UPS and performance is irrelevant, does file system exist that is completely incorruptible from a power failure?

share|improve this question

7 Answers 7

up vote 3 down vote accepted

Not really. There are several things you can do to mitigate risk, though.

  • Use a journaled filesystem (ext3, reiserfs, zfs, ntfs, etc.)
  • Make sure you're using a battery-backed raid card
  • Use a UPS, dang nabbit. If you're that worried about your data, it's worth the money. Oh, and also, make sure to set up and test the UPS's auto-shutdown feature on your server.
share|improve this answer
    
Be aware that "UPS auto shutdown" isn't usually an option if your gear is colocated. Also it's important to check your raid controller battery periodically (warnings may show up in /var/log/messages, or you may have to run a special tool to interrogate the controller). Even new batteries can suddenly stop holding a charge, and Murphy says you'll have power problems right after the battery goes flat. –  voretaq7 Feb 4 '10 at 5:21
    
I agree with your UPS position completely in principle; however for some situations it is an awkward solution. Eg: I deal mostly with augmenting factory floor machinery with embedded PCs for information logging at the operator level. My experience with using UPSs at that level is that they confuse the operator since they are wired to shut down the PC when the main power-switch is turned. Parts powered, parts not powerd (albeit briefly). Then there is the typical ON-OFF-ON switch usage, followed by recharging the battery problems. Finally increased wear on the battery and flat battery confusin. –  Nicholas Feb 4 '10 at 8:05
    
Well that's a user education issue that should be able to be easily resolved with a bit of documentation and process training. I've done a fair amount of work designing and implementing data collection systems for manufacturing environments, and in all cases, I get the data to a central server as quickly as possible after acquisition. Perhaps that is the best solution to your problem - get the data off asap and then you don't ever need to worry about local data corruption due to power failure (or anything else). –  EEAA Feb 4 '10 at 16:31

As has already been answered, a journaled file system is the nearest, although it cannot be guaranteed. It's just like a journaled database system. There are moments, brief though they may be where the data is still in a transaction but has not yet been fully written to the journal. The damage in such a case might be extremely minimal but if that happens to be the one really critical bit you're still up the proverbial creek.

Reality: Despite the best efforts of some really great developers we still suffer file system corruption from power drops.

share|improve this answer
    
The reliable filesystem should protect me from loosing "old" data (data which was already on disk when the power failure event happened) and not the most recent data (which should be either written or not but never corrupt). Unfortunately (as you mentioned) many filesystems do not work that way, especially when coupled with imperfect block devices. –  jpc Aug 28 '13 at 10:16

ZFS is definently what you are looking for.

There are many ways it prevents data corruption. The most significative example is it only commits data that has been fully written to disk. This should prevent most, if not all, data corruption.

Another way it does this is checksumming, it checks that the data written to disk is correct. This will help in case of power failure when only part of the data gets written to disk.

Also, battery backed RAID cards are really a no-brainer...

share|improve this answer

Nothing is going to be 100% safe from having the power dropped out from under it. You best bet is to use a journaling file system (e.g. EXT3 or new revisions of NTFS) with the disks hosted on a battery backed RAID controller (the battery is on the RAID controller). The batter backed RAID controller will allow the card to write out what is in cache before it's too late.

share|improve this answer
1  
Actually, I've tried this and found difficulties using battery backed-up RAID controllers. That being that they are generally designed to be on all the time. Not off all the time like we would need them to be. (See previous question’s comment regarding 'augmenting factory floor machinery'). From what I've seen, they use the battery to actively store unwritten data from a power failure until the machine is next powered up, at which time the data is then committed to disk. The time span on these BB-Raid Array batteries tend to be only 2 - 3 days. About the same time as a long weekend. –  Nicholas Feb 4 '10 at 8:17

Depending on your usage you might consider a read only filesystem with changes only stored in memory. If power is lost disk state is simply restored back to your original good image. Ideal for things like kiosks/web terminals or processing style servers working on data from a network source.

share|improve this answer

For the benefit of others interested, after writing this question I have come across two on the market solutions for a viable power safe file system. Both use the copy-on-write principle. (Interestingly they were surprisingly hard to find). They are:

  1. From HCC Embedded, they offer two file system solutions - SafeFAT, and SafeFLASH - which are stated to be completely power failure safe. The former is a FAT compatible option, and later is optimised for wear levelling and performance. While good, these products tend to be priced for large volume users.

  2. From QNX Software Systems & reviewed here, they offer a range of different file system solutions, one of which is potentially power failure safe from what I read. This company offers both commercial licensing and open source licensing, which was nice to see. Unfortunately they only support drivers for 'nix variants.

share|improve this answer
    
The skeptic in me says that regardless of system used there must be a critical point where data has not been fully written, regardless of file system used. Alternatively, the data is still being written when the power disappears. It just not possible to instantaneously transfer data from memory to disk. This is one of those times I'd really like to be wrong but I'm going to take a lot to be convinced. –  John Gardeniers Feb 5 '10 at 7:51

Another option to consider is a true transactional file system, such as Datalight Reliance or Reliance Nitro. Unlike a journaling file system as recommended in other posts which protects file system structures, a true transactional file system protects both user data and file system structures from corruption due to power loss. Also, Reliance and Reliance Nitro do not suffer from non-deterministic start up times after a power failure caused by a journal replay requirement.

Both Reliance-family file systems can be used with any storage media: HDD, SSD,CF cards, NOR flash, NAND flash, etc.

More info including file system comparisons at Datalight.com

[full disclosure: I am the Director of Sales & Marketing for Datalight]

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.