Disk quota, df and stat weird behaviour

The aim of this article is to understand where the numbers that are shown by stat/df utils in VE come from.

Consider typical OpenVZ setup, where ext2 separate filesystem is mounted on /vz. ext2 is called underlying filesystem in such situation.

Linux VFS design allows every filesystem to export to userspace the following information concerning disk space (here and further I use subscript to specify paricular filesystem type):

• $total_{ext2}$ - total amount of disk space that potentially can be acquired (e.g. HDD capacity)
• $free_{ext2}$ - amount of disk space that is still free
• $avail_{ext2}$ - amount of disk space that is still available for non-root users

Note, that not all free blocks can be used by non-root users: some amount of disk space is reserved for root. For example on ext2 filesystem only root can use last free 5 percent (by default) of disk space. This is the difference between $avail_{ext2}$ and $free_{ext2}$. Also mark, that the following inequality is always true:

$avail_{ext2}\leq free_{ext2}$ (1)

Inside VE special filesystem type is used: simfs. This filesystem allows to isolate particular VE from other VEs. Hence, when df or stat utils are invoked they get information from simfs, which exports to them the following values (by analogy with ext2):

• $total_{simfs}$
• $free_{simfs}$
• $avail_{simfs}$

This article is in fact devoted to how simfs filesystem calculates the values above.

To produce any calculations input data are required. What are input data for simfs? Except already discussed information from underlying filesystem ($total_{ext2}$, $total_{ext2}$, $total_{ext2}$) one more element comes into force in OpenVZ environment. It is OpenVZ per-VE disk quotas. The values that provide this element are:

• $quota_{used}$ - the number of blocks currently used by VE
• $quota_{barrier}$ - the number of blocks this VE potentially can obtain

OpenVZ disk quota counts the number of blocks currently used by VE and prevents this number to be greater than the limit/barrier set.

Consider three basic scenarios, that are possible:

• Quota is off for VE

If quota is off for VE (DISK_QUOTA=no), the total amount of space, that VE potentially can acquire, equals amount of total space on partition. Certainly some space can be used by other VEs, but potentially VE can have all the space on device. Number of free blocks for VE equals number of free blocks on partition. Note, that it implies that VE root user, can fill all the space, including the space, that is reserved for root user of HN. This is why, you shouldn't reside VEs private areas on root filesystem of your HN. Amount of available disk space for VE equals the number of available blocks for underlying filsystem. Thus, we have the following relationships:

$total_{simfs}$ = $total_{ext2}$

$free_{simfs}$ = $free_{ext2}$

$avail_{simfs}=avail_{ext2}$

Rather valuable disadvantage of swithching OpenVZ quota off (besides having unlimited VEs!) is that you will not be able to get information about how much disk space is used by VE (without doing possibly long term du command) using df/stat. I mean, that

$df_{usage}=total_{simfs}-free_{simfs}=total_{ext2}-free_{ext2}$

thus in VE you obtain information about disk usage of partition, but not disk usage of VE.

• Quota is on for VE and there is enough space on partition

If quota is on, amount of disk space that VE potentially can acquire should be equal quota barrier:

$total_{simfs}=quota_{barrier}$

Amount of free space in this case should logically be the following:

$free_{simfs}=quota_{barrier}-quota_{used}$

However here is a pitfall. Suppose that the amount of free disk space actually on underlying filesystem is less than it is estimated from quota using the formule above, i.e.:

$free_{ext2}<quota_{barrier}-quota_{used}$

Then, definitely, amount of free disk space reported by simfs should be other! This situation will be considered in the next point and in this point we assume that there is enough space on partition, i.e

$free_{ext2}\geq quota_{barrier}-quota_{used}$ (2)

As concerns amount of disk space available for non-root users, if there is enough disk space:

$avail_{ext2}\geq quota_{barrier}-quota_{used}$

then amount of disk space available for non-root users in VE equals free space estimated from quota:

$free_{simfs}=quota_{barrier}-quota_{used}$

• Quota is on for VE and there is NOT enough space on partition

This is the most interesting and difficult to explain case. Nevertheless I tried to do it. So, our assumption is that:

$quota_{barrier}-quota_{used}>free_{ext2}$

What should be reported as free space in such case? Of course, $free_{ext2}$! This is the actual amount of space that can be used by VE. Hence:

$free_{simfs}=free_{ext2}$

And now consider the following situation. There is two VEs. One of VEs writes nothing to disk. Second VE writes to disc some information. Administrator of VE #1 looks at df output. He observes the "Usage" column. What does she see?

$df_{usage}=total_{simfs}-free_{simfs}=total_{simfs}-free_{ext2}$ (3)

$free_{ext2}$ decreases because VE #2 writes to disc, consequently $df_{usage}$ increases! "What the hell is going on?!" - thinks the administrator - "Nobody writes on the disk in my VE, but the usage increases!" To avoid such situation the following approach is used in OpenVZ: decrease $total_{simfs}$ so, that $df_{usage}$ remains the same, i.e.:

$total_{simfs}=total_{ext2}-(quota_{barrier}-quota_{usage})$ (4)

Substituting (4) in (3) obtain:

$df_{usage}=(total_{ext2}-free_{ext2})-(quota_{barrier}-quota_{usage})=const$

In this case, administrator of VE #1 sees that total amount of space decreases, but usage however is constant.

The same reasoning as with $free_{simfs}$ suits for calculating $avail_{s}imfs$. Two cases are possible. If

$avail_{ext2}\geq quota_{barrier}-quota_{used}$

then

$avail_{simfs}=free_{ext2}$

and if

$avail_{ext2}<quota_{barrier}-quota_{used}$

then

$avail_{simfs}=quota_{barrier}-quota_{used}$

The table below summarize all possible cases.

So we have three basic variants. Variant number one is not good, because VE administrator can't get information about VE disk usage and HN administrator can't limit VE disk usage. Variant three is not good 'cause we have some weird (but logical) values in df/stat output in VE, e.g. total disk space can decrease. Variant two is perfect. How can we provide this varaint always take place? Here is the simple rule:

Do not set random disk quota barrier/limit!

Even if you want VE to be unlimited, consider reasonable values. Use the following formula:

$\sum _{i=1}^{N}q_{i}=S-s$

$q_{i}$ - quota barrier for VE i

$S$ - total amount of space on underlying filesystem

$s$ - amount of space used by not VEs private area: templates, locks, etc.

---

TODO: add info about inconsistent quota problems

TODO: Add Roma's images

TODO: Add table

TODO: Add examples with stat/df