huge .sujournal file on FreeBSD

Question

I am running out of space and when I checked, I found that I have

# pwd
/usr
# ls -l .sujournal
-r--------  1 root  wheel  33554432 Dec 31  1969 .sujournal

I wanted to ask should/can I remove it? Any implications of that?

Answer 1

No!

As a general rule, if you see a system file and you don't know what it is, don't remove it. Even more generally, if an action requires root permissions and you don't know what it would mean, don't do it.

The .sujournal file contains the soft updates journal. The file is not accessed directly as a file; rather, it's space that is reserved for internal use by the filesystem driver. This space is marked as occupied in a file for compatibility with older versions of the filesystem driver: if you mount that filesystem with an FFS driver that supports journaled soft updates, then the driver uses that space to store the SU journal; if you mount that filesystem with an older FFS driver, the file is left untouched and the driver performs an fsck upon mounting instead of replaying the journal.

Answer 2

If you're really that concerned about a 32 meg journal file, what you can do is check to see what processes, if any, have open file handles on the file:

$ fuser /usr/.sujournal

If there are any pids returned, then it's probably a good idea to not remove the file.

If you like, you can set up logrotate(8) to automatically rotate the file if you append the following to /etc/logrotate.conf:

/usr/.sujournal {
    # rotate once a week
    weekly
    # keep 4 weeks of backlogs
    rotate 4
    # don't rotate if empty
    notifempty
    # copy and truncate original (for always-open file handles
    # [read: tail -f, multitail, root-tail, etc.])
    copytruncate
}