Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am running out of space and when I checked, I found that I have

# pwd
/usr
# ls -l .sujournal
-r--------  1 root  wheel  33554432 Dec 31  1969 .sujournal

I wanted to ask should/can I remove it? Any implications of that?

share|improve this question
2  
As a note, that's not really huge (it's only 32MiB). –  Chris Down Nov 27 '11 at 4:30
    
Why does it have a timestamp of Dec 31 1969? –  amphetamachine Nov 27 '11 at 6:06
2  
@amphetamachine Its date is 0 in the unix epoch, i.e. 1970-01-01 00:00:00 UTC, shown here in a western hemisphere timezone. –  Gilles Nov 27 '11 at 19:20
add comment

2 Answers

up vote 5 down vote accepted

No!

As a general rule, if you see a system file and you don't know what it is, don't remove it. Even more generally, if an action requires root permissions and you don't know what it would mean, don't do it.

The .sujournal file contains the soft updates journal. The file is not accessed directly as a file; rather, it's space that is reserved for internal use by the filesystem driver. This space is marked as occupied in a file for compatibility with older versions of the filesystem driver: if you mount that filesystem with an FFS driver that supports journaled soft updates, then the driver uses that space to store the SU journal; if you mount that filesystem with an older FFS driver, the file is left untouched and the driver performs an fsck upon mounting instead of replaying the journal.

share|improve this answer
    
if an action requires root permissions and you don't know what it would mean, don't do it I would like to have that embroidered on something heavy that I could throw at developers. –  Jenny D Jan 2 at 11:37
add comment

If you're really that concerned about a 32 meg journal file, what you can do is check to see what processes, if any, have open file handles on the file:

$ fuser /usr/.sujournal

If there are any pids returned, then it's probably a good idea to not remove the file.

If you like, you can set up logrotate(8) to automatically rotate the file if you append the following to /etc/logrotate.conf:

/usr/.sujournal {
    # rotate once a week
    weekly
    # keep 4 weeks of backlogs
    rotate 4
    # don't rotate if empty
    notifempty
    # copy and truncate original (for always-open file handles
    # [read: tail -f, multitail, root-tail, etc.])
    copytruncate
}
share|improve this answer
    
I don't know how much harm deleting the file will do, but it's surely a bad idea to modify it in any way. –  Gilles Nov 27 '11 at 19:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.