"stat /etc" size mismatch: 24 blocks, size 8192 instead of 12288

Question

My stat /etc command shows that the number of blocks is 24. I understand that a block here means 512 bytes. So the total size is 24 × 512 which makes it 12288 bytes.

But it shows 8192 bytes instead, and I can't understand why. To my mind it should be 12288 (3 × 4096).

$ stat /etc
  File: /etc
  Size: 8192            Blocks: 24         IO Block: 4096   directory
Device: fd00h/64768d    Inode: 16777345    Links: 152
Access: (0755/drwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2022-01-28 00:03:35.470200471 +0100
Modify: 2022-01-27 23:59:09.331606660 +0100
Change: 2022-01-27 23:59:09.331606660 +0100
 Birth: -

/etc is on an XFS file system.

Answer 1

Since this is on XFS, the discrepancy between the reported size of /etc and the number of blocks allocated to it is probably caused either by preallocation, or by directory shrinking. If you look at your file system with xfs_db (xfs_db -r /dev/...), you can look at the allocated blocks; for example,

$ sudo xfs_db -r ...
xfs_db> inode 16777345
xfs_db> print
[...]
u3.bmx[0-3] = [startoff,startblock,blockcount,extentflag] 
0:[0,1052355,1,0] 
1:[1,1094509,1,0] 
2:[2,1094191,1,0] 
3:[8388608,1052431,1,0]
[...]

(The inode command above is correct for your system, but your output will differ.)

This is from a directory with a size of 12,288 bytes but an allocated size of 16,384 bytes (32 blocks reported by stat). This shows up as three data blocks (start offsets 0, 1, 2), and an extra block (start offset 8388608) which is part of the “freelist”, i.e. a block allocated to the directory but not used by the directory’s data.