This article applies to:
OS: Windows
Product edition: Phoenix
Problem description
The File server backup fails with the USN not found in Journal. The error is logged in the Phoenix.log file of the file server.
The USN (Change) Journal provides a persistent log of all changes made to the files in the volume. When files, directories, and the other NTFS objects are added, deleted, or modified, the NTFS records all the changes into the USN Journal. One Journal is maintained for each volume on the computer. Each record indicates the type of change and the object changed. The new records are appended to the end of the stream.
Backup programs consult the USN Journal to determine all the modifications made to the set of files.
Traceback
level=warn ts=2023-04-30T18:07:44.1027273-07:00 filename=usnutil_windows.go:80 message="USN Journal purged old entries for \\\\?\\E:\\." Error=USN03 level=warn ts=2023-04-30T18:07:44.1027273-07:00 filename=walker.go:82 message="Error while initializing USN Journal. Converting to folderwalk..." Error=USN03 level=info ts=2023-04-30T18:07:44.1027273-07:00 filename=backup_agent.go:966 message="Sending log to Phoenix server with message: Drive:E Last USN not found in Journal. Consider increasing USN Journal size. Converting to folder walk."
Cause
This error occurs due to the following reasons:
If a file system is not NTFS, the USN Journal query does not work.
If the USN Journal already exists on a volume, update the
MaxSizeandAllocationDelta
parameters of the Journal. This enables you to expand the number of records that an active Journal maintains without having to disable it.
Resolution
Increase the USN journal size as described below. The illustrations provided are examples and not true values.
Check the current USN journal size with the following command and note the value of Maximum Size from the output.
fsutil usn queryjournal <DRIVE_LETTER>
Run the following command from an elevated command prompt to find the total number of files on the NTFS volume.
c:\Windows\system32>dir <Drive_LETTER>:/s /a /w
Add the number of files and the directories to get the total count. For example, the total count from the above illustration comes to 600,189.
Use the table below to find the appropriate values of the Maximum Size and Allocation Delta:
Files | Maximum Size (m) in bytes | Allocation Delta (a) in bytes | m (MB) | m (HEX) | a (hex) |
400,000 | 536,870,912 | 67,108,864 | 512 | 20000000 | 4000000 |
600,000 | 805,306,368 | 100,663,296 | 768 | 30000000 | 6000000 |
800,000 | 1,073,741,824 | 134,217,728 | 1,024 | 40000000 | 8000000 |
1,000,000 | 1,342,177,280 | 167,772,160 | 1,280 | 50000000 | A000000 |
1,200,000 | 1,610,612,736 | 201,326,592 | 1,536 | 60000000 | C000000 |
1,400,000 | 1,879,048,192 | 234,881,024 | 1,792 | 70000000 | E000000 |
1,600,000 | 2,147,483,648 | 268,435,456 | 2,048 | 80000000 | 10000000 |
1,800,000 | 2,415,919,104 | 301,989,888 | 2,304 | 90000000 | 12000000 |
2,000,000 | 2,684,354,560 | 335,544,320 | 2,560 | A0000000 | 14000000 |
2,200,000 | 2,952,790,016 | 369,098,752 | 2,816 | B0000000 | 16000000 |
2,400,000 | 3,221,225,472 | 402,653,184 | 3,072 | C0000000 | 18000000 |
2,600,000 | 3,489,660,928 | 436,207,616 | 3,328 | D0000000 | 1A000000 |
2,800,000 | 3,758,096,384 | 469,762,048 | 3,584 | E0000000 | 1C000000 |
3,000,000 | 4,026,531,840 | 503,316,480 | 3,840 | F0000000 | 1E000000 |
3,200,000 | 4,294,967,296 | 536,870,912 | 4,096 | 100000000 | 200000000 |
If the USN change journal size is too small for the volume according to the above table, set the Maximum Size and Allocation Delta accordingly.
fsutil usn createjournal m=2415919104 a=301989888 <DRIVE_LETTER>