Skip to main content
All CollectionsKnowledge BaseEnterprise WorkloadsTroubleshooting - Enterprise Workloads
File server backup fails with the Unable to query USN Journal error
File server backup fails with the Unable to query USN Journal error
Updated over a week ago

This article applies to:

  • OS: Windows

  • Product edition: Phoenix

Problem description

  • The File server backup fails with the USN not found in Journal. The error is logged in the Phoenix.log file of the file server.

  • The USN (Change) Journal provides a persistent log of all changes made to the files in the volume. When files, directories, and the other NTFS objects are added, deleted, or modified, the NTFS records all the changes into the USN Journal. One Journal is maintained for each volume on the computer. Each record indicates the type of change and the object changed. The new records are appended to the end of the stream.

  • Backup programs consult the USN Journal to determine all the modifications made to the set of files.

Traceback

level=warn ts=2023-04-30T18:07:44.1027273-07:00 filename=usnutil_windows.go:80 message="USN Journal purged old entries for \\\\?\\E:\\." Error=USN03
level=warn ts=2023-04-30T18:07:44.1027273-07:00 filename=walker.go:82 message="Error while initializing USN Journal. Converting to folderwalk..." Error=USN03
level=info ts=2023-04-30T18:07:44.1027273-07:00 filename=backup_agent.go:966 message="Sending log to Phoenix server with message: Drive:E Last USN not found in Journal. Consider increasing USN Journal size. Converting to folder walk."

Cause

This error occurs due to the following reasons:

  • If a file system is not NTFS, the USN Journal query does not work.

  • If the USN Journal already exists on a volume, update the MaxSize and

    AllocationDelta 

    parameters of the Journal. This enables you to expand the number of records that an active Journal maintains without having to disable it.

Resolution

Increase the USN journal size as described below. The illustrations provided are examples and not true values.

  1. Check the current USN journal size with the following command and note the value of Maximum Size from the output.

    fsutil usn queryjournal <DRIVE_LETTER>
  2. Run the following command from an elevated command prompt to find the total number of files on the NTFS volume.

    c:\Windows\system32>dir <Drive_LETTER>:/s /a /w 
    FindFilesonNTFS.png
  3. Add the number of files and the directories to get the total count. For example, the total count from the above illustration comes to 600,189.

  4. Use the table below to find the appropriate values of the Maximum Size and Allocation Delta:

Files

Maximum Size (m) in bytes

Allocation Delta (a) in bytes

m (MB)

m (HEX)

a (hex)

400,000

536,870,912

67,108,864

512

20000000

4000000

600,000

805,306,368

100,663,296

768

30000000

6000000

800,000

1,073,741,824

134,217,728

1,024

40000000

8000000

1,000,000

1,342,177,280

167,772,160

1,280

50000000

A000000

1,200,000

1,610,612,736

201,326,592

1,536

60000000

C000000

1,400,000

1,879,048,192

234,881,024

1,792

70000000

E000000

1,600,000

2,147,483,648

268,435,456

2,048

80000000

10000000

1,800,000

2,415,919,104

301,989,888

2,304

90000000

12000000

2,000,000

2,684,354,560

335,544,320

2,560

A0000000

14000000

2,200,000

2,952,790,016

369,098,752

2,816

B0000000

16000000

2,400,000

3,221,225,472

402,653,184

3,072

C0000000

18000000

2,600,000

3,489,660,928

436,207,616

3,328

D0000000

1A000000

2,800,000

3,758,096,384

469,762,048

3,584

E0000000

1C000000

3,000,000

4,026,531,840

503,316,480

3,840

F0000000

1E000000

3,200,000

4,294,967,296

536,870,912

4,096

100000000

200000000

If the USN change journal size is too small for the volume according to the above table, set the Maximum Size and Allocation Delta accordingly.

fsutil usn createjournal m=2415919104 a=301989888 <DRIVE_LETTER>
Did this answer your question?