File server backup fails with the Unable to query USN Journal error
This article applies to:
- OS: Windows
- Product edition: Phoenix
Problem description
- The File server backup fails with the USN not found in Journal. The error is logged in the Phoenix.log file of the file server.
- The USN (Change) Journal provides a persistent log of all changes made to the files in the volume. When files, directories, and the other NTFS objects are added, deleted, or modified, the NTFS records all the changes into the USN Journal. One Journal is maintained for each volume on the computer. Each record indicates the type of change and the object changed. The new records are appended to the end of the stream.
- Backup programs consult the USN Journal to determine all the modifications made to the set of files.
Traceback
level=warn ts=2023-04-30T18:07:44.1027273-07:00 filename=usnutil_windows.go:80 message="USN Journal purged old entries for \\\\?\\E:\\." Error=USN03
level=warn ts=2023-04-30T18:07:44.1027273-07:00 filename=walker.go:82 message="Error while initializing USN Journal. Converting to folderwalk..." Error=USN03
level=info ts=2023-04-30T18:07:44.1027273-07:00 filename=backup_agent.go:966 message="Sending log to Phoenix server with message: Drive:E Last USN not found in Journal. Consider increasing USN Journal size. Converting to folder walk."
Cause
This error occurs due to the following reasons:
- If a file system is not NTFS, the USN Journal query does not work.
- If the USN Journal already exists on a volume, update the MaxSize and AllocationDelta parameters of the Journal. This enables you to expand the number of records that an active Journal maintains without having to disable it.
Resolution
Increase the USN journal size as described below. The illustrations provided are examples and not true values.
- Check the current USN journal size with the following command and note the value of Maximum Size from the output.
fsutil usn queryjournal <DRIVE_LETTER>
- Run the following command from an elevated command prompt to find the total number of files on the NTFS volume.
c:\Windows\system32>dir <Drive_LETTER>:/s /a /w
- Add the number of files and the directories to get the total count. For example, the total count from the above illustration comes to 600,189.
- Use the table below to find the appropriate values of the Maximum Size and Allocation Delta:
Files Maximum Size (m) in bytes Allocation Delta (a) in bytes m (MB) m (HEX) a (hex) 400,000 536,870,912 67,108,864 512 20000000 4000000 600,000 805,306,368 100,663,296 768 30000000 6000000 800,000 1,073,741,824 134,217,728 1,024 40000000 8000000 1,000,000 1,342,177,280 167,772,160 1,280 50000000 A000000 1,200,000 1,610,612,736 201,326,592 1,536 60000000 C000000 1,400,000 1,879,048,192 234,881,024 1,792 70000000 E000000 1,600,000 2,147,483,648 268,435,456 2,048 80000000 10000000 1,800,000 2,415,919,104 301,989,888 2,304 90000000 12000000 2,000,000 2,684,354,560 335,544,320 2,560 A0000000 14000000 2,200,000 2,952,790,016 369,098,752 2,816 B0000000 16000000 2,400,000 3,221,225,472 402,653,184 3,072 C0000000 18000000 2,600,000 3,489,660,928 436,207,616 3,328 D0000000 1A000000 2,800,000 3,758,096,384 469,762,048 3,584 E0000000 1C000000 3,000,000 4,026,531,840 503,316,480 3,840 F0000000 1E000000 3,200,000 4,294,967,296 536,870,912 4,096 100000000 200000000 If the USN change journal size is too small for the volume according to the above table, set the Maximum Size and Allocation Delta accordingly.
fsutil usn createjournal m=2415919104 a=301989888 <DRIVE_LETTER>