File server backup fails with the Unable to query USN Journal error
This article applies to:
- OS: Windows
- Product edition: Phoenix
The File server backup fails with the Unable to query USN Journal error. The error is logged in the PhoenixScanner_<drive>.log file of the file server.
The USN (Change) Journal provides a persistent log of all changes made to the files in the volume. When files, directories, and the other NTFS objects are added, deleted, or modified, the NTFS records all the changes into the USN Journal. One Journal is maintained for each volume on the computer. Each record indicates the type of change and the object changed. The new records are appended to the end of the stream.
Backup programs consult the USN Journal to determine all the modifications made to the set of files.
The following files contain the changed records:
Line <Line_Number> : level=error ts=<time_Stamp> USNUtil="Unable to query USN Journal." Fault=" The volume change journal is deleted."
This backup will always be converted to the folder walk as you cannot read the USN.
- Event Viewer (Event ID 55)
The master file table (MFT) contains a corrupted file record. The file reference number is 0x2900000000f1c5. The name of the file is <filename cannot be determined>.
This error occurs due to the following reasons:
- If a file system is not NTFS, the USN Journal query does not work.
- If the USN Journal already exists on a volume, update the MaxSize and AllocationDelta parameters of the Journal. This enables you to expand the number of records that an active Journal maintains without having to disable it.
To resolve this error, perform the following steps:
- For issues with disk or the file system, check with your system administrator and proceed with the following check disk command (command-line utility) in the read-only mode.
If the error persists, proceed with the recovery mode. This mode locates bad sectors and recovers readable information.
- Query the USN Journal or create it using the following command:
fsutil.exe usn queryjournal <Drive Name>
fsutil usn createjournal m=1000 a=100 <Drive Name>