Hello networker friends,

I'm looking at the NTFS change journal to see if it is a possible
solution for the very long time an incremental backup on our
windows 2000 servers takes, due to the virusscanner.

It seems that there's not much helpful information on the subject.

I've set up a test system, containing a disk with a lot of (sub)directories,
and even more small files. When I do an incremental without the change journal
enabled, it takes about 20 minutes to complete. If I do an incremental backup
with the change journal enabled, it takes 5 minutes, even though only one
small file has been changed. After some testing and monitoring it seems that
it's taking 5 minutes just to 'read' the change journal.

Also, it seems that sometimes the change journal isn't used or perhaps disabled,
without any obvious cause. Just like the change journal gets activated
sometimes without any cause (we have it disabled everywhere since we know so
little about it).

The only useful tool I found to read the changejournal is 'fsutil', supplied 
with XP.


Some questions I have:
- How long will the reading of the change journal take if the system is 'in 
use'?
 will this always be 5 minutes? Or will this be dependant on the size of the
 journal?

- How can I be sure that all changes are in the journal? The output of fsutil 
doesn't seem
 to include the date/time of the entry. If I understand correctly, the journal 
is a FIFO,
 so if it's full, the oldest entries get kicked out.
 So how can I ensure that all changes are still in the journal at the end of 
the day?
 (or a week later at the level1 backup?).


Any thoughts/insights anybody? Any experience?


greetings and thanks,

Dennis

--
Note: To sign off this list, send a "signoff networker" command via email
to listserv AT listmail.temple DOT edu or visit the list's Web site at
http://listmail.temple.edu/archives/networker.html where you can
also view and post messages to the list.
=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=