CHKDSK: Usn Journal Corruption

[Bob]

About half the time I reboot my Win2K/SP4 system it runs CHKDSK
automatically. Everything appears to check out OK except the entry
called "Usn Journal". It says that records were fixed.

How do I find out why this is happening. Because it happens
intermittantly it is not practical to remove one application at a time
to test. That would render the machine useless.

So I need some way to run a background diagnostic to see what is
causing this problem. How would you chase this kind of problem down?

 

[Steven L Umbach]

It could also be a problem with your hard drive. Programs like Norton
Utilities have more advanced disk diagnostic and repair programs that have
worked well for me in the past like Disk Doctor, etc. Hard drive
manufactures often have utilities at their websites that may be able to
diagnose and fix minor problems. Below is the one for Seagate and it may
work on drives from other manufactures. --- Steve

http://www.seagate.com/support/seatools/

 

[Bob]

It could also be a problem with your hard drive. Programs like Norton
Utilities have more advanced disk diagnostic and repair programs that have
worked well for me in the past like Disk Doctor, etc. Hard drive
manufactures often have utilities at their websites that may be able to
diagnose and fix minor problems. Below is the one for Seagate and it may
work on drives from other manufactures. --- Steve

http://www.seagate.com/support/seatools/

I thought that but I have 3 drives all the same WD 80GB. I find it
hard to believe all three drives have failed.

There has to be some process or application that uses the Usr Journal
and is corrupting it. How do I find that process or application?

 

[Steven L Umbach]

Offhand I have never had that problem but if it is affecting all drives it
could also be a hardware problem such as with the controller, memory, etc.
Below is a Google search link that may be of help to links with others that
may have have experienced Usn Journal issues. --- Steve

http://www.google.com/search?hl=en&q=windows+checkdisk+Usn+Journal&btnG=Google+Search
http://groups.google.com/groups?hl=en&q=windows checkdisk Usn Journal&btnG=Google+Search&sa=N&tab=wg

 

[Bob]

Offhand I have never had that problem but if it is affecting all drives it
could also be a hardware problem such as with the controller, memory, etc.

Maybe it's caused by the removable bay not being ATA compliant.

It only happens when I shutdown. I know because Event Viewer does not
report a problem before I shut down, yet when the machine comes back
up (after running CHKDSK) there is always 2 identical entries that say
the NTS Volume is corrupt and I should run CHKDSK. But CHKDSK runs
automatically. So something is corrupting the disk at shutdown and
Windows discovers it before shutdown has finished and schedules CHKDSK
to run next reboot.

Below is a Google search link that may be of help to links with others that
may have have experienced Usn Journal issues. --- Steve

Thanks, but I have already searched both the web and MS KB. Nothing
obvious popped up.

I need to trap this error. How do I do that?

 

[Steven L Umbach]

If it is not enabled yet try enabling auditing of system events in Local
Security Policy. If nothing is reported in the logs then it will be
difficult to track down and again may be a hardware problem. Try to boot
into Safe Mode and then reboot to see if the problem persists. There are
some commands that you could also try running in Recovery Console such as
fixboot and chkdsk which may do a better job in RC mode. See the link below
for more info on Recovery Console. Beyond that f it was my computer I would
try doing an in place upgrade of the operating system and if that did not
work a pristine install of the operating system which you could also do as a
dual boot configuration to see if the new install had the problem or not.
Try disconnecting the other drives from the motherboard [from the cable or
via cmos] if possible [assuming RAID striping is not used] and only boot
from the system drive and maybe try new hard drive data cables. You might
also want to post in a hardware newsgroup or a general operating system
newsgroup for Windows 2000. --- Steve

http://support.microsoft.com/kb/q229716/

 

[Bob]

If it is not enabled yet try enabling auditing of system events in Local
Security Policy. If nothing is reported in the logs then it will be
difficult to track down and again may be a hardware problem. Try to boot
into Safe Mode and then reboot to see if the problem persists. There are
some commands that you could also try running in Recovery Console such as
fixboot and chkdsk which may do a better job in RC mode. See the link below
for more info on Recovery Console. Beyond that f it was my computer I would
try doing an in place upgrade of the operating system and if that did not
work a pristine install of the operating system which you could also do as a
dual boot configuration to see if the new install had the problem or not.
Try disconnecting the other drives from the motherboard [from the cable or
via cmos] if possible [assuming RAID striping is not used] and only boot
from the system drive and maybe try new hard drive data cables. You might
also want to post in a hardware newsgroup or a general operating system
newsgroup for Windows 2000. --- Steve

http://support.microsoft.com/kb/q229716/

Thatks for the detailed comments, but I am looking for a simple way to
find the culprit. I am using ATA-133 80-wire ribbon cables. Before I
was using round IDE cables and replaced them because I thought they
were the culprit. I have two removable bays with two drives operative.
I see no evidence of corruption on the second drive so I tend to rule
out the hardware, especially since I have three separate identical
disks I use as boot disks. They all exhibit this problem.

If could it be my Computer Associates anti-virus program, which is the
only new background application I have installed in a long while.
Unfortunately there is no easy way to remove it from background
without uninstalling it. IOW, there is no Exit or Close option. I
suppose I could use msconfig to prevent it from loading, but first I
want to find a way to understand what the problem is all about.

What uses the Usn Journal? Why would it become corrupted and force
CHKDSK to run at startup?

 

[Steven L Umbach]

I really don't know much about Usn Journal other than what I see in a
Google search. If you try booting into Safe Mode that should bypass any
startup programs and load in barebones mode which could help rule out a lot
of your applications. If you have any good spare RAM laying around try
swapping that or if you have multiple sticks installed try using one at a
time. I have seen flaky RAM cause a lot of strange problems. -- Steve

If it is not enabled yet try enabling auditing of system events in Local
Security Policy. If nothing is reported in the logs then it will be
difficult to track down and again may be a hardware problem. Try to boot
into Safe Mode and then reboot to see if the problem persists. There are
some commands that you could also try running in Recovery Console such as
fixboot and chkdsk which may do a better job in RC mode. See the link
below
for more info on Recovery Console. Beyond that f it was my computer I
would
try doing an in place upgrade of the operating system and if that did not
work a pristine install of the operating system which you could also do as
a
dual boot configuration to see if the new install had the problem or not.
Try disconnecting the other drives from the motherboard [from the cable or
via cmos] if possible [assuming RAID striping is not used] and only boot
from the system drive and maybe try new hard drive data cables. You might
also want to post in a hardware newsgroup or a general operating system
newsgroup for Windows 2000. --- Steve

http://support.microsoft.com/kb/q229716/

Thatks for the detailed comments, but I am looking for a simple way to
find the culprit. I am using ATA-133 80-wire ribbon cables. Before I
was using round IDE cables and replaced them because I thought they
were the culprit. I have two removable bays with two drives operative.
I see no evidence of corruption on the second drive so I tend to rule
out the hardware, especially since I have three separate identical
disks I use as boot disks. They all exhibit this problem.

If could it be my Computer Associates anti-virus program, which is the
only new background application I have installed in a long while.
Unfortunately there is no easy way to remove it from background
without uninstalling it. IOW, there is no Exit or Close option. I
suppose I could use msconfig to prevent it from loading, but first I
want to find a way to understand what the problem is all about.

What uses the Usn Journal? Why would it become corrupted and force
CHKDSK to run at startup?