What is the Usn Journal

[Bob]

I have read some of the KB articles and still I do not know what the
Usn Journal is or its purpose.

Something is corrupting my filesystem which causes CHKDSK to run. The
entry in Event Viewer is "The file system structure on the disk is
corrupt and unusable. Please run the chkdsk utility on the volume ",
which is about as helpful as a bucket under a bull.

When CHKDSK runs it quickly passes over everything but the Usn
Journal, which it says it has repaired. Sometimes I can see an
enumeration of entries being repaired one by one, but most of the time
it just says that it has repaired records in the Usn Journal.

I have never lost Win2K because of this - it always starts as if
nothing happned.

 

[seth]

USN desribed
http://kb.iu.edu/data/aexw.html

 

[Bob]

USN desribed
http://kb.iu.edu/data/aexw.html

"USN Journal: This feature provides a persistent log of all changes
made to files on the volume. This feature is one of the reasons that
the Windows 2000 domain controller must use an NTFS 5.0 partition as
the system volume."

Yes, I knew that. I need to know more so I can figure out why it is
being corrupted, seemingly at random.

 

[John John]

Turn off (disable) Indexing Service and see if things change. Turn it
all off, on all drives and make sure the service is disabled.

John

 

[Bob]

Turn off (disable) Indexing Service and see if things change. Turn it
all off, on all drives and make sure the service is disabled.

How do I do all that? I am not very familiar with indexing service.

I went into Properties for each of my two hard disks and neither has
indexing checked. I also went into Search and it said that indexing is
currently disabled. Where else do I need to look?

What service or services do I need to disable? I cannot see anything
that is obviously related to "indexing".

I do have a few compressed directories - do I need to change them
back? I do not have any compressed drives.

 

[John John]

If the Indexing service is disabled then it isn't running and can't be
responsible for errors in the USN Journal. Here is a description of USN
Journal from a Microsoft site:

"The update sequence number (USN) change journal, which provides a
persistent log of all changes made to files on the volume. As files,
directories, and other NTFS objects are added, deleted, and modified,
NTFS enters records into the USN change journal, one for each volume on
the computer. Each record indicates the type of change and the object
changed. New records are appended to the end of the stream."

"Programs can consult the USN change journal to determine all the
modifications made to a set of files. The USN change journal is much
more efficient than checking time stamps or registering for file
notifications. The USN change journal is enabled and used by the
Indexing Service, File Replication Service (FRS), Remote Installation
Service (RIS), and Remote Storage."

Note that any other applications (not just Indexing Service, File
Replication Service (FRS), Remote Installation Service (RIS), and Remote
Storage) can call on or use the USN Journal, so the journal might get
corrupted by a flawed application. You can read here for more insight:

Keeping an Eye on Your NTFS Drives: the Windows 2000 Change Journal
Explained
http://www.microsoft.com/msj/0999/journal/journal.aspx

Are any errors showing in the Event Viewer log?

John

 

[Bob]

If the Indexing service is disabled then it isn't running and can't be
responsible for errors in the USN Journal.

When CHKDSK runs it says that it has repaired records in the Usn
Journal. On some occasions I have seen an enumeration of the very
records it has repaired.

There must be something else that is using the Usn Journal, like a
background application.

Here is a description of USN Journal from a Microsoft site

Thanks but as I mentioned in my original post I have read as much as I
can find in the MS KB, and none of it helps me find the culprit that
is corrupting the Usn Journal.

Are any errors showing in the Event Viewer log?

Yes, two identical entries show up after the repair has been effected
and Windows comes up. I have watched the Event Viewer just before I
shutdown and there is no entry.

I posted the exact entry in an earlier post, and I do not have it
anymore. It is a terse one-liner about NTFS having been corrupted and
recommending that I run CHKDSK. But Windows schedules CHKDSK anyway.

On occasion I have bypassed CHKDSK to see what would happen, and
nothing happened that I was aware of. So whatever has happened the Usn
Journal is not catastrophic.