Windows Server 2008 Server Core : Monitoring the File System with the FSUtil Command (part 1) - Behavior, Dirty & File

• Behavior

• Dirty

• File

• FSInfo

• Hardlink

• ObjectID

• Quota

• Repair

• ReparsePoint

• Resource

• Sparse

• Transaction

• USN

• Volume

Each of these modes helps you manage a different aspect of the file system. For example, the behavior mode queries and sets the file system behavior parameters and controls how the file system reacts in a given situation. The following sections describe each of these operational modes in detail.

1. Behavior

The Behavior mode controls how the file system works. For example, you can modify the use of the older DOS 8-character filename, with 3-character file extension. This mode uses the following syntax:

FSUtil Behavior Query [allowextchar] [disable8dot3]
   [disablecompression] [disableencryption] [disablelastaccess]
   [encryptpagingfile] [mftzone] [memoryusage] [quotanotify]
   [SymlinkEvaluation]
FSUtil Behavior Set [allowextchar {1 | 0}] [disable8dot3 {1 | 0}]
   [disablecompression {1 | 0}] [disableencryption {1 | 0}]
   [disablelastaccess {1 | 0}] [encryptpagingfile {1 | 0}]
   [mftzone Zone] [memoryusage Value] [quotanotify Value]
   [SymlinkEvaluation [L2L:{0|1}] | [L2R:{0|1}] |
   [R2R:{0|1}] | [R2L:{0|1}]]

When querying a value, all you supply is the option name. However, when you set an option, you must also provide a new value. The following list describes each of the command line arguments.

allowextchar {1 | 0}

Determines whether you can use extended characters, including diacritic characters used for languages other than English, in the short filenames on NTFS volumes. The default setting doesn't provide a value for this option. Setting the value to 1, or true, allows you to use the extended character set.

disable8dot3 {1 | 0}

Determines whether Windows supports older DOS naming conventions or uses extended filenames exclusively. The older DOS naming conventions relied on an 8-character filename and a 3-character file extension. Disabling this support could cause some older applications to fail. The default value is 0, or false, which means that the older DOS naming convention is available.

disablecompression {1 | 0}

Disables compression for the affected file system object. The default value is 0, or false, which means that compression is available.

disableencryption {1 | 0}

Disables data encryption for the affected file system object. The default value is 0, or false, which means that encryption is available.

disablelastaccess {1 | 0}

Determines whether Windows changes the last access time stamp for a directory or file each time you list the directory contents on an NTFS volume. The default setting doesn't provide a value for this option. Setting this option to 1, or true, will increase disk performance slightly, but then you'll lack last access time statistics when working with the drive.

encryptpagingfile {1 | 0}

Encrypts the paging file to ensure third parties can't obtain information about your system by reading it. For example, it may be possible to read passwords as part of the paging file under certain conditions. Using this setting incurs a significant performance penalty. The default value is 0, or false, which means that the paging file isn't encrypted.

mftzone

Zone

Changes the MFT zone value. Learn more about the MFT at http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/prork/prdf_fls_xkhv.mspx?mfr=true. The Windows NT File System (NTFS) normally sets aside 12.5 percent of the disk (zone 1) to hold the MFT so that it doesn't become fragmented. Generally, this value provides more than sufficient space for data entries. Each zone (values 1 through 4) provides additional space for the MFT: 1 (12.5 percent), 2 (25 percent), 3 (37.5 percent), and 4 (50 percent). Any change to the MFT zone won't take effect until you reboot the system. Generally, you want to set this value before you do anything else with a new hard drive to ensure the MFT zone doesn't become fragmented.

memoryusage

Value

Controls the amount of paged memory used for file operations. The default value of 1 uses the default amount of paged memory for file operations. Setting the value to 2 increases the amount of paged memory available for file operations. However, this feature can have unwanted side effects. The added file operation memory only nets increased performance when you don't take paged memory away from other areas of the operation system. Generally, you'll need to experiment with this setting and monitor its effect on overall system performance before you make it permanent.

quotanotify

Value

Defines the interval between disk quota violation checks on an NTFS drive. The disk quota system ensures that a user doesn't use more resources than the administrator allows. The default setting is 3,600 seconds or 1 hour when you enable the quota system. You can supply any value between 1 second and 4,294,967,295 seconds. Longer intervals enhance system performance, but could result in more quota violations.

SymlinkEvaluation [L2L:{0|1}] | [L2R:{0|1}] | [R2R:{0|1}] | [R2L:{0|1}]

Determines the use of symbolic links within the operating system. You can individually set the use of local-to-local (L2L), local-to-remote (L2R), remote-to-remote (R2R), and remote-to-local (R2L) links. The default value for L2L and L2R is 1, or true, which means that these symbolic links are enabled. The default value for R2R and R2L links is 0, or false, which means that you can't create these link types.

2. Dirty

Use this mode to check or set the dirty bit for a volume. The system automatically performs an AutoChk whenever it detects the dirty bit during startup. The AutoChk utility looks for drive errors. This mode uses the following syntax:

FSUtil Dirty Query Volume
FSUtil Dirty Set Volume

The following describes the command line argument.

Volume

Determines the NTFS volume to check during the next reboot. This utility only works with local volumes, so you can't query or set the dirty bit on a remote volume.

3. File

The file mode lets you perform tasks with files. Some of the tasks are quite mundane. For example, you can create a new file of a specific size. The file mode will even fill the file with zeros for you. Other tasks are unique. The findbysid argument lets you locate a file using its Security Identifier (SID). This mode uses the following syntax:

FSUtil File [findbysid UserName Directory] [queryallocranges
Offset=StartRange Length=RangeLength Filename] [setshortname Filename
ShortFilename] [setvaliddata Filename DataLength] [setzerodata
Offset=StartRange Length=RangeLength Filename] [createnew Filename Length]

The following list describes each of the command line arguments.

findbysid

UserName Directory

Locates a file based on the user's SID. The username argument contains a local user's name, which the operating system maps to the SID. FSUtil then locates the file based on this SID in the directory supplied. Unlike other command line utilities, this one lets you search for files that belong to specific users on an NTFS volume.

queryallocranges Offset=

StartRange Length=RangeLength Filename

Displays a list of allocated ranges within the specified file. The Offset argument defines the starting point of the search, while the Length argument specifies the length of the search. You can use this command to locate sparse regions within files. See the "Understanding Sparse Files" sidebar for additional information.

setshortname

Filename ShortFilename

Sets the short (DOS) filename for a file. The short filename must fall within the 8-character filename and 3-character extension limitations. The Dir command won't normally display the results of this command. However, using the /X command line switch with the Dir command displays both the long and the short filename.

setvaliddata

Filename DataLength

Sets the valid data length for a file. The Valid Data Length (VDL) is the length of the valid data within a file, rather than the actual file length as indicated by an End Of File (EOF) marker. The data between the VDL and the EOF may contain data, as in a download cache, but any query to that data returns a 0 since the data isn't valid. Because of the low-level nature of this particular argument, only administrators with the SetManageVolumePrivilege can execute it.

setzerodata Offset=

StartRange Length=RangeLength Filename

Changes the data bits within a file to 0. This is an excellent method of clearing a file before deleting it for security reasons (deleting a file retains the data on disk; Windows only removes the directory entries, making the file recoverable). The start range determines the starting point within the file for writing zeros. The start of the file is 0, but you can use any range up to the size of the file in bytes. The range length determines how many zeros to write. This value must be less than or equal to the length of the file minus the start range value.

createnew

Filename Length

Creates a new file that FSUtil fills with zeros. You must include a filename and the length of the file. Because these files are zeroed, they make excellent test files for other file utilities.

Understanding Sparse Files

It's possible for a file to contain some data in addition to large ranges of zeros (or null data). A cache file could fall into this category. You might allocate 1 MB for the cache, but the cache file could contain only a little data; the rest of the file contains zeros. The part of the file that contains zeros wastes disk space. There's no reason to allocate an entire 1 MB storage location for a file that contains 10 KB of data. The term for such a file is sparse. Generally, you want to manage sparse files so they use the minimum space necessary, yet continue to provide full functionality to the application that creates the sparse file.

The most common Windows application that uses sparse files is the indexing service. You define the size of the catalogs as part of creating a new catalog. However, the catalog might not actually contain that much information. Rather than waste the disk space, the indexing service uses a sparse file to hold the catalog.

Sparse files require special handling. The FSUtil command provides a number of special commands to work with sparse files. For example, you can use the queryallocranges argument of the file mode to locate sparse files on the hard drive. Likewise, the sparse mode arguments help you manage sparse files. For example, you can use this mode to set a sparse range within a file. You can learn more about sparse files on the Microsoft Web site at http://technet.microsoft.com/en-us/library/Bb457112.aspx.