Windows Server 2008 Server Core : Monitoring the File System with the FSUtil Command (part 4) - Transaction, USN & Volume

12. Transaction

The Transaction mode lets you interact with the transactions currently supported by a Transactional Resource Manager.This mode uses the following syntax:

FSUtil Transaction [commit GUID] [list] [fileinfo Filename]
[query [{files | all}] GUID] [rollback GUID]

The following list describes each of the command line arguments.

commit

GUID

Completes a transaction and makes all of the tasks specified by the entries in the log permanent. You must commit a transaction before the system considers the action completed, even though the file system objects will appear to have all of the changes.

list

Displays a list of all of the current transactions.

fileinfo

Filename

Displays the transactional data about a particular file.

query [{files | all}]

GUID

Displays detailed information about the transaction specified by GUID. You can obtain just the file information or all of the transaction details. Use the list option to obtain a list of the current transactions and their associated GUIDs.

rollback

GUID

Undoes all of the changes made to file system objects within the current transaction since the start of the transaction. A rollback returns the file system objects to their pre-change state.

13. USN

You use this mode to manage the Update Sequence Number (USN) for the system. The USN provides a persistent log of all of the changes made to the files on the system. As users add, delete, and modify files and directories, NTFS makes an entry in the USN. Each volume has a separate USN. The main use of the USN for administrators is to check the changes made to one or more files. Using the USN is more efficient than relying on time stamps and you'll receive more information as well. You can find a complete description of the USN on the Microsoft Systems Journal Web site at http://www.microsoft.com/msj/0999/journal/journal.aspx. This mode uses the following syntax:

FSUtil USN [createjournal m=MaximumSize a=AllocationDelta Volume]
[deletejournal [/D] [/N] Volume] [enumdata FileRef LowUSN HighUSN]
[queryjounral Volume] [readdata Filename]

The following list describes each of the command line arguments.

Volume

Specifies the NTFS volume to manage. The journal always affects an entire volume. Consequently, even though you can query statistics for an individual file, you must work with a volume when creating or deleting the journal.

Filename

Specifies the name of the file to manage. The filename can include both drive and path information.

m=

MaximumSize

Defines the maximum size of the USN journal in bytes. The journal can grow larger than this value, but NTFS truncates it during the next checkpoint to less than this size. The checkpoint size is the maximum size plus the allocation delta. Consequently, if you set the journal size to 1,000 bytes and the allocation delta to 100, then NTFS automatically truncates the journal when it reaches 1,100 bytes to 900 bytes in size.

a=

AllocationDelta

Determines the delta between a full journal and a truncated journal.

/D

Disables a USN journal (rather than deleting it) and returns control of the Input/Output (I/O) of the system immediately. NTFS continues to disable the journal in the background. This option takes more time to complete than the /N option, but lets the user continue working immediately.

/N

Disables a USN journal (rather than deleting it) and maintains control of the I/O subsystem. The system won't read or write data to the hard drive while NTFS disables the USN journal. This option completes the process much faster, but requires that the user give up access to the system while the process completes.

FileRef

Specifies the ordinal position of the file within the drive hierarchy. Each file has a unique number. This value specifies the starting point for the enumeration.

LowUSN

Determines the lowest USN number within a range. Only USNs with numbers that are equal to or higher than this number appear within the range.

HighUSN

Determines the highest USN number within a range. Only USNs with numbers lower than or equal to this number appear within the range.

createjournal

Creates a new journal for the specified volume. If you set the m and a arguments to 0, Windows determines journal allocation sizes based on the size of the hard drive.

deletejournal

Deletes or disables a USN journal. Deleting the journal removes it from the system permanently and could adversely affect applications such as Indexing Service, File Replication Service (FRS), Remote Installation Services (RIS), and Remote Storage that rely on it. Disabling the journal makes it inaccessible, but doesn't free the resources used by the journal.

enumdata

Enumerates the change journal entries between two boundaries as specified by the LowUSN and HighUSN arguments for files starting with a specific reference number.

queryjournal

Displays the USN journal statistics for the requested volume. This information includes the USN journal identifier, first USN number, next USN number, lowest valid USN, maximum valid USN, maximum size, and allocation delta.

readdata

Displays data about the requested file. The information includes the major version, minor version, file reference number, parent file reference number, USN, time stamp, reason, source information, security identifier, file attributes, filename length, filename offset, and filename.

14. Volume

The Volume mode helps you work with volumes directly. This mode uses the following syntax:

FSUtil Volume [dismount Drive] [diskfree Drive]

The following list describes each of the command line arguments.

Drive

Specifies the drive to query or dismount.

dismount

Removes a drive from service. Dismounting a volume makes it unavailable for any activity.

diskfree

Displays the amount of free space on the drive. The output includes the number of free bytes, the total number of bytes on the drive, and the available number of free bytes (after any allocations).