You are here: Advanced Configuration Options > About the NTFS change journal

About the Windows NTFS change journal

Today, customers with large numbers of files (typically in the millions) can experience very long incremental backup times. Two factors contributing to the delayed backup times include:

Factor 1 – The Windows agent scans all files/directories on the specified volumes to determine modification times. Files with modification times more recent than the last successful master are included in the incremental backup.
Factor 2 – The Windows agent also looks at the ‘archive’ property on each file whose modification time does not meet the first criteria. If the property is set, then the file is included in the backup.

Factor 1 accounts for a large percentage of the time spent performing the backup, while Factor 2 contributes more processing overhead from the mechanics of examining the file properties. In addition, Factor 2 helps to inflate the size of the backup by including files that do not meet the modification criteria. Additionally, files with the archive property set should not automatically be included in incremental backups.

Use of the change journal can eliminate much of the overhead contributed by these factors. The change journal is a record of all changes to any file(s) on a given volume. When a change journal is created, Windows begins to log changes immediately to that journal without requiring a reboot of the server. Windows logs all file changes on a given volume along with the nature and time of the change.

During an incremental backup, the Unitrends agent queries the change journal to discover the changes made to files on the volume. It queries the data logged for each change to determine if the time of the change qualifies the data for back up. This is done by comparing the modified data to the time of the last successful master backup. Since journal records are kept only for changes to files or directories, determining which files to back up on a volume requires just a fraction of the time needed for the traditional volume scan. As the number of files on a volume increases, the benefit of using the change journal also increases.

The change journal feature is transparent. There are no visible configuration or setting options on the backup system or on Unitrends local agent interface. By default, the agent prefers to use the change journal during incremental backups. If the journal cannot be used, the agent uses the volume-scanning method to produce the list of files to back up.

See the following topics for details: