Backups are critical part of healthy infrastructure. Without backup is like driving downhill without a brakes. Is it important to have them and be sure they are good.
USN journal stands for Update Sequence Number Journal and is a feature of Windows NT file system (NTFS) which maintains a record of changes made to the volume.
This issue is related to Barracuda backup appliance 690 and agent version running on the server is 6.5. Email notification received by the appliance is the following:
Errors ----------------------------------- Server: TERMINAL (10.10.11.120) Backup Agent - Error during backup selection - March 28 2020 1:05am CET System State - Error during backup selection - March 28 2020 1:06am CET Filesystem File Systems - USN journal error - March 28 2020 1:05am CET
Looking at the logs from the agent located at “C:\Program Files\Barracuda\Barracuda Backup Agent\log\bbtrace.txt” we are able to see some errors pointing to USN journal
04/02/2020 01:04:42 0x00000fe4 Critical: Exception - Description: Data error (cyclic redundancy check). Original: 23 Mapped: 111 Location: Brt::Util::Ioctl:c:\jenkins\workspace\bbs_new_agent_win\backupagentapp\libbrt\brt\util\Windows/Util.hpp:85 04/02/2020 01:04:42 0x00000fe4 Critical: Exception - Description: Failed to read from the usn journal log (Failed to read USN journal using FSCLT_READ_USN_JOURNAL. Please try rebuilding the USN journal for volume: \Device\HarddiskVolume3) Original: 171 Mapped: 171 Location: Backup::Volume::UsnJournal::ReadJournalRecords:C:\jenkins\workspace\bbs_new_agent_win\backupagentapp\Backup\Volume\Windows\UsnJournal.cpp:178
Following the official documentation from Barracuda https://campus.barracuda.com/product/backup/doc/54266940/resolve-the-failure-while-using-usn-journal-error/ we are going to proceed with deleting USN journal and recreating it.
Based on the error before and number of partitions we have on our server it is important to understand which partition is affected with the issue. To list all disk and locate \Device\HarddiskVolume3 we are going to use diskpart. In CMD type diskpart to start the tool. Once you have diskpart window type list volume to list all volumes on your server.
diskpart DISKPART> list volume Volume ### Ltr Label Fs Type Size Status Info Volume 0 Z DVD-ROM 0 B No Media Volume 1 System Rese NTFS Partition 364 MB Healthy System Volume 2 C NTFS Partition 40 GB Healthy Boot Volume 3 D Jaguar NTFS Partition 40 GB Healthy exit
based on the output from diskpart we are able to see that our \Device\HarddiskVolume3 is our D drive in Windows OS.
Now we are going to check USN journal info for our D drive using the command fsutil usn queryjournal D: The output is shown below:
C:\Windows\system32>fsutil usn queryjournal D: Usn Journal ID : 0x01d08855113f1363 First Usn : 0x0000000004280000 Next Usn : 0x000000000525cff8 Lowest Valid Usn : 0x0000000000000000 Max Usn : 0x7fffffffffff0000 Maximum Size : 0x0000000000f40000 Allocation Delta : 0x00000000001c0000 Minimum record version supported : 2 Maximum record version supported : 4 Write range tracking: Disabled
In our last step we are going to delete our old USN journal file for our D:\ drive, query the journal info and creating the journal.
C:\Windows\system32>fsutil usn deletejournal /D D: C:\Windows\system32>fsutil usn queryjournal D: Error: The volume change journal is not active. C:\Windows\system32>fsutil usn createjournal m=2147483648 a=1 D: C:\Windows\system32>fsutil usn queryjournal D: Usn Journal ID : 0x01d6093da75f86e4 First Usn : 0x0000000000000000 Next Usn : 0x0000000000000000 Lowest Valid Usn : 0x0000000000000000 Max Usn : 0x7fffffffffff0000 Maximum Size : 0x0000000080000000 Allocation Delta : 0x0000000000040000 Minimum record version supported : 2 Maximum record version supported : 4 Write range tracking: Disabled
Once USN journal is recreated your next backup will finish successfully.
Notice: If your issue is related to different partition keep in mind to replace D: with your correct partition letter.