NTFS USN/Change Journal

[Rick_DeBay]

How is the NTFS USN/Change Journal used for backups?  Be as detailed as possible.

Is the last USN saved after a successful snapshot?  Is a USN saved after each full and each incremental/differential?  Do the full and incremental/differential share the same saved USN, or is there one for full and one for incrementals/differentials?  Is there one for each selection list?

I'm assuming that this implies two USN (one for the last full, and one for the last incremental or differential) for each selection list.

[teiva-boy]

Rather than a traditional Archive bit, BE can instead use the NTFS change journal to backup files that have changed or been modified since the last backup.  By using the NTFS Change Journal, BE does NOT have to traverse the entire file system and read a file's properties, rather only the database held within the NTFS volume.  

If you want to learn more about the NTFS change journal, go to Microsoft's technet for more into.

[pkh]

See pages 267 - 268 of the BE 2010 Admin Guide.

[Rick_DeBay]

I understand how the USN journal works.  I need to know how BE uses it.

[Rick_DeBay]

The Admin Guide does not contain any details as to the implementation.

[pkh]

To quote the Admin Guide

========================

WhenBackup Exec runs a full or incremental backup, the time the backup launches

is recorded in the Backup Exec database. The next time an incremental or

differential backup launches, Backup Exec compares the file system time to the

backup time recorded in the Backup Exec database. If the file system time is later

than the database time, the file is backed up.

=========================

Isn't the above clear enough about how BE uses the change journal?

[Rick_DeBay]

No, it is not clear.  It does not make clear whether or not it stores just one time, or the time of the full and the time of the incremental.
Storing one time means that a differential after an incremental would only consist of changes since the incremental; thus the differential actually is an incremental.
A literal reading would give that result, however since that is completely incorrect I need confirmation.

Also, using the USN would mean that timestamps are irrelevant, since the journal tracks all file changes.

[pkh]

It does not make clear whether or not it stores just one time or the time of the full and the time of the incremental

AGAIN, here is what is in the Admin Guide.

When Backup Exec runs a full or incremental backup, the time the backup launches is recorded in the Backup Exec database

Let me try to explain the above.  Let's say you run a Full backup on Sat at 11 p.m.  BE will record the time in its database.

If you run an Incremental on Mon at 11 p.m.,  BE will again record this time in its database.  It will then compare the modified time of the files with the timestamp from the Full backup and backup those files whose modified time are later than the Full backup timestamp.  If you run an Incremental backup on Tues, BE will record the timestamp in its database.  It will compare the modified time of the files with the Monday Incremental backup timestamp and backup those files whose modified time are later than the Mon Incremental backup timestamp.

If, however, you are running Differential backups on Mon and Tue, then no further timestamps will be recorded in the BE database.  Files whose modified time are later than the Full backup timestamp will be backed up on both days.

I hope my explanation is clear enough.  If not, let me know.

[Rick_DeBay]

AGAIN, does it save one time or two?  The admin guide doesn't make it clear.  If it stores just one, it is impossible to properly implement differential backups.  A differential that takes place after an incremental would perform identically to an incremental.
If you don't know, and can only parrot the admin guide, just say so.  Then we can find someone who has access to the BE specifications and can see how Veritas intended to implement it.

[Ben_L_]

The start and end time for each backup is stored in the database, so there will many times saved in the database.  The number of times in the database does not make much of a difference in this instance.  Since Backup Exec differential backups back up all data changed after the last full or incremental, only changed data since the latest incremental or full will get backed up.

[pkh]

Alas, my secret is out.  My puny brain cannot fathom your novel scheme of doing a differential backup after an incremental backup.  Normally, differential backups are done after a full backup.  What are the advantages of your scheme?  Do you also do incremental backups after a few differential backups?