Windows agent file-level backup failure due to change journal wrap or Journal range exceeded

SUMMARY

How to fix backup failures due to change journal wrap errors

ISSUE

Unitrends' agent for Windows uses each volume's NTFS USN change journal to determine which files have been modified since the prior full or incremental backup's point-in-time.  If the USN change journal for the volume in question does not contain the point-in-time of the prior successful backup then we cannot trust the journal to contain information for all of the file system's changes since that backup, and we fail the backup attempt.


Sample error message:
 
----- Error Messages -----
The first record available for reading from the Change Journal for volume 'C:/' is higher then agent backup in previous backup and indicate there is a chance that file or directory changes will be not backed up. Please take a new master backup to correct a problem.
Change Journal for volume C:/ appears to have wrapped.
Refer to the Unitrends Agents manual for instructions on enlarging the Change Journal size.
Volume 'C:/' (//?/VOLUME{72F45FDD-3A8D-11E7-80B4-806E6F6E6963}/): The USN Journal was not registered because it experienced a wrap condition.
Backup job was terminated due Change Journal registration errors. Please correct the problem and perform a new full backup.
Windows Instant Recovery is not possible for this backup.
----- End Error Messages -----

RESOLUTION

Basic resolution:

Unitrends has made Windows agent changes to help prevent this from occurring.  Please upgrade to the latest agent release and then run a new, successful full backup of the protected asset(s) in question


You may download the latest Windows agent from https://support.unitrends.com/UnitrendsBackup/s/downloads.

Advanced resolution:

To address the USN change journal is too small issue, follow the steps below:

1. Connect to the System being backed up and open a cmd admin 
2. Check current journal size (note the Maximum Size) (using C: in this example, you may have different or additional volumes where a journal wrap has occurred):


fsutil usn queryjournal C:

3. Open Calculator in programmer mode. Then select the Hex radio option.
4. Paste in the Maximum Size value. Then change the radio to the decimal option.
5. Divide by 1024 twice to convert the units to Megabytes.
6. Confirm you have 4 GB free on the volume in question (because 4 GB is large enough for most environments to avoid a reoccurrence).
7. Create a 4 GB journal for the C:

 
fsutil usn createjournal m=4294967296 a=1 C:

Note:  For advanced administrators, you may chose to use a different size in this command.  Just keep in mind the root causes.

8. Run a new, successful full backup of the client(s) in question.

Should the problem continue:


1. You may need to increase your backup frequency to daily or more frequently, depending on change rate.
2. You may need to use tools from Sysinternals to identify what files are being opened and modified.  In some cases, antivirus software have been found to make copies of files when they are being scanned on access, for example.

CAUSE

The root cause is one of two things, or both:

1. The USN change journal is too small
2. The backup frequency is too infrequent

NOTES

​Note:  For advanced administrators, you may chose to set the change journal to a different size using this command.

References  

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc788042(v=ws.11)
 

Was this article helpful?
0 out of 0 found this helpful
Have more questions? Contact us