microsoft.com/msj/0999/journal/journal.aspx. This mode uses the following
syntax:
FSUtil USN [createjournal m=MaximumSize a=AllocationDelta Volume]
[deletejournal [/D] [/N] Volume] [enumdata FileRef LowUSN HighUSN]
[queryjounral Volume] [readdata Filename]
The following list describes each of the command line arguments.
Volume Specifies the NTFS volume to manage. The journal always affects an entire volume.
Consequently, even though you can query statistics for an individual file, you must work with
a volume when creating or deleting the journal.
Filename Specifies the name of the file to manage. The filename can include both drive and
path information.
MONITORING THE FILE SYSTEM WITH THE FSUTIL COMMAND 249
m=MaximumSize Defines the maximum size of the USN journal in bytes. The journal can grow
larger than this value, but NTFS truncates it during the next checkpoint to less than this size. The
checkpoint size is the maximum size plus the allocation delta. Consequently, if you set the journal
size to 1,000 bytes and the allocation delta to 100, then NTFS automatically truncates the
journal when it reaches 1,100 bytes to 900 bytes in size.
Pages:
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618