Iologsum Remarks

Article
10/08/2009

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

IOLogSum Remarks

Before Using IOLogSum

If Perl is not installed on your system, if you are connected to the Internet, you can download a free version from the ActiveState Web site.

IOLogSum Report

When used with NtfrsUtl inlog and NtfrsUtl outlog, the IOLogSum report can be used to determine which files are involved in FRS replication, and what has caused them to replicate. When used with NtfrsUtl idtable, IOLogSum can generate a report describing the state of all files and folders known to an FRS member.

Familiarity with FRS concepts and terminology is required in order to interpret IOLogSum reports.

Each IOLogSum report starts by identifying the name of the file that it processed, and the sort options used to generate the report. Then, for every replica set in which the computer participates, the report lists one row per change order.

The following table lists and describes each column in the report.

Column Heading	Description
SeqNumber	Specifies the unique sequence number for the change order. For NtfrsUtl idtable reports, this is always reported as 00000000.
EventTime	Specifies the USN Journal Entry Timestamp; in other words, the time the file was changed on the originating machine.
FileVersNum	Specifies the file version number, incremented each time the file is closed.
FileUsn	Specifies the USN that the file must match on the Fetch request.
FileSize	Specifies the file size (in KB).
FileGuid	Specifies the object ID of the file or directory. For brevity, only the last 8 digits are printed.
OriginatorGuid	Specifies the GUID of the originating member. For brevity, only the last 8 digits are printed. The originator GUID can be mapped back to the server name by searching the NtfrsUtl sets output.
Cxtion	Specifies the GUID of the remote connection – for brevity, only the last 8 digits are printed
FileName	Specifies the Unicode file name.
Flags	Specifies a valid Change Order Flag. Valid flags are shown in the following list. Abort - Set when CO is being aborted. VVAct - Set when VV activate request is made. Content - Valid content command. Locn - Valid location command. LclCo - CO is locally generated. Retry - CO needs to retry. InstallInc - Local install not completed. Refresh - CO is an upstream-originated file refresh request. OofOrd - Do not check/update version vector. NewFile - If CO fails, delete IDTable entry. DirectedCo - This CO is directed to a single connection. DemandRef - CO is a downstream demand for refresh. VVjoinToOri - CO is from vvjoin to originator. MorphGen - CO generated as part of name morph resolution. MoveinGen - This CO was generated as part of a sub-dir MOVEIN. OidReset - This CO reset the Object ID (OID) back to the FRS defined value. CmpresStage - The stage file for this CO is compressed. MD5 - The MD5 hash of the file is included. DELETED - The file has been deleted. On idtable reports, this indicates that the record is a tombstone, ensuring the file remains deleted throughout the replica set.
LocationCmd	Specifies the Change Order Location command. Valid Location Commands are shown in the following list. CREATE - Create a new file or directory. DELETE - Delete a file or directory. MOVEIN - Rename a file or directory from a point outside the Replica Tree, into a Replica Tree on the same volume. MOVEOUT - Rename a file or dir from a point inside the Replica Tree to a point outside the Replica Tree on the same volume. MOVERS - Rename a file or directory from one Replica Tree to another Replica Tree on the same volume (currently unsupported). MOVEDIR - Rename a file or directory from one directory to another in the same Replica Tree.
ContentCmd	Specifies the Change Order content changes from the USN reason. Flags set in the NTFS change log describing modifications to the file. Close - Change log close record. Create - File or directory was created. Delete - File or directory was deleted. RenNew - File or directory was renamed. DatOvrWrt - Main file data stream was overwritten. DatExt - Main file data stream was extended. DatTrunc - Main file data stream was truncated. Info - Basic info change (attrib, last write time, etc.). Oid - Object ID change. StreamNam - Alternate data stream name change. StrmOvrWrt - Alternate data stream was overwritten. StrmExt - Alternate data stream was extended. StrmTrunc - Alternate data stream was truncated. EAChg - Extended file attribute was changed. Security - File access permissions changed. IndexableChg - File change requires re-indexing. HLink - Hard link change. CompressChg - File compression attribute changed. EncryptChg - File encryption changed. Reparse - Reparse point changed.

By default, the records are sorted by sequence number, but it is possible to sort by other columns.

Sorting by File GUID makes it easy to detect repetitive changes to single files and the times at which they occurred (for example, once per hour).
Sorting by Event Time is useful for identifying older change orders that may indicate a particular partner has been unavailable for a while. The IOLogSum report, coupled with the report that Connstat Overview generates, can tell you what change orders are pending for the delinquent partner.

Iologsum Remarks