IOLogSum Remarks

Before Using IOLogSum

If Perl is not installed on your system, if you are connected to the Internet, you can download a free version from the ActiveState Web site(

IOLogSum Report

When used with NtfrsUtl inlog and NtfrsUtl outlog, the IOLogSum report can be used to determine which files are involved in FRS replication, and what has caused them to replicate. When used with NtfrsUtl idtable, IOLogSum can generate a report describing the state of all files and folders known to an FRS member.

Familiarity with FRS concepts and terminology is required in order to interpret IOLogSum reports.

Each IOLogSum report starts by identifying the name of the file that it processed, and the sort options used to generate the report. Then, for every replica set in which the computer participates, the report lists one row per change order.

The following table lists and describes each column in the report.

Column Heading Description
SeqNumber Specifies the unique sequence number for the change order. For NtfrsUtl idtable reports, this is always reported as 00000000.
EventTime Specifies the USN Journal Entry Timestamp; in other words, the time the file was changed on the originating machine.
FileVersNum Specifies the file version number, incremented each time the file is closed.
FileUsn Specifies the USN that the file must match on the Fetch request.
FileSize Specifies the file size (in KB).
FileGuid Specifies the object ID of the file or directory. For brevity, only the last 8 digits are printed.
OriginatorGuid Specifies the GUID of the originating member. For brevity, only the last 8 digits are printed. The originator GUID can be mapped back to the server name by searching the NtfrsUtl sets output.
Cxtion Specifies the GUID of the remote connection – for brevity, only the last 8 digits are printed
FileName Specifies the Unicode file name.
Flags Specifies a valid Change Order Flag. Valid flags are shown in the following list.
  • Abort - Set when CO is being aborted.
  • VVAct - Set when VV activate request is made.
  • Content - Valid content command.
  • Locn - Valid location command.
  • LclCo - CO is locally generated.
  • Retry - CO needs to retry.
  • InstallInc - Local install not completed.
  • Refresh - CO is an upstream-originated file refresh request.
  • OofOrd - Do not check/update version vector.
  • NewFile - If CO fails, delete IDTable entry.
  • DirectedCo - This CO is directed to a single connection.
  • DemandRef - CO is a downstream demand for refresh.
  • VVjoinToOri - CO is from vvjoin to originator.
  • MorphGen - CO generated as part of name morph resolution.
  • MoveinGen - This CO was generated as part of a sub-dir MOVEIN.
  • OidReset - This CO reset the Object ID (OID) back to the FRS defined value.
  • CmpresStage - The stage file for this CO is compressed.
  • MD5 - The MD5 hash of the file is included.
  • DELETED - The file has been deleted. On idtable reports, this indicates that the record is a tombstone, ensuring the file remains deleted throughout the replica set.
LocationCmd Specifies the Change Order Location command. Valid Location Commands are shown in the following list.
  • CREATE - Create a new file or directory.
  • DELETE - Delete a file or directory.
  • MOVEIN - Rename a file or directory from a point outside the Replica Tree, into a Replica Tree on the same volume.
  • MOVEOUT - Rename a file or dir from a point inside the Replica Tree to a point outside the Replica Tree on the same volume.
  • MOVERS - Rename a file or directory from one Replica Tree to another Replica Tree on the same volume (currently unsupported).
  • MOVEDIR - Rename a file or directory from one directory to another in the same Replica Tree.
ContentCmd Specifies the Change Order content changes from the USN reason. Flags set in the NTFS change log describing modifications to the file.
  • Close - Change log close record.
  • Create - File or directory was created.
  • Delete - File or directory was deleted.
  • RenNew - File or directory was renamed.
  • DatOvrWrt - Main file data stream was overwritten.
  • DatExt - Main file data stream was extended.
  • DatTrunc - Main file data stream was truncated.
  • Info - Basic info change (attrib, last write time, etc.).
  • Oid - Object ID change.
  • StreamNam - Alternate data stream name change.
  • StrmOvrWrt - Alternate data stream was overwritten.
  • StrmExt - Alternate data stream was extended.
  • StrmTrunc - Alternate data stream was truncated.
  • EAChg - Extended file attribute was changed.
  • Security - File access permissions changed.
  • IndexableChg - File change requires re-indexing.
  • HLink - Hard link change.
  • CompressChg - File compression attribute changed.
  • EncryptChg - File encryption changed.
  • Reparse - Reparse point changed.

By default, the records are sorted by sequence number, but it is possible to sort by other columns.