When used with NtfrsUtl inlog and NtfrsUtl outlog,
the IOLogSum report can be used to determine which files are
involved in FRS replication, and what has caused them to replicate.
When used with NtfrsUtl idtable, IOLogSum can generate a
report describing the state of all files and folders known to an
Familiarity with FRS concepts and terminology is required in
order to interpret IOLogSum reports.
Each IOLogSum report starts by identifying the name of the file
that it processed, and the sort options used to generate the
report. Then, for every replica set in which the computer
participates, the report lists one row per change order.
The following table lists and describes each column in the
Specifies the unique sequence number for the change order. For
NtfrsUtl idtable reports, this is always reported as
Specifies the USN Journal Entry Timestamp; in other words, the
time the file was changed on the originating machine.
Specifies the file version number, incremented each time the
file is closed.
Specifies the USN that the file must match on the Fetch
Specifies the file size (in KB).
Specifies the object ID of the file or directory. For brevity,
only the last 8 digits are printed.
Specifies the GUID of the originating member. For brevity, only
the last 8 digits are printed. The originator GUID can be mapped
back to the server name by searching the NtfrsUtl sets
Specifies the GUID of the remote connection – for brevity, only
the last 8 digits are printed
Specifies the Unicode file name.
Specifies a valid Change Order Flag. Valid flags are shown in
the following list.
Abort - Set when CO is being aborted.
VVAct - Set when VV activate request is made.
Content - Valid content command.
Locn - Valid location command.
LclCo - CO is locally generated.
Retry - CO needs to retry.
InstallInc - Local install not completed.
Refresh - CO is an upstream-originated file refresh
OofOrd - Do not check/update version vector.
NewFile - If CO fails, delete IDTable entry.
DirectedCo - This CO is directed to a single
DemandRef - CO is a downstream demand for refresh.
VVjoinToOri - CO is from vvjoin to originator.
MorphGen - CO generated as part of name morph
MoveinGen - This CO was generated as part of a sub-dir
OidReset - This CO reset the Object ID (OID) back to the
FRS defined value.
CmpresStage - The stage file for this CO is
MD5 - The MD5 hash of the file is included.
DELETED - The file has been deleted. On idtable
reports, this indicates that the record is a tombstone, ensuring
the file remains deleted throughout the replica set.
Specifies the Change Order Location command. Valid Location
Commands are shown in the following list.
CREATE - Create a new file or directory.
DELETE - Delete a file or directory.
MOVEIN - Rename a file or directory from a point outside
the Replica Tree, into a Replica Tree on the same volume.
MOVEOUT - Rename a file or dir from a point inside the
Replica Tree to a point outside the Replica Tree on the same
MOVERS - Rename a file or directory from one Replica
Tree to another Replica Tree on the same volume (currently
MOVEDIR - Rename a file or directory from one directory
to another in the same Replica Tree.
Specifies the Change Order content changes from the USN reason.
Flags set in the NTFS change log describing modifications to the
Close - Change log close record.
Create - File or directory was created.
Delete - File or directory was deleted.
RenNew - File or directory was renamed.
DatOvrWrt - Main file data stream was overwritten.
DatExt - Main file data stream was extended.
DatTrunc - Main file data stream was truncated.
Info - Basic info change (attrib, last write time,
Oid - Object ID change.
StreamNam - Alternate data stream name change.
StrmOvrWrt - Alternate data stream was overwritten.
StrmExt - Alternate data stream was extended.
StrmTrunc - Alternate data stream was truncated.
EAChg - Extended file attribute was changed.
Security - File access permissions changed.
IndexableChg - File change requires re-indexing.
HLink - Hard link change.
CompressChg - File compression attribute changed.
EncryptChg - File encryption changed.
Reparse - Reparse point changed.
By default, the records are sorted by sequence number, but it is
possible to sort by other columns.
Sorting by File GUID makes it easy to detect repetitive changes
to single files and the times at which they occurred (for example,
once per hour).
Sorting by Event Time is useful for identifying older change
orders that may indicate a particular partner has been unavailable
for a while. The IOLogSum report, coupled with the report that
ConnStat generates, can tell you what
change orders are pending for the delinquent partner.