What's Causing that DFSR Change Storm?

re: What's Causing that DFSR Change Storm?

MarkRenoden [MSFT] — Wed, 13 Jun 2012 21:12:30 GMT

Hi johnmsanz

The findstr command used in the example gathers all the time stamps for any USN update (it’s a pretty rough approximation). This includes new files created in replication groups, deletions, file updates and changes to files that are filtered from replication. If you want to be more specific (for example – just file updates that originate on the server where log harvesting took place), you need to do something trickier – much like the PowerShell parsing scripts later in the post or the additional findstr operation you suggest.

Gathering what you need starts with understanding the log file format in more detail and then crafting a parser that will isolate the time stamps for the events that are important to you.

- Mark

re: What's Causing that DFSR Change Storm?

johnmsanz — Tue, 12 Jun 2012 14:28:58 GMT

I tried this but I believe my results may have been skewed due to there being other lines resulting from the findstr beyond just the "UsnConsumer::UpdateIdRecord ID record updated from USN_RECORD", for example:

"UsnConsumer::CreateNewRecord ID record created from USN_RECORD:"

"UsnConsumer::ProcessUsnRecord Filtered USN_RECORD:"

"UsnConsumer::TombstoneOrDelete ID record deleted from USN_RECORD:"

"UsnConsumer::UpdateUsnOnly USN-only update from USN_RECORD:"

How should the above lines be handled in terms of the analysis in this blog? Should any of these also be counted as "changes", or should I do an additional findstr on the output to omit all lines except for lines containing "UpdateIdRecord"?

Thanks!

re: What's Causing that DFSR Change Storm?

sgrinker — Fri, 01 Jun 2012 21:24:16 GMT

Outstanding post! Awesome job sluething Mark, and very slick use of a number of different tools to pull the data out!!