NTFS USN (change) journal

[PiqueABoo]

Anyone looked at these in detail and know what they're talking about? Or have you ever encountered a succinct, definitive take on this?

 

Looking at a bunch of servers, on many it's using ~130,000 clusters[1] which is around the 512MB I've seen cited as the default for the maximum size. But looking at some others its apparently using ~1,000,000 clusters which is around 4GB although I'm not yet sure I believe that... does the default size get bigger subject to volume size e.g. if it's say 30GB, you get a bigger journal?

 

In both examples these are single DC systems and some have been around for a while and are getting a bit tight for space. I'm tempted to occasionally delete the USN journal with fsutil, add the magic reg entry and restart the FRS service (a la the usual "journal wrap" error recovery) to see what happens to disk space... would that be a very bad thing to do?

 

 

[1] They are sparse files so the apparent "file size" in bytes (e.g. the 6 - 9 GB I've seen so far) tells you nothing about the actual space used on the disk, hence the focus on clusters.

Edited March 8, 2010 by PiqueABoo
default = default maximum size