Journal sizes

[harryray2]

I'm using one particular instance to monitor very recent changes, maximum of about last 20 minutes.

I have load USN journal enabled and index recent changes enabled which seems to do a good job of catching the changes.

I was wondering if lowering either the enable journal maximum size or lowering the enable USN journal size would reduce the monitoring of the changes to fairly recently and help with the loading speed of the load journal into database?

I know (or at least I think I know) from a previous answer you gave me that the minimum size of the enable journal should be 32768 to make sure all changes are captured.
Would lowering this be detrimental to capturing changes made within 20mins (give or take)?

[void]

I was wondering if lowering either the enable journal maximum size or lowering the enable USN journal size would reduce the monitoring of the changes to fairly recently and help with the loading speed of the load journal into database?

Changing the Maximum size of your USN Journal should help the loading performance of Load USN Journal into the Recent Changes database.

I know (or at least I think I know) from a previous answer you gave me that the minimum size of the enable journal should be 32768 to make sure all changes are captured.
Would lowering this be detrimental to capturing changes made within 20mins (give or take)?

This will take some trial and error to find the right Maximum USN Journal size to match your number of file system changes.

Very roughly, expect each USN journal entry to consume about 1KB, so a maximum size of 32768 KB should give you about 30,000 file system changes.
There can be many entries for a single file.

Note: Windows 10 can very quickly make 30,000 file system changes.

I recommend the following values:
Maximum size: 32768 KB
Allocation delta: 4096 KB


ntfs_maximum_size
ntfs_allocation_delta

[raccoon]

What would you recommend as extreme values for modern computers built in the past 5 years? Any suggestions for bittorrent software that regularly has a thousand files open with random writes each second?

[void]

I personally use 131072 KB.
This gives me ~3 days worth of changes.

262144 KB - 1048576 KB would also be fine for very large volumes (10+ TB) with many changes.


To view your USN Journal:

• In Everything, from the Tools menu, click Options.
• Click the Indexes tab on the left.
• Check Index recent changes.
• Click the NTFS tab on the left.
• Select your volume of interest (eg: C:)
• Check Load USN Journal into the Recent Changes database. (can be toggled at any time to load and unload this database)
• Click OK.
• In Everything, search for rc: to list all the files in your USN Journal.

[harryray2]

Currently the size is set to:

Maximum size: 32768 KB
Allocation delta: 4096 KB

I tried halving the max size to 16384 but Everything wont allow me to do it.
It just returns to 32768

[void]

The new size is not immediate.

The new size will take effect at the next allocation delta. (after about 4096 KB changes have been made)
I've added this information to the tooltips and documentation.

[harryray2]

I'm trying to revise two of my instances upwards and one down. The size on one instance is being reflected by the other two.

Is it possible to have a different size for each instance?

[void]

No, there can only be one maximum USN Journal size per volume.