Video Screencast Help

EV FSA Policies using Last Access Date

Created: 25 Sep 2012 • Updated: 07 Dec 2012 | 5 comments
This issue has been solved. See solution.

Hi All,

Using EV 8.0 SP5 i am archiving a number of volumes on a Windows 2003 Server, the volume policy is based upon Last Accessed < 13 Months. Unfortunately, this policy is not producing good results in relation to what gets archived.

After some investigation i conculded EV FSA is working correctly but there is a unknown system process which is causing the files on the server to be accessed. This is based upon inspection of a number of folders containing files we know have not been accessed by anyone for years however the last access date was within the last 3 months at 3 o'clock in the morning.

Is it possible that EV FSA could somehow be responsible perhaps during an archive run? Unlikely i know but i am desperate to understand what could be causing the issue. Other thoughts i had could were that it could be McAfee AV software but this doesn't scan these volumes, Netbackup Enterprise is used for backups but that wouldn't change access dates, another thought was diskeeper so i plan to remove this.

I am reluctant to move to a policy based on Last Modified Date because we do have lot of frequently accessed files which haven't been modified for a while.

If anyone can offer me some advice on how to track what might be causing the problem it would be much appreciated.

Thanks

Darryl.

 

Comments 5 CommentsJump to latest comment

TonySterling's picture

@RahulG  That article won't apply as the items aren't archived yet.

@Darryl  It shouldn't be EV as it can reset the access date, just like your backup software can, as long as the account that the task is running under has the appropriate permissions.

 

SOLUTION
Jeff Shotton's picture

I doubt it is diskkeeper either, since that should work at the block level. Do you have any monitoring or auditing software in place?

You could set up monitoring of some sort in order to track this down. Using something like process mon or filemon to track all data access would be far too resource intensive, so I think you are going to need to look a little higher level and hopefully track it down.

To that end, maybe try using performance monitor to track I/O of processes running on the system, and log at a suitably sparse interval that you dont fill the disk up. After all, whatever is running must be running for a time to touch all the files.

However, maybe this was something like Windows search building an index for the first time..therefore a one off event?

Incidentally, NtfsDisableLastAccessUpdate is set to 1 on windows 2008+ so unless you change it you would need to change your access policy when you upgrade.

If you use last modified date then you could use it with a pass-through recall cache so that if items are accessed a lot there is a copy available on the local disk.....more info on pass through recall: http://www.symantec.com/docs/HOWTO49599

Regards,

Jeff

Jeff Shotton

Principal Consultant

Adept-tec Ltd

Website: here

djbrown71's picture

Hi Jeff, Thanks for th reply. I was thinking a long these lines with regards auditing. I am going to try file access auditing overnight on a sample area with perfm mon tracking as well.