Fileshare backup detects way too many changed files

[FrancWest]

Case #04041658. As a test I have a fileshare backup job running alongside the normal block level backup of the same VM. This night I noticed that the fileshare backup job backed-up 113.365 files and 6.739 folders (206,2 GB). I immediately thought the worst of course, since so many changed files in one day is normally impossible. As a check I ran a quick backup job of that same VM (since the VM is still being backed up with a regular backup also). This quick backup gave the following results: Hard disk 2 (1,5 TB) 13,3 GB read at 2 GB/s [CBT]. This is way less than the 206 GB the fileshare backup job backed-up and a normal amount of changed data in our situation.

Why did the fileshare backup job backup so much changed data this evening? Yesterday it only backed up 228 folders and 363 files (3,9 GB), which is normal.

[Egor Yakovlev]

Hi Franc!
Interesting case, I will keep an eye on your ticket. Any chance that scheduled antivirus scan landed on that file server between Monday and Tuesday?

[FrancWest]

Hi,

A scheduled virus scan runs every night at 12 a.m, so yes, but not only on that night.

[veremin]

Any other scheduled activity that might affect existing files? Defrag, Deduplication garbage collection, etc.?

Anyway, just for testing purposes you might disable antivirus activity for one night and see whether it makes a difference.

Thanks!

[FrancWest]

Deduplication is not running on that volume. Defrag runs once a week, but that doesn't change files only blocks. Furthermore, that doesn't explain why the block level backup didn't backup that much data. If data was actually changed due to the defrag or any other job that modifies the filesystem, then it should also be captured inside the block-level backup.

This evening I had a normal amount of changed files again, with still the anti-virus scan being scheduled.

[Dima P.]

Thanks for the provided details. I've shared your case ID and this thread with nas backup team, stay tuned!