How do I list the files in a particular saveset ? 2

[libove]

I'm trying to track down where several hundred megabytes of changed data is coming from each day on each of several of my Windows 2000 / XP clients. What I want is just to be able to list the files which are in a particular saveset, or to list the files which are backed up from a particular client during a particular backup run.

(Networker 6.0, NT 4.0 server, 2K/XP clients).

Thanks!
-Jay

 

[mgdaviso]

Don't think you can actually list the files in a saveset, but you can check the messages log as that should summarize how much data has been backed up from each server volume. good starting point
HTH Mike davison
mike.davison@avon.com

 

[ptwork]

Actually, you can get to what you are looking for using a two step process that involves running mminfo to get a save time and nsrinfo to display the files. Your sequence will be something like this

mminfo -r &quot;name,nsavestime&quot; -c <clientname>

This will give you the save set name and time for savesets on clientname. Once you find the saveset you want, take the nsavetime an insert it into the <time> variable below.

nsinfo -t <time> <clientname>

Cheers
pt

 

[libove]

Thanks. Here's what I got, so maybe I'm doing something wrong:

C:\> mminfo -r &quot;name,nsavetime&quot; -c <Client>
name save time
<1>C:\ 1012898073
<1>C:\ 1013330196
.....
C:\ 1012898072
C:\ 1012984478
.....
C:\ 1018337651

C:\> mminfo -t 1018337651
volume client date size level name
...
cheshire.008 beast3 04/09/02 784 MB incr C: ...

C:\> mminfo -t 1018337651 beast3
mminfo: no matches found for the query

C:\> mminfo -t 1018337651 -c beast3
volume client date size level name
cheshire.008 beast3 04/09/02 784 MB incr C:

So, how do I list the actual files underneath C:\ which are included in the saveset with the time stamp e.g. 1018337651 for this client &quot;beast3&quot; ?

Thanks!
-JAy

 

[ptwork]

Hmm, worked fine when I tested it today (Unix System, however). I'll take a check tomorrow on one of my NT clients and get back to you. The <1> looks a bit odd to me

Cheers
PT

 

[ulsj]

Hi!

I run the command posted by ptwork on NT networker 6.1
and it works fine. I been looking for something like this for a long time. Tanks ptwork

libove: you should use nsrinfo not mminfo.
tip use also savetime to get a readeble time format.

the <1> can be the 2GB limit for savesets on pre 6.x

Good luck Jay

 

[ptwork]

Thanks for the assist Jay, I missed the fact that he used mminfo Must have been the beer
pt

 

[libove]

Thanks to all of you. I ran nsrinfo to get a usage message, and completely missed that it even had a &quot;-t&quot; option, so I saw one on mminfo and tried that instead.

In fast, the recommended nsrinfo did exactly what I want.

Thanks again!
-Jay

 

[libove]

Okay, so now that I have a list of the files included in a saveset, I need to ask the underlying question that was nagging at me:

Why is my nightly backup of each workstation on my LAN pulling in hundreds of megabytes of data, when I don't see evidence of changes in hundreds of megabytes of files?

I ran the mminfo and nsrinfo commands we've discussed above, and generated a list of all of the files saved in the most recent (incremental) saveset for a particular backup client (Windows XP Professional). The list of files includes many many files with modification times much older than the past day (in fact most of the files in the most current incremental saveset from that client have mod times last year).

Am I reading the nsrinfo output correctly?
Is the output of &quot;nsrinfo -t <timestamp> <clientname>&quot; the actual list of files only in that saveset? .. or is it the list of all files currently indexed for that client as of that time?

What I need is a list just of the files in that particular saveset.

Thanks again, everyone.
-Jay

 

[gerudman]

Hi

As far as I can remember an incremental backup would include any file that has been accessed and not neccesarily modified. Might this be possible in your environment that people just access files without modifying?

George

 

[Zantor]

You might also want to check that you are actually running an incremental and not a differential (level 1-9).
From the online help:
[1 -- 9] -- backs up files that have changed since the last lower numbered backup level. For example, a level 1 backup backs up all the files that have changed since the last full backup (considered a level zero. A level 3 backup backs up all the files that have changed since the last level 2 backup, level 1 backup, or full backup.

Also check that your group setting for schedule or level is not overriding your schedule set in the client.

 

[libove]

I have confirmed that the backup is an incremental. Here are some excerpts. The client of interest is called &quot;beast3&quot;.

From this morning's Savegroup Completion email:
beast3:C:\ 663785 KB estimated
beast3: C:\ level=incr, 664 MB 00:26:35 3285 files
.....

On the server:
C:> mminfo -r &quot;name,nsavetime&quot; -c beast3
.....
C:\ 1018510443
C:\ 1018596858

C:> nsrinfo -t 1018596858 beast3 > C:\Temp\FileList.txt

Looking through C:\Temp\FileList.txt (actually, processing it through a PERL script which finds large files then reports their timestamp, size, and name) I find that saveset ID 1018596858 includes files with modification times earlier than the past one day (I run incrementals or better every night, and before someone asks, yes they have all been successful in recent nights). Some of the files listed by the nsrinfo command include:

2001/1/23 11:19 3485968 C:\Program Files\Common Files\Microsoft Shared\CDO\CDOEX.DLL
1999/10/8 9:3 1556480 C:\Program Files\Common Files\Microsoft Shared\Grphflt\FPX32.FLT
1999/10/8 9:31 1093632 C:\Program Files\Common Files\Microsoft Shared\TextConv\WRD6EX32.CNV
2000/1/21 22:23 1843246 C:\System Volume Information\_restore{364A5D0E-8E4A-4F79-96A7-F8A2E150BE6A}\RP74\A0018737.rbf
2002/4/4 16:13 3626958 C:\TEMP\wwi_support.zip

Questions that this raises in my mind:
1. Should it be backing up C:\System Volume files at all as part of C:\ ? Shouldn't that be part of system state and excluded from the regular filesystem backup? This is a Windows XP Professional system, a domain member. The Savegroup completion message doesn't say anything one way or another about SYSTEM STATE or SYSTEM DB or SYSTEM FILES on this particular client. On a Windows 2000 client, it does specifically treat those three SYSTEM* items differently. Maybe part of my problem is that I'm running a version of the NSR client which doesn't know what Windows XP is?
2. I have an NSR.DIR file in C:\ which contains these lines:
skip: &quot;Adobe Albums&quot;
skip: hiberfil.sys
skip: pagefile.sys
+skip: recycled
+skip: recycler
+skip: Temp
+skip: tmp
It doesn't seem to be skipping C:\Temp, from the output above. Have I botched the NSR.DIR file, or is NSR not reading it correctly? (If it matters, all filesystems on my network are NTFS, there are no FAT filesystems).

Thanks for your continuing help!
-Jay

 

[ulsj]

Hi! libove

Firs use the new 6.2 client on you XP. The 6.2 has support for XP. Second the directive is case sensetive. If you have files or directives named tmp, Tmp and TMP you have to include all three in the directive.

Hope this helps

-Ulf

 

[libove]

Thanks ulsj for the suggestions.

I have upgraded to 6.2, and verified that the nsr.dir files have all variations of spellings on the directories to be excluded, and still the nightly incremental backups are storing much more data than I expect them to.

By the way, the same symptom occurs on Win2K clients, so we can eliminate XP as the specific source of the problem.

What else can I do to try to either
1) figure out exactly what files are in a saveset, or
2) figure out by some other means exactly what files are getting backed up on any given night? (Maybe a higher debug / log level on a command somewhere?)

Thanks again!
-Jay
(just back from a CISSP review and test, whew; that's why I didn't answer for more than a week!)