Reading the Diagnostic Level Log

With regard to these trace statements:

DIAG - 2018-03-12 14:10:44.484 7668 Analyzing: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2379\Previous Files\02 Math and RNG\01 Vols\Touchdown Roulette.txt (0,478)[F,F] [0]

 

First DIAG statement indicates "Analyzing

- after the filename are two numbers in parenthesis (page_offset, page_length)  

- the values in braces will be T or F. The first indicates if a verify operation is required, and the second indicates if VRef (Index1) entry was found. If either are T the files will be processed.  

- In this case [F,F] indicates no further processing required.

- The finale [0] is the USN journal entry value, in this case a zero value means no USN is used (i.e. no -maxf parameter on the archive command)

DIAG - 2018-03-12 14:10:44.625 7668 Analyzing: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2379\Previous Files\02 Math and RNG\01 Vols\Touchdown Roulette.txt(10.3 KB)[T,T] [0]

DIAG - 2018-03-12 14:10:44.656 7668 *** Pre-Processing alternate StreamId=0x8 (1012 bytes)DIAG - 2018-03-12 14:10:44.656 7668 *** Pre-Processing alternate StreamId=0x9 (8 bytes)DETAIL - 2018-03-12 14:10:44.656 7668 Archived-> Y:\Previous Files\02 Math and RNG\01 Vols\Touchdown Roulette.txt (10.3 KB) A-----ZL-O- [L] 10589 (0) bytes archived 31ms (333 KB/sec).

 

The second DIAG statement indicates "Analyzing"  

- In this case [T,T] indicates verify required and no VRef entry, so the file will be processed.  

- StreamID = 0x08 is a REPARSE Stream  

- StreamID = 0x09 is a BACKUP_SPARSE_BLOCK  

- both are valid stream types as long as the BACKUP_SPARSE_BLOCK has a length under 8MB which in this case it does, 8 bytes.  

- the file is subsequently archived and '[L] 10589 (0) bytes' means the final data was linked to an existing blob, 10589 is the size, and (0) is the number of bytes stored.  

- the attributes 'A-----ZL-O-' indicate" 

A - Archive attribute

D - Directory

T - Temp file

S - System attribute

H - Hidden attribute

R - Read only attribute

Z - Sparse file

L - Reparse point

C - Compressed file

0 - Offline (stubbed) file

I - Do not content index

 

So in this case the files is: Read for archiving, Sparse, Reparse, and Offline. If this is a new stub, then this is expected behavior. If the same files keeps getting archived, then there's some issue.