FSCTL_DELETE_USN_JOURNAL - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// ntifs.h
// CTL_CODE(0x0009, 0x03e, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define FSCTL_DELETE_USN_JOURNAL 0x000900F8
View the official Windows Driver Kit DDI reference// winioctl.h
// CTL_CODE(0x0009, 0x03e, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define FSCTL_DELETE_USN_JOURNAL 0x000900F8
View the official Win32 API referenceNo description available.
The FSCTL_DELETE_USN_JOURNAL control code deletes the update sequence number (USN) change journal on a volume, or waits for notification of change journal deletion. See Remarks.
FSCTL_DELETE_USN_JOURNAL
FSCTL_DELETE_USN_JOURNAL can be used to:
Delete a change journal. The NTFS file system starts a deletion operation and returns immediately to the calling process, unless the USN_DELETE_FLAG_NOTIFY flag is set in the DeleteFlags member of DELETE_USN_JOURNAL_DATA.
If the USN_DELETE_FLAG_NOTIFY and USN_DELETE_FLAG_DELETE flags are both set, a call to FSCTL_DELETE_USN_JOURNAL begins the deletion process. Then the call either blocks the calling thread and waits for the deletion (on a synchronous or non-overlapped call), or sets up event notification by using an I/O completion port or other mechanism, and returns (on an asynchronous or overlapped call).
Receive notification that a change journal deletion is complete, by setting only USN_DELETE_FLAG_NOTIFY. If you do so, the FSCTL_DELETE_USN_JOURNAL operation either waits until the deletion completes before returning (on a synchronous or non-overlapped call), or sets up event notification by using an I/O completion port or other mechanism (on an asynchronous or overlapped call).
To perform this operation, call FltFsControlFile or ZwFsControlFile with the following parameters.
FileObject [in]: Parameter for FltFsControlFile only. A file object pointer for the remote volume. This parameter is required and can't be NULL.
FileHandle [in]: Parameter for ZwFsControlFile only. A handle for the remote volume. This parameter is required and can't be NULL.
FsControlCode [in]: A control code for the operation. Use FSCTL_CREATE_USN_JOURNAL for this operation.
InputBuffer [in]: Pointer to a DELETE_USN_JOURNAL_DATA structure that contains the parameters for the operation.
InputBufferLength [in]: The size, in bytes, of the input buffer.
OutputBuffer [out]: Not used.
OutputBufferLength [in]: Not used.
FltFsControlFile or ZwFsControlFile returns STATUS_SUCCESS if the operation succeeds. Otherwise, the appropriate function returns the appropriate NTSTATUS error code.
Deletes the update sequence number (USN) change journal on a volume, or waits for notification of change journal deletion.
| C++ |
|---|
BOOL WINAPI DeviceIoControl( (HANDLE) hDevice, // handle to volume FSCTL_DELETE_USN_JOURNAL, // dwIoControlCode(LPVOID) lpInBuffer, // input buffer (DWORD) nInBufferSize, // size of input buffer NULL, // lpOutBuffer0, // nOutBufferSize(LPDWORD) lpBytesReturned, // number of bytes returned (LPOVERLAPPED) lpOverlapped ); // OVERLAPPED structure |
Irp->IoStatus.Status is set to STATUS_SUCCESS if the request is successful.
Otherwise, Status to the appropriate error condition as a NTSTATUS code.
For more information, see NTSTATUS Values.
For the implications of overlapped I/O on this operation, see the Remarks section of the DeviceIoControl topic.
You can use FSCTL_DELETE_USN_JOURNAL to delete a change journal. The NTFS file system starts a deletion operation and returns immediately to the calling process, unless the USN_DELETE_FLAG_NOTIFY flag is set in the DeleteFlags member of DELETE_USN_JOURNAL_DATA.
If the USN_DELETE_FLAG_NOTIFY and USN_DELETE_FLAG_DELETE flags are both set, a call to FSCTL_DELETE_USN_JOURNAL begins the deletion process. Then the call either blocks the calling thread and waits for the deletion (on a synchronous or non-overlapped call), or sets up event notification by using an I/O completion port or other mechanism, and returns (on an asynchronous or overlapped call).
You can also use FSCTL_DELETE_USN_JOURNAL to receive notification that a change journal deletion is complete, by setting only USN_DELETE_FLAG_NOTIFY. If you do so, the FSCTL_DELETE_USN_JOURNAL operation either waits until the deletion completes before returning (on a synchronous or non-overlapped call), or sets up event notification by using an I/O completion port or other mechanism (on an asynchronous or overlapped call).
The deletion on which an application receives notification may have been initiated by the current process, or some other process. For example, when an application is started, it can use FSCTL_DELETE_USN_JOURNAL to determine if a deletion started by some other process is in progress and if it is, exit.
Complete deletion of a change journal requires a scan of the volume where the change journal resides, which may take a long time on a volume with many files. The operation continues to completion even across system restarts. Attempts to create, modify, delete, or query the change journal while deletion is in progress fail and return the error code ERROR_JOURNAL_DELETE_IN_PROGRESS.
The FSCTL_DELETE_USN_JOURNAL operation has a significant performance cost, so it should be used sparingly. An administrator should delete a journal when the current USN value approaches that of the maximum possible USN value.
For more information, see Creating, Modifying, and Deleting a Change Journal.
To retrieve a handle to a volume, call CreateFile with the lpFileName parameter set to a string in the following form:
\.*X*:
In the preceding string, X is the letter identifying the drive on which the volume appears. The volume must be NTFS.
In Windows 8 and Windows Server 2012, this code is supported by the following technologies.
| Technology | Supported |
|---|---|
| Server Message Block (SMB) 3.0 protocol | No |
| SMB 3.0 Transparent Failover (TFO) | No |
| SMB 3.0 with Scale-out File Shares (SO) | No |
| Cluster Shared Volume File System (CsvFS) | Yes |
Volume Management Control Codes