We've recently migrated my entire University including faculty and staff
from Novell to Samba.
There's typically 700+ clients connected to the samba server at any given
time and thus far there are about 400GB of client's files on the server.
Basically every Microsoft Windows user generated file (Word, Excel, whatever) of
the entire University gets stored on my Samba server.
Obviously backups are important. The Samba server is a Sunfire 280R and we use
Sun's Solstice Backup (rebadged Legato Networker) and a Storagetek
Timberwolf DLT tape jukebox to do backups every night. A full backup on Sat.
nights and an incremental the other 6.
Ok, now to the problem/question - lately we've been getting a lot of Huge
incremental backups. I spent a great deal of my time yesterday digging into the
problem and unfortunately I came to the conclusion I least expected, that it is
a Samba issue.
The backup software uses the Unix ctime value of files when checking for files
that need to be included in an incremental backup. What I've discovered is
that files accessed via Samba by just simple things like being virus scanned
with Norton Antivirus, simply opening a file in MS Word but not changing it, or
just right clicking on a file in Windows Explorer and checking the properties
change the ctime stamp of the inode to the current date and time and are thus
picked up by our backup software as being changed since the last backup and
getting backed up in an incremental backup that evening even though the file
hasn't really changed whatsoever.
I thought maybe it was some kind of issue with the Samba build I'm using or
the file system (Samba 2.2.8 on Solaris 5.8 with UFS file system) but I messed
with it at home last night where I've got an older version of Samba running
on Linux with EXT3 file system and it exhibited the same behavior.
Why is this? Is it by design for some reason or a bug? It seems like a bug to
me. More to the point, is there anwyay to change this behaviour? Every client
PC on campus has Norton Anti Virus installed and I think my huge incremental
backups are coming from PCs that have used NAV that day to scan their Samba
"network drives" thus resetting the ctime on every file that is
scanned and therefore every scanned file that day becomes part of the
incremental backup to tape that evening.
Tom Schaefer
Unix Administrator
University of Missouri St. Louis