archive bit reappears ...

Gentle people,
Installed a backup process with full backups once a month and daily incremental backups. Ever since I wondered why the incremental backups need such a lot of space and looked more closely. Result: Backup switches off the archive bit but some 10-15 minutes later the archive bits on most of the .BMP and some of the .JPG files just backed up reappear. Mind you, I am just sitting in front of the PC doing nothing, just watching!! Had a closer look at all the processes, but couldn't identify a culprit. All of them appear to have a valid reason for being there. Task manager screen shot is available!

Any ideas who may be going 'round in my machine switching on archive bits unnecessarily?

Thanks a lot in advance!

 

I have exactly the same problem, and noticed it in the same way. This started happening, as near as I can tell, when Win2k SP-4 was installed on the server. IBM Tivoli was installed at about the same time, as well.

Do you have any resolution?

Thanks,

Fred

 

I don't have any idea what might be doing that particular bit flip to you. I'm guessing that if SP4 was causing it, we'd see large numbers of mentions on Google or in the various forums and that isn't the case.

It is the sort of thing that spyware might do either from a program bug or as part of some nasty things it did you your machine. What spyware blockers and cleaners are you using?

 

Well, gentle people, this is a sad story. As soon as I had a little bit of spare time I had a closer look into this problem with the following results:

- switched off all archive bits in a single directory
- started a file manager with a very short refresh time to see when the archive bits came back on
- started task manager to see which processes are active when the archive bits reappear
- and watched

- when the archive bits reappeared only McShield (from McAfee antivirus) and task cidaemon were active
- my first guess was obviously McAfee, but cidaemon was easier to deactivate temporarily - and guess what ...

- deactivated cidaemon and the archive bits remained switched off!!!

Now can anybody tell me how to fix this problem in cidaemon??

Thanks a lot in advance!

 

cidaemon.exe = Microsoft Indexing Service

I would simply turn off indexing. I've never seen it speed up searches (or anything else) and have seen it cause a number of different issues from NT4 up through XP. Seems like that is one function Microsoft has never gotten right.

That was a very nice bit of detective work you did to locate the problem source.

 

Will do, Newt, but thanks a lot for putting my mind at rest concerning the usefulness of indexing services!

Thank you very much!

Ernst

 

Still no resolution here

I've found that this is happening on all the Win2k servers at my company (at least on the 5 or 6 in our development section). Indexing is disabled on all the servers, and they're all behind multiple firewalls on two different networks, separated from each other with a firewall requiring SecurID to get through.
We do use Macafee AV, which gets automatic updates. However, there's no spyware detection on these servers.

 

Hi fstjohn1,

Are you really sure you switched off/halted/stopped indexing service altogether? I.e. cidaemon.exe is no longer in your list of active tasks (and will not start automatically if some other component is requesting it)? I did and didn't have a problem ever since. Also - please make sure you switch off your archive bits manually after you stopped indexing service (or run a backup instead) otherwise you will not notice flipping of archive bits has stopped (at least for me).

Kind regards,
Ernst

 

Indexing service is marked as "Disabled" in the services dialog, and cidaemon is not present in Task Manager.

Yesterday morning I did this:
1. Made two copies of a folder containing about 30 small files to be sure nobody else would access them. The files were all ascii text log files (.log extension). All archive flags were already set. To be sure of our terminology, set means "A" was showing in Windows Explorer's attributes column for all files.
2. Backed up one of the two folders with Windows Backup. All archive flags automatically reset when I did this.
3. Used Windows Explorer to reset all archive flags in the other folder.

When I arrived for work this morning, both folders again had all archive flags set. Windows Explorer showed no change in the "Accessed" date/time for any of the files. Experience shows that this happens anywhere from a few minutes to several hours after the flags are reset. In this case, it took more than 8 hours.

As an aside, Setting or resetting the "A" attribute with Windows Explorer changes the Accessed date/time to the present. Doing the same with the DOS attrib command does not change the Accessed date/time.

 

Well, in my case index service is "deactivated" and not "disabled ", but this may only be a translation problem and hence a minor difference. The major difference as I see it is - if you look at my very first post it will tell you that this thing happened only to many if not all of my .BMP files, some of my .JPG files and very scarcely to other picture files. But never to .LOG files ...

Sorry, but I can't help you there.

 

Thanks, anyway, e.g.gru, for commiserating with me. We'll soldier on and if I find out what's causing it I'll post it here for posterity.

My next move:
Created three folders, containing identical files with all archive flags reset.
Folder 1 - security limited to my signon only - full control
Folder 2 - security limited to administrators group - full control
Folder 3 - secuirity limited to administrators and system - full control

Wait and see what happens. Could possibly narrow things down.

Fred

 

Cause Found (but not Solution)

The problem is being caused by the several-times daily application of system policy by the network group in my company. Among the policies, one of them sets all directory and file permissions, regardless of whether they need changing or not. When this happens, since all files are accessed all archive flags are set for every file and directory on the box. I was put on the trail of system policies when I found that the folders I created (see previous post) were all reset to default permissions this morning when I came to work.

Anybody know a way around this? Kinda renders the archive flag redundant, doesn't it?

Fred