Re: st_size differs in windows verify jobs

The backup of a Windows PC stores more than just the file data, so I suspect
there is a bug in the code that calculates the vol file size.

__Martin


>>>>> On Wed, 22 Oct 2025 11:55:52 -0500, Rob Gerber said:
> 
> Bacula 15.0.2, running on rocky linux 9.x, backing up windows 11 PCs.
> 
> I ran a Data verify job against a full backup from my windows PCs, and I found a number of "st_size  differs on" errors like those below. I am confused by these results. I want to understand why the data verify jobs are reporting these issues. I did spot checks of a few of the files reported, and on restore the files I checked appear to be correct (with the exception of 1 file, that appears to change frequently).
> 
> Host td-qb:
> Many of the differing files from host td-qb complained that the vol had file size xxx, with file size 0. One file differed, qmgr.db had a non-zero size. This file changes frequently, so of course, on restore the file didn't hash the same as the file currently on disk.
> 
> examples:
> td-cad1-fd JobId 3643:    st_size  differs on "C:/ProgramData/Microsoft/Network/Downloader/qmgr.db". Vol: 1114360 File: 1310720
> td-cad1-fd JobId 3643:    st_size  differs on "C:/Users/Owner/AppData/Local/Packages/MicrosoftWindows.Client.CoreAI_cw5n1h2txyewy/Settings/settings.dat.LOG2". Vol: 232 File: 0
> 
> Host td-cad2:
> For host td-cad2, there were around 160 st_size differs results with non-zero filesizes. I pulled out a couple files that I am certain shouldn't have changed, and restored them. Hashing with sha512 showed that the restored files and the files on disk were identical.
> 
> examples:td-cad1-fd JobId 3641:    st_size  differs on "C:/Craeon/backup/C/Program Files/Autodesk/AutoCAD LT 2022/en-US/AcVMToolsRes.dll". Vol: 720532 File: 720520
> 
> td-cad1-fd JobId 3641:    st_size  differs on "C:/Users/cad2/Dropbox/REDACTED/IMG_8253 (1).png". Vol: 7602302 File: 7601830
> 
> I do have zstd compression enabled for the fileset, but surely the data verify job is using non-compressed filesize values, correct? Why should a file with size 0 be reported as size xxx on the volume? I understand that the volume needs some space to store the file attributes, but wouldn't the data verify job understand the difference between the size used by attributes and the size used by a file?
> 
> What strange thing could be happening here?
> 
> Details:
> My data verify job was not ran in accurate mode. I specified the verify job should be ran against specific jobids.
> 
> verify job from bacula-dir.conf:
> Job {
>   Name = "Verify-job" 
>   JobDefs = "None"
>   Messages = "Standard"
>   Type = Verify
>   Storage = "Synology-Local"
>   Client = "td-bacula-fd"
>   Level = Data
> }
> 
> fileset:
> FileSet {
>   Name = "Windows-All-Drives-fs"
>   IgnoreFilesetChanges = no
>   Include {
>     Options {
>       Exclude = "yes"
>       IgnoreCase= "yes"
>       wilddir = "*:/Windows"
>       wildfile = "*:/pagefile.sys"
>       wildfile = "*:/hiberfil.sys"
>       wildfile = "*:/swapfile.sys"
>       wild = "*:/$Recycle.Bin"
>       wild = "*:/$recycler"
>       wild = "*:/Program Files (x86)"
>       wild = "*:/Program Files"
>       wild = "*:/recycler/"
>       wild = "*:/users/all users/microsoft help/"
>       wild = "*:/users/all users/microsoft/"
>       wild = "*:/i386/"
>       wild = "*:/msocache/"
>      }
> 
>     Options {
>       #compression=GZIP
>       #compression=LZO
>       compression=ZSTD
>       IgnoreCase= "yes"
>       Signature = "SHA512"
>       OneFS = "no"
>       DriveType = fixed, removable   # this means that we will not back up cdrom, ramdisk, or remote (network) drives.
>       verify = pins3
>     }
>     File = /
>   }
> }
> 
> Sample truncated joblog output from one of the verify jobs:
> 
> td-bacula-dir JobId 3643: Verifying against JobId=3632 Job=Backup-td-qb-job.2025-10-20_21.05.06_02
> td-bacula-dir JobId 3643: Start Verify JobId=3643 Level=Data Job=Verify-job.2025-10-21_09.36.58_45
> td-bacula-dir JobId 3643: Connected to Storage "Synology-Local" at td-bacula:9103 with TLS
> td-bacula-dir JobId 3643: Using Device "Synology-Local-005" to read.
> td-bacula-dir JobId 3643: Connected to Client "td-cad1-fd" at td-cad1.local:9102 with TLS
> td-cad1-fd JobId 3643: Connected to Storage at td-bacula:9103 with TLS
> td-bacula-sd JobId 3643: Ready to read from volume "Synology-Local-Full-0044" on File device "Synology-Local-005" (/mnt/synology/bacula/Synology-Local).
> td-bacula-sd JobId 3643: Forward spacing Volume "Synology-Local-Full-0044" to addr=280
> 
> <many st_size differs messages>
> 
> td-bacula-dir JobId 3643: Bacula td-bacula-dir 15.0.2 (21Mar24):
>   Build OS:               x86_64-redhat-linux-gnu-bacula redhat (Blue
>   JobId:                  3643
>   Job:                    Verify-job.2025-10-21_09.36.58_45
>   FileSet:                Windows-All-Drives-fs
>   Verify Level:           Data
>   Client:                 td-cad1-fd
>   Verify JobId:           3632
>   Verify Job:             
>   Start time:             21-Oct-2025 10:22:49
>   End time:               21-Oct-2025 10:46:54
>   Elapsed time:           24 mins 5 secs
>   Accurate:               no
>   Files Expected:         297,912
>   Files Examined:         297,912
>   Non-fatal FD errors:    0
>   SD Errors:              0
>   FD termination status:  Verify differences
>   SD termination status:  OK
>   Termination:            Verify Differences
> td-bacula-dir JobId 3643: Begin pruning Jobs older than 6 months .
> td-bacula-dir JobId 3643: No Jobs found to prune.
> td-bacula-dir JobId 3643: Begin pruning Files.
> td-bacula-dir JobId 3643: No Files found to prune.
> td-bacula-dir JobId 3643: End auto prune.
> 
> Regards,
> Robert Gerber
> 402-237-8692
> [email protected]
>