What does Windows error code 1178 (ERROR_JOURNAL_DELETE_IN_PROGRESS) mean?

 
Previous Next
ERROR_UNABLE_TO_MOVE_REPLACEMENT_2 ERROR_JOURNAL_NOT_ACTIVE

ERROR_JOURNAL_DELETE_IN_PROGRESS

The NTFS USN change journal is currently being deleted.

ERROR_JOURNAL_DELETE_IN_PROGRESS has value 1178 (0x49A). Deleting an NTFS update sequence number change journal is a volume-wide asynchronous operation that can require scanning many files and can continue across system restarts. While deletion is active, attempts to create, modify, delete, or query the journal return this code.

What can start the condition

  • an administrator or maintenance tool issues FSCTL_DELETE_USN_JOURNAL
  • storage preparation resets journal state before imaging or repurposing a volume
  • a diagnostic or cleanup product deletes the journal without coordinating with indexers or backup software
  • the system resumes an unfinished deletion after restart

Why immediate recreation fails

Journal deletion is not merely removal of a small metadata file. NTFS must process volume state, and Microsoft notes that the operation can take a long time. A create or query request cannot safely race that work, so 1178 is a serialization signal rather than evidence of journal corruption.

Evidence to record

  • volume GUID path, drive letter, filesystem, and size
  • operation that received 1178 and its requested journal ID or USN
  • identity of the process or maintenance task that initiated deletion when known
  • deletion start time, restarts since then, and completion notification state
  • workloads affected: backup, indexing, replication, security scanning, or change capture

Correct recovery

Wait for deletion to complete. FSCTL_DELETE_USN_JOURNAL supports a notify mode that can wait synchronously or complete through overlapped I/O. After notification, query the volume again and create a new journal only if the application or administrator intends to do so.

Do not issue repeated delete/create/query loops. They add load and logs but cannot make the ongoing volume scan finish safely. If deletion appears stuck for an abnormal period, investigate NTFS, storage, and volume health rather than terminating arbitrary processes.

Consequences for journal consumers

A backup or indexer must assume its previous checkpoint is no longer usable after deletion. Once a new journal exists, it will have a different journal identity and a new range of USNs. The consumer should perform a full rescan or another documented reconciliation before accepting incremental records.

Administrative guidance

Delete a journal sparingly and coordinate the maintenance window with all change-journal consumers. Microsoft specifically warns that the control operation has significant performance cost. On a heavily populated volume, plan for extended activity and persistence across reboot.

Related journal codes

ERROR_JOURNAL_NOT_ACTIVE says no active journal is available. ERROR_JOURNAL_ENTRY_DELETED means a requested record has already fallen out of the retained range. Error 1178 identifies a transitional state in which deletion is actively underway.

Example

A backup service starts and queries the USN journal while a storage-maintenance task is deleting it. The query returns 1178. The service subscribes to deletion completion, marks its incremental checkpoint invalid, waits, and performs a baseline scan after a new journal is created instead of treating the temporary state as an empty change set.

References

Looking for a different code? Search another status or error code.