| Previous | Next |
| ERROR_JOURNAL_DELETE_IN_PROGRESS | ERROR_POTENTIAL_FILE_FOUND |
ERROR_JOURNAL_NOT_ACTIVE
No active USN change journal is available on the volume.
ERROR_JOURNAL_NOT_ACTIVE is Win32 error 1179 (0x49B). A caller attempted a change-journal operation on a volume where the NTFS USN journal is absent or not active. This is different from an active journal that contains no new records.
Common reasons
- a journal has never been created on the volume
- an administrator or maintenance tool deleted it
- the caller opens a different volume from the one originally checkpointed
- the filesystem or access path does not support the requested journal operation
- journal deletion completed after the application saved its prior state
Evidence needed from the caller
- volume GUID, drive letter, filesystem type, and volume handle path
- control code used: query, read, enumerate, or another journal operation
- saved journal ID and USN checkpoint
- time of the last successful query and any storage maintenance since then
- whether the application has privilege and access required for the volume handle
Keep “journal inactive” separate from access failures. An incorrect volume handle or insufficient permissions should be diagnosed through the original error returned by CreateFile or DeviceIoControl, not normalized to 1179 by a wrapper.
Recovery choices
An application that owns journal provisioning can create or configure the journal with FSCTL_CREATE_USN_JOURNAL, then query its new identity. A read-only consumer should report that incremental tracking is unavailable and request administrator action rather than changing volume configuration unexpectedly.
After a journal is created again, discard checkpoints tied to the old journal ID. A full scan or equivalent baseline is required before incremental processing resumes; otherwise changes made while the journal was absent can be missed.
Retry policy
Polling may be acceptable when another coordinated component is expected to create the journal shortly. Use bounded backoff and compare journal identity after activation. Without such an expected transition, repeated queries only reproduce the same deterministic state.
Developer guidance
- persist volume identity, journal ID, and last processed USN together
- verify all three after restart and mount changes
- make the fallback to full enumeration explicit and observable
- never interpret 1179 as “zero changes”
- test journal deletion and recreation while the consumer is offline
Difference from related results
ERROR_JOURNAL_DELETE_IN_PROGRESS is a temporary deletion phase during which journal operations are blocked. ERROR_JOURNAL_ENTRY_DELETED says the journal exists but the requested historical record is no longer retained. Error 1179 says there is no active journal to query or read.
Example
An indexer stores a journal ID and USN, then the volume is restored from an image without an active journal. On restart, FSCTL_QUERY_USN_JOURNAL returns 1179. The indexer does not mark the tree unchanged; it schedules a complete crawl and begins incremental indexing only after a newly created journal has been identified.
References
- Microsoft: System Error Codes (1000–1299)
- Microsoft: FSCTL_QUERY_USN_JOURNAL
- Microsoft: Change journal operations
Looking for a different code? Search another status or error code.