[Samba] 100GB incremental backups

[Tom Schaefer]

We've recently migrated my entire University including faculty and staff from Novell to Samba.
There's typically 700+ clients connected to the samba server at any given time and thus far there are about 400GB of client's files on the server.

Basically every Microsoft Windows user generated file (Word, Excel, whatever) of the entire University gets stored on my Samba server.

Obviously backups are important.  The Samba server is a Sunfire 280R and we use Sun's Solstice Backup (rebadged Legato Networker) and a Storagetek Timberwolf DLT tape jukebox to do backups every night.  A full backup on Sat. nights and an incremental the other 6.

Ok, now to the problem/question - lately we've been getting a lot of Huge incremental backups.  I spent a great deal of my time yesterday digging into the problem and unfortunately I came to the conclusion I least expected, that it is a Samba issue.

The backup software uses the Unix ctime value of files when checking for files that need to be included in an incremental backup.  What I've discovered is that files accessed via Samba by just simple things like being virus scanned with Norton Antivirus, simply opening a file in MS Word but not changing it, or just right clicking on a file in Windows Explorer and checking the properties change the ctime stamp of the inode to the current date and time and are thus picked up by our backup software as being changed since the last backup and getting backed up in an incremental backup that evening even though the file hasn't really changed whatsoever.

I thought maybe it was some kind of issue with the Samba build I'm using or the file system (Samba 2.2.8 on Solaris 5.8 with UFS file system) but I messed with it at home last night where I've got an older version of Samba running on Linux with EXT3 file system and it exhibited the same behavior.

Why is this?  Is it by design for some reason or a bug?  It seems like a bug to me.  More to the point, is there anwyay to change this behaviour?  Every client PC on campus has Norton Anti Virus installed and I think my huge incremental backups are coming from PCs that have used NAV that day to scan their Samba "network drives" thus resetting the ctime on every file that is scanned and therefore every scanned file that day becomes part of the incremental backup to tape that evening.

Tom Schaefer
Unix Administrator
University of Missouri St. Louis