Error Event 4118-How to resolve?

Archived from groups: microsoft.public.windowsxp.perform_maintain (More info?)

We could not find any advice on this issue, just many reports from the
people having the same problem. What follows is what we have arrived at
after some thought. We have implemented this on our machines and the
problem went away.
The problem has to do with change notification in Windows and happens
on the systems where the rate of file modification is high.
Windows maintains a USN Journal ( change log ) of a fixed size - one
per drive. When a file on the drive is changed, a record in the journal
is made to that effect. Clients, such as indexing service, file
replication service etc use the log to update their own databases. This
log wraps around when it reaches the maximum size. Indexing service
polls this log from time to time.If the Indexing service detects the
wrap around it concludes that it is not keeping up with the rate of
modifications and logs 4118 error message, suggesting that the full
rescan be done.
We have dramatically increased the size of the USN Journal to make this
wrap around less likely, and the problem went away.

To query USN data for a volume on drive C, type:
fsutil usn queryjournal C:

To change the size of the journal on drive c: type:
fsutil usn createjournal m=<max size> a=<allocation size> C:

(If the journal exists, this will have effect of just increasing the
size)
For Windows 2003 FRS service default max size is 512 MB. Because you
can alway increase the size easily we started with
m=0x10000000
a=0x100000

Hope this helps.

Ty wrote:
> Suddenly I am getting error 4118 in event viewer application log. It

> pertains to the Ci service. "A content scan could not be completed
on C"
> This happens after every boot and has an error entry referencing each

> drive/partition on my system (C,D,E, F, & G) I have reviewed KB
article
> 273768 which confuses me on two accounts. First, I am unable to find
the
> "Index Server" to do a manual rescan. Second, under 'Status', it
states
> "This behavior is by design". If it is by design, then why is it
listed as
> an error? Or does this imply that I'm fretting over a non-critical
issue.
> My system is working fine, but I'm not accustomed to leaving error
messages
> unresolved.