This article applies to System Change Log.

Last Updated: 20 July 2011

Problem

System Change Log reports "Unable to resolve parent index" errors

Background

The error indicates a mismatch between the System Change Log (SCL) index and the NTFS USN Change Journal on a monitored volume. Changes to files are reported by the operating system to SCL with a file name and its parent folder's index number. SCL then attempts to match up the index number with the corresponding entry in the USN Journal in order to present the full path name of the file. However, if that index number doesn't exist in the USN Journal, there is no parent folder name to resolve so SCL reports the "Unable to resolve parent index" error.

Mismatches in the indices may occur during normal operation for a variety of reasons, usually benign. Deleting the SCL index file and allowing it to rebuild as detailed in the Solution section below are usually sufficient to solve the issue. However, recurrent errors in the USN Journal are potentially serious and may indicate problems with drive operation. Please refer to Microsoft's documentation on the CHKDSK utility, disk repair, and maintenance.

Solution

In most cases, allowing System Change Log to rebuild its index will solve the issue. SCL keeps an index file in the root folder of each monitored volume. Do the following:
1. Stop the System Change Log service
2. Delete the SYSTEMCHANGELOG.IDX file from the root folder of each monitored volume. (Note this file will be marked with HIDDEN and SYSTEM attributes, so you may need to remove these attributes before the file can be deleted)
3. Restart the System Change Log service. The .IDX file(s) will automatically be rebuilt

If this does not resolve the issue, then there is likely a corruption in the USN Change Journal. In many cases, the Microsoft CHKDSK disk repair utility can resolve these issues.

IMPORTANT: Please refer to Microsoft's documentation on the CHKDSK utility, disk repair, and maintenance, and ensure you have full backups before attempting any disk repair procedure. Proper disk maintenance is outside the scope of our product, and we cannot be responsible for any data loss.

If you choose to attempt to repair the USN Journal, follow this sequence:

1. Stop the System Change Log service
2. Delete the SYSTEMCHANGELOG.IDX file from the root folder of each monitored volume. DO NOT restart the SCL service.
3. Run the Microsoft recommended disk repair utility with options that will verify the USN Journal for the entire disk (i.e. CHKDSK /R)
4. Check to be sure the System Change Log service has restarted after the boot.