Symbolic Link Handling in PA WatchDISK
Symbolic links typically exist on Unix/Linux-type file systems. When viewed from Windows (typically via a SMB/Samba/CFS service), the links appear as normal directories. Imagine the following contrived example:
/users/steve/bin -> /usr/bin
When a Windows-based directory scanner sees this, it will think /users/steve/bin is a separate and distinct directory from /usr/bin.
Further, consider the loop that this link would make/usr/bin/network/test/bin -> /usr/bin
When symbolic links point back up into their own path they create a cycle. A Windows-based directory scanner would see:\\<machine>\<share>\user\bin\network\test\bin\network\test\bin\network\test\bin... and so on...
Power Admin has come up with some advanced symbolic link detection algorithms that can be deployed on Windows. The algorithm isn't perfect, but it's close. Enabling symbolic link detection will have the following side-effects:
- Scanning of volumes is somewhat slower
- Space might be shown under the wrong directory. For example, since /users/steve/bin and /usr/bin both appear to be the legitimate directory, one of them must be chosen as the true parent. Determining the true parent directory is unfortunately impossible from Windows, so the first directory seen is assigned as the true parent. Although this might shift some space usage numbers from one directory to another, it will shift it consistently such that directory growth can still be seen.
- Some simple directories that contain IDENTICAL files (same creation date, filename, etc) may be considered the same and only counted once, when they should be counted twice. In our experience, this typically happens with empty directories and has no effect on the results.
- Despite the effects above, the scan of a directory (even with link created loops) will finish, and be generally correct (unlike products that don't have link detection and will run forever).
Is it safe to enable symbolic link detection on a Windows-only volume? Yes, but the caveats above still apply (mostly scans are just slower) , so there is no real reason to do it.
Is it required to enable symbolic link detection when scanning a volume hosted on a Unix/Linux server? Yes, otherwise the data will likely be incorrect and the scan process could very possibly scan forever and never finish.