atime changed by OSX Finder/Spotlight and Windows Explorer search function

Hi,

Background: Isilon cluster used for storage of media to be used in video editing for content for our TV station. We use the atime stamp to determine whether a media file needs to stay online, or can be archived off. Since editing apps do not modify the media (read-only) atime is the only method to assess the need to stay/go. We have been doing this for about a year without problems. Nothing has changed on the cluster system (upgrades, atime off/on switch, rogue/nefarious access). Nothing has changed on the client side (OSX Mavericks, few El Capitan, and few Win7) All clients access multiple SMB shares (cluster is sliced up specifically for this purpose), most with 3-4 volumes for their daily use (SpaceA, SpaceB, ..., etc)

I've encountered a very bizarre situation yesterday:

When looking for files not accessed in more than x days, my search was a much much smaller set than expected. After some investigation, I discovered that a very large % of my files on the cluster were atime-stamped for April 1. I engaged Tech Support, and after some brain-drain, we came up with the "only" plausible scenario, which follows...

When a user mounts a volume on their client (smb://house/SpaceA) that corresponds to /ifs/data/SpaceA, then opens a Finder window, and lists the contents (say it contains a file within that dir), the atime for that file gets updated. When that user in Finder, uses Spotlight to search for filename "a", as the results come in, a thumbnail gets made for each found file, and THAT updates the atime. Same method in Windows Explorer. Weird, that when you open Finder, not ALL files at that tip get the atime changed. I have three .txt files, all mtime same, but now atime is only affected on one file but not the other two:

ls -l

-rwxrwx--- +   1 root          wheel               20449 Apr 13 17:14 OlderThan250-20160413-1705.txt

-rwxrwx--- +   1 tom     isilon users grp   184356 Mar 24 16:04 OlderThan300-20160324-1534.txt

-rwxrwx--- +   1 root          wheel              204217 Mar  2 10:35 OlderThan365-20160302-1026.txt

ls -lu

-rwxrwx--- +   1 root          wheel               20449 May  6 15:45 OlderThan250-20160413-1705.txt

-rwxrwx--- +   1 tom     isilon users grp   184356 May  5 16:31 OlderThan300-20160324-1534.txt

-rwxrwx--- +   1 root          wheel              204217 May  5 16:31 OlderThan365-20160302-1026.txt

I open the Finder again and navigate to the tip again...

-rwxrwx--- +   1 root          wheel               20449 May  6 15:47 OlderThan250-20160413-1705.txt

-rwxrwx--- +   1 tom     isilon users grp   184356 May  5 16:31 OlderThan300-20160324-1534.txt

-rwxrwx--- +   1 root          wheel              204217 May  5 16:31 OlderThan365-20160302-1026.txt

This has not been an issue, until April 1st. I'll take any insight on why now. Also, how do others deal with archiving content off the cluster in a media-centric environments, NOT using atime?

We discussed hacking the registry/plist and disabling the thumbnail creation, so that the atime stays intact but I'm not clear on how that would work, if disabled would the atime never get updated, or only update via the editing app using the files..? Any input from greater minds is appreciated

Tom