Event Error 13568
Kevin Gal
rebooted twice today (unplanned), thanks Kevin
The File Replication Service has detected that the
replica set "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" is in
JRNL_WRAP_ERROR.
Replica set name is : "DOMAIN SYSTEM VOLUME (SYSVOL
SHARE)"
Replica root path is : "c:\winnt\sysvol\domain"
Replica root volume is : "\\.\C:"
A Replica set hits JRNL_WRAP_ERROR when the record that
it is trying to read from the NTFS USN journal is not
found. This can occur because of one of the following
reasons.
[1] Volume "\\.\C:" has been formatted.
[2] The NTFS USN journal on volume "\\.\C:" has been
deleted.
[3] The NTFS USN journal on volume "\\.\C:" has been
truncated. Chkdsk can truncate the journal if it finds
corrupt entries at the end of the journal.
[4] File Replication Service was not running on this
computer for a long time.
[5] File Replication Service could not keep up with the
rate of Disk IO activity on "\\.\C:".
Setting the "Enable Journal Wrap Automatic Restore"
registry parameter to 1 will cause the following recovery
steps to be taken to automatically recover from this
error state.
[1] At the first poll, which will occur in 5 minutes,
this computer will be deleted from the replica set. If
you do not want to wait 5 minutes, then run "net stop
ntfrs" followed by "net start ntfrs" to restart the File
Replication Service.
[2] At the poll following the deletion this computer
will be re-added to the replica set. The re-addition will
trigger a full tree sync for the replica set.
WARNING: During the recovery process data in the replica
tree may be unavailable. You should reset the registry
parameter described above to 0 to prevent automatic
recovery from making the data unexpectedly unavailable if
this error condition occurs again.
To change this registry parameter, run regedit.
Click on Start, Run and type regedit.
Expand HKEY_LOCAL_MACHINE.
Click down the key path:
"System\CurrentControlSet\Services\NtFrs\Parameters"
Double click on the value name
"Enable Journal Wrap Automatic Restore"
and update the value.
If the value name is not present you may add it with the
New->DWORD Value function under the Edit Menu item. Type
the value name exactly as shown above.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
kevin gal
>
Henry Craven
Event ID Details for this error:
=========================
Things to understand What is the role of File Replication Service?
Comments Ionut Marin (Last update 12/5/2003):
Q292438 gives information on troubleshooting Journal_Wrap errors on
Sysvol and DFS Replica Sets.
Andi K (Last update 12/5/2003):
As per Microsoft: "FRS no longer performs an automatic non-authoritative
restore if a journal wrap condition is detected. Instead, it logs an
event ID 13568 message in the FRS event log to remind you to perform the
operation at a convenient time. A registry key has been included to
configure an automatic non-authoritative restore operation if you want
to do so. However, if you configure this setting, the contents of the
replica tree may be made unavailable while the restore operation is
taking place". See Q321557 for more details.
Tom McMeekin
After speaking with MS Technical Support, I was emailed a Q article,
which did fix the problem. See Q315070 ("Event 13568 Is Logged in the
File Replication Service Event Log[ntrelease]").
The Q article does not appear to be available anymore so here is the
content (please note that if the article is not available anymore then
it probably means that is no longer valid or was wrong!):
Event 13568 Is Logged in the File Replication Service Event
Log[ntrelease]
ID: Q315070 CREATED: 18-DEC-2001 MODIFIED: 06-AUG-2002
The information in this article applies to:
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Server
------------------------------------------------------------------------
-------
[...]
SYMPTOMS
========
The following event may be logged in the File Replication service (FRS)
event
log after you install Windows 2000 Service Pack 3 (SP3):
Event Type: Warning
Event Source: NtFrs
Event Category: None
Event ID: 13568
Date: 12/12/2001
Time: 2:03:32 PM
User: N/A
computer: NA-DC-01
Description:
[... event description...]
CAUSE
=====
This error message is logged because the requested data is not available
due to
the following series of events:
- FRS uses the NTFS file system journal to track changes to files and to
folders that are in a replica tree to propagate those changes to
other
members of the replica set.
- If FRS does not record the changes, the journal wraps and FRS does not
know
which change to process next. FRS may not record the changes because:
- FRS is off for an extended period of time.
-or-
- The changes are occurring faster than FRS can process them.
- To recover from this error state, FRS needs to:
- Re-initialize the content of the replicated directory.
- Resume tracking the NTFS journal from a known good starting point.
- To re-initialize the replica tree, FRS moves all content into the
NTFRS_Pre-Existing folder, and then FRS rejoins the replica set by
sourcing
from an upstream partner. Based on the contents of the file, one of
the
following events occurs:
- If a file on the upstream partner is identical to the file that is
in the NTFRS_Pre-Existing folder, the local copy is moved into the
replica tree.
- If the file is different, or if new files have been added to the
replica set, FRS replicates the update from the upstream partner and
moves it into the replica tree.
- During this procedure, the data on that particular member becomes
unavailable.
In Service Pack 2 (SP2), this re-initialization takes place
automatically, which may take the data offline at an inopportune time.
In SP3, the event is logged by default and an administrator can
re-initialize the replica tree at a convenient time.
RESOLUTION
==========
[...]
To modify the default behavior, make the following changes in the
registry to
instruct FRS to handle the JRNL_WRAP_ERROR status automatically:
1. Stop FRS.
2. Start Registry Editor (Regedt32.exe).
3. Locate and click the following key in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters
4. On the Edit menu, click Add Value, and then add the following
registry value:
Value name: Enable Journal Wrap Automatic Restore
Data type: REG_DWORD
Radix: Hexadecimal
Value data: 1 (Default 0)
5. Quit Registry Editor.
6. Restart FRS.
If these steps do not modify the default settings and the automatic
re-initialization is not turned on, you need to manually re-initialize
the
replica tree. At a convenient time, make the following changes to the
registry:
1. Stop FRS.
2. Start Registry Editor (Regedt32.exe).
3. Locate and click the following key in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Ba
ckup/Restore/Process at Startup
4. On the Edit menu, click Add Value, and then add the following
registry value:
Value name: BurFlags
Data type: REG_DWORD
Radix: Hexadecimal
Value data: D2
5. Quit Registry Editor.
6. Restart FRS.
MORE INFORMATION
================
For additional information about SP3 updates to the File Replication
service,
click the article number below to view the article in the Microsoft
Knowledge
Base:
Q307319 File Replication Service Improvements in Windows 2000 SP3
===============================
also:
Description of FRS entries in the registry
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q221111
Troubleshooting journal_wrap errors on Sysvol and DFS replica sets
http://support.microsoft.com/default.aspx?scid=kb;EN-US;292438
If you don't need file replication, turn the service off.
Antivirus, backup, and disk optimization programs that are compatible
with the File Replication Service
http://support.microsoft.com/default.aspx?scid=kb;en-us;815263
check that the ststrm account exists in the drivers ACL
If still no joy, call MS Product Support Services.
The cost is well worth the time and effort they put in to resolving the
issue with you, and much cheaper than your cost of Downtime and time
spent searching for (free) answers.
--
Henry Craven {SBS-MVP}
Melbourne Australia
"kevin gal" <anon...@discussions.microsoft.com> wrote in message
news:2301101c45dfc$77d24ff0$a401...@phx.gbl...
> help!1
Les Connor [SBS MVP]
on eventid.net and the mskb. It wasn't a difficult task. Unfortunately, the
error condition was on a test box and I didn't keep notes on the resolution.
But you are on the trail....
--
Les Connor [SBS MVP]
-------------------------------------
SBS Rocks !
"Henry Craven" <IUnk...@Dot.Nyet> wrote in message
news:ej0b9oiX...@tk2msftngp13.phx.gbl...
Christopher Ames MSFT
Below is the steps needed to Reinitialize File Replication
KBLink:221111.KB.EN-US: Description of FRS Entries in the Registry
To perform a non-authoritative restore, stop the FRS
service, configure the
BurFlags
registry key, and then restart
the FRS service. To do so:
1. Click "Start", and then click "Run".
2. In the "Open" box, type "cmd" (without the quotation marks) and then
press ENTER.
3. In the "Command" box, type "net stop ntfrs" (without the quotation
marks).
4. Click "Start", and then click "Run".
5. In the "Open" box, type "regedit" (without the quotation marks) and
then press ENTER.
6. Locate the following subkey in the registry:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Ba
ckup/Restore\Process at Startup
7. In the right pane, double-click "BurFlags".
8. In the "Edit DWORD Value" dialog box, type "D2" (without the
quotation marks) and then click "OK".
9. Quit Registry Editor, and then switch to the "Command" box.
10. In the "Command" box, type "net start ntfrs" (without the quotation
marks).
11. Quit the "Command" box.
When the FRS service restarts, the following actions
occur:
- The value for BurFlags registry key returns to 0.
- Files in the reinitialized FRS folders are moved to a <Pre-existing>
folder.
- The FRS database is rebuilt.
- The member performs an initial join of the replica set from an
upstream partner or from the computer that is specified in the Replica
Set Parent registry key if a parent has been specified for SYSVOL
replica sets.
- The reinitialized computer performs a full replication of the
affected replica sets when the relevant replication schedule begins.
Note: The placement of files in the
<Pre-existing> folder on reinitialized members is a
safeguard in FRS designed to prevent accidental data loss. Any files
destined
for the replica that exist only in the local
<Pre-existing> folder and did not replicate in after
the initial replication may then be copied to the appropriate folder.
When
outbound replication has occurred, delete files in the
<Pre-existing> folder to free up additional drive
space.
#toc: back to the
top
Authoritative FRS Restore
Use authoritative restores only as a final option, such as in the
case of directory collisions.
For example, you may require an
authoritative restore if you must recover an FRS replica set where
replication
has completely stopped and requires a rebuild from scratch.
The
following list of requirements must be met when before you perform an
authoritative FRS restore:
1. The FRS service must be disabled on all downstream partners (direct
and transitive) for the reinitialized replica sets before you restart
the FRS service when the authoritative restore has been configured to
occur.
2. Events 13553 and 13516 have been logged in the FRS event log. These
events indicate that the membership to the replica set has been
established on the computer that is configured for the authoritative
restore.
3. The computer that is configured for the authoritative
restore is configured to be authoritative for all the data that you
want to
replicate to replica set members. This is not the case if you are
performing a
join on an empty directory.
For additional information, click the
following article number to view the article in the Microsoft
Knowledge Base:
KBLink:266679.KB.EN-US: Pre-staging the File Replication Service
Replicated Files on SYSVOL and Distributed File System Shares for
Optimal Synchronization
4. All other partners in the replica set must be reinitialized with a
non-authoritative restore.
To complete an authoritative restore, stop the FRS service,
configure the
BurFlags
registry key, and then restart the FRS service. To do so:
1. Click "Start", and then click "Run".
2. In the "Open" box, type "cmd" (without the quotation marks) and then
press ENTER.
3. In the "Command" box, type "net stop ntfrs" (without the quotation
marks).
4. Click "Start", and then click "Run".
5. In the "Open" box, type "regedit" (without the quotation marks) and
then press ENTER.
6. Locate the following subkey in the registry:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Ba
ckup/Restore\Process at Startup
7. In the right pane, double click "BurFlags".
8. In the "Edit DWORD Value" dialog box, type "D4" (without the
quotation marks) and then click "OK".
9. Quit Registry Editor, and then switch to the "Command" box.
10. In the "Command" box, type "net start ntfrs" (without the quotation
marks).
11. Quit the "Command" box.
When the FRS service is restarted, the following actions
occur:
- The value for the BurFlags registry key is set back to 0.
- Files in the reinitialized FRS replicated directories remain
unchanged and become authoritative on direct replication, and through
transitive replication, indirect replication partners.
- The FRS database is rebuilt based on current file inventory.
#toc: back to
the top
Global vs. Replica Set Specific Reinitialization
------------------------------------------------
There are both global- and replica set-specific
BurFlags
registry keys.
Setting the global
BurFlags
registry key reinitializes all
replica sets that the member holds. Do this only when the computer
holds only
one replica set, or when the replica sets that it holds are relatively
small.
In contrast to configuring the global
BurFlags
key, the
replica set
BurFlags
key
permits you to reinitializes discrete, individual replica sets, allowing
healthy replication sets to be left intact.
The global
BurFlags
registry key is
found in the following location in the registry:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Ba
ckup / Restore\Process At Startup
This key can contain the same values as those that are
discussed earlier in this article for authoritative and
non-authoritative
restores.
You can locate the replica set specific
BurFlags
registry key by
determining the GUID for the replica set that you want to configure. To
determine which GUID corresponds to which replica set and configure a
restore,
follow these steps:
1. Click "Start", and then click "Run".
2. In the "Open" box, type "cmd" (without the quotation marks) and then
press ENTER.
3. In the "Command" box, type "net stop ntfrs" (without the quotation
marks).
4. Click "Start", and then click "Run".
5. In the "Open" box, type "regedit" (without the quotation marks) and
then press ENTER.
6. To determine the GUID that represents the replica set that
you want to configure, follow these steps:
a. Locate the following key in the registry:
KEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Replica
Sets
b. Below the "Replica Sets" subkey, there
are one or more subkeys that are identified by a GUID. In the left
pane, click
the GUID, and then in the right pane note the "Data" that is
listed for the "Replica Set Root" value. This file system path
will indicate which replica set is represented by this GUID.
c. Repeat step 4 for each GUID that is listed below the
"Replica Sets" subkey until you locate the replica set that you
want to configure. Note the GUID.
7. Locate the following key in the registry:
KEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Cum
ulative Replica Sets
8. Below the "Cumulative Replica Sets" subkey, locate the GUID you
noted in step 6c.
9. In the right pane, double click" BurFlags".
10. In the "Edit DWORD Value" dialog box, type "D2" (without the
quotation marks) to complete a non-authoritative restore or type "D4"
(without the quotation marks) to complete an authoritative restore, and
then click "OK".
11. Quit Registry Editor, and then switch to the "Command" box.
12. In the "Command" box, type "net start ntfrs" (without the quotation
marks).
13. Quit the "Command" box.
#toc: back to
the top
Considerations Before You Configure Authoritative or Non-Authoritative
Restores of FRS Members
If you configure an FRS member to complete an authoritative or
non-authoritative restore by using the
BurFlags
registry subkey, you do not
resolve the issues that initially caused the replication problem. If
you cannot
determine the cause of the replication difficulties, the members will
typically
revert back to the problematic situation as replication continues.
Thank you,
--------------------------
Christopher Ames
Microsoft Online Support Engineer
=====================================================
When responding to posts, please "Reply to Group" via your newsreader
so that others may learn and benefit from your issue.
For SBS 4.5 issues, post to: microsoft.public.backoffice.smallbiz
For SBS 2000 issues, post to: microsoft.public.backoffice.smallbiz2000
For SBS 2003 issues, post to: microsoft.public.windows.server.sbs
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
</BODY>