Ошибка 13508 ntfrs

  • Remove From My Forums

  • Question

  • Event Type: Warning

    Event Source: NtFrs

    Event Category: None

    Event ID: 13508

    Date: 1/17/2012

    Time: 6:49:55 PM

    User: N/A

    Computer: MAILADC

    Description:

    The File Replication Service is having trouble enabling replication from MDC to MAILADC for c:windowssysvoldomain using the DNS name mdc.siroclinpharm.com. FRS will keep retrying. 

     Following are some of the reasons you would see this warning. 

     [1] FRS can not correctly resolve the DNS name mdc.siroclinpharm.com from this computer. 

     [2] FRS is not running on mdc.siroclinpharm.com. 

     [3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers. 

     This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

    Data:

    0000: d5 04 00 00               Õ…  

    Also I am not getting event 13509 after 13508 

    • Edited by

      Wednesday, January 18, 2012 11:52 AM

Answers

  • Hi,

    Event ID 13568 indicates the replica set is in Journal wrap error state, it occur if a sufficient number of changes that occur while FRS is turned off in such a way that the last USN change that FRS recorded during shutdown no longer exists in the USN journal
    during startup. The risk is that changes to files and folders for FRS replicated trees may have occurred while the service was turned off, and no record of the change exists in the USN journal. To guard against data inconsistency, FRS asserts into a journal
    wrap state. 

    • How to troubleshoot journal_wrap errors on Sysvol and DFS replica sets- http://support.microsoft.com/?kbid=292438
    • What happens in a Journal Wrap? :
      http://blogs.technet.com/b/instan/archive/2009/07/14/what-happens-in-a-journal-wrap.aspx
    • Journal Wrap: http://adfordummiez.com/?p=61

    Regards,

    Abhijit Waikar — MCSA 2003|MCSA 2003:Messaging|MCTS|MCITP:SA

    • Edited by
      Abhijit Waikar
      Wednesday, January 18, 2012 12:02 PM
    • Proposed as answer by
      Meinolf Weber
      Wednesday, January 18, 2012 1:06 PM
    • Marked as answer by
      Yan Li_
      Monday, January 23, 2012 2:08 AM

  • Hi,

    According to the event ID:13568, it indicates that there is a domain controller is in a journal wrap state.

    To troubleshoot the cause of a journal wrap, see the following article in the Microsoft Knowledge Base:

    Troubleshooting Journal_Wrap Errors on Sysvol and DFS Replica Sets

    http://support.microsoft.com/?id=292438

    After you determine the cause of a journal wrap or after you have taken steps to prevent future journal wraps, at a
    convenient time, make the following changes to the registry:

    1.

    Stop FRS.

    2.

    Start Registry Editor (Regedt32.exe).

    3.

    Locate and click the following key in the registry:

    HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesNtFrsParameters

    BackupRestoreProcess at Startup

    4.

    On the
    Edit menu, click Add Value , and then add the following registry value:

    Value name: BurFlags

    Data type: REG_DWORD
    Radix: Hexadecimal
    Value data: D2

    5.

    Quit Registry Editor.

    6.

    Restart FRS.

    This should take the DC out of JRNL_WRAP_ERROR. Monitor your logs for the next 24 hours to make sure
    that you do not see any Event ID: 13568 errors in the File Replication Service Logs. If this does not work, you will need to do a non-authoritative restore of Active Directory.

    Hope this helps.

    Best Regards,

    Yan Li

    Yan Li

    TechNet Community Support

    • Edited by
      Yan Li_
      Thursday, January 19, 2012 6:38 AM
    • Marked as answer by
      Yan Li_
      Monday, January 23, 2012 2:07 AM

  • The error message you have posted indicates that FRS is in Jornal Wrap error state.In the event itself the the recovery procedure is given.

    Your first step should be finding why JRNL_WRAP_ERROR error has occurred. Normally, JRNL_WRAP_ERROR occurs due to drive/partition being corrupted, antivirus locking and corrupting the file during sysvol scan, heavy size of the files inside sysvol and netlogon
    shares.

    The solution is listed in your event log.

    Click on Start, Run and type regedit.

     
    Expand HKEY_LOCAL_MACHINE.
    Click down the key path:
       «SystemCurrentControlSetServicesNtFrsParameters»
    Double click on the value name
       «Enable Journal Wrap Automatic Restore»
    and update the value.

    If the value name(Enable Journal Wrap Automatic Restore) is not present you may add it with the New->DWORD Value and set the value to 1 and restart FRS service.
    Once the recovery is completed make sure that the Enable Journal Wrap Automatic Restore is set to 0 or delete the key.

    If the JRNL_WRAP_ERROR occurs frequently, you need to exclude sysvol/netlogon from antvirus scan, check the drive for corruption or bad sector and also restore a sysvol using burflag key.

    http://msdn.microsoft.com/en-us/library/windows/desktop/cc507518%28v=vs.85%29.aspx

    You can also fix the same by performing authorative and non authorative of sysvol folder as other mentioned.

    http://support.microsoft.com/kb/290762

    1) Normally for an Authoritative Restore you stop at NTFRS services on all DCs.
    2) Set burflags to D4 on a known good sysvol (or at this time restore sysvol data from backup then set burflags to D4) then start NTFRS on this server.  You may want to rename the old folders with .old extensions prior to restoring good data.
    3) Clean up the folders on all the remaining servers (Policies, Scripts, etc) — renamed them with .old extensions.
    4) Set burflags to D2 on all remaining servers and start NTFRS.
    5) Wait for FRS to replicate.
    6) Clean up the .old stuff if things look good.

    This is probably what you need to do to get it back.

    Note:Kindly take the backup of sysvol folder(Policies & Script) before you proceed.

    Hope this helps

    Regards,
    Sandesh Dubey.
    ——————————-
    MCSE|MCSA:Messaging|MCTS|MCITP:Enterprise Adminitrator
    My Blog: http://sandeshdubey.wordpress.com
    This posting is provided AS IS with no warranties, and confers no rights.

    • Marked as answer by
      Yan Li_
      Monday, January 23, 2012 2:08 AM

Источник

hello All, I have armdc01, armfs01 in office A, armdc01 is PDC, armfs01 is file server; toofs01 in office B, wagdc01 is office C; they are also DNS server and DHCP servers; I set up (armfs01, toofs01, wagdc01) to be DFS replica member for several years;
however, it stopped file relicate from this Tuesday; I logged on to toofs01 and found actually it has problem on 4th of June with error code 13555 and 13506, but today it only has 13508 and 13509; also I logged onto armfs01 , the error code of FRS displayed
today is still 13506,13555,13502,13505; then I have running FRSdiag tool to analysis the problem: following is the log running on server toofs01: 

————————————————————

FRSDiag v1.7 on 6/15/2012 9:07:07 AM

.toofs01 on 2012-06-15 at 9.07.07 AM

————————————————————

Detecting this machine’s domain role … Domain Controller

Processing File Replication Service Event Log… 501 items………….Done!

Processing Application Event Log… 1000 items………….Done!

Processing System Event Log… 1000 items………….Done!

Processing Directory Service Event Log… 1000 items………….Done!

Processing DNS Server Event Log… 112 items………….Done!

Processing ntfrsutl Version….Done!

Processing ntfrsutl ds….NTFRSUTL ERROR — Cannot RPC to computer, toofs01; 000006d9 (1753)… Make sure you are logged on as a Domain Admin! Skipping!

Processing ntfrsutl sets….NTFRSUTL ERROR — Cannot RPC to computer, toofs01; 000006d9 (1753)… Make sure you are logged on as a Domain Admin! Skipping!

Processing ntfrsutl configtable….NTFRSUTL ERROR — Cannot RPC to computer, toofs01; 000006d9 (1753)… Make sure you are logged on as a Domain Admin! Skipping!

Processing ntfrsutl inlog….NTFRSUTL ERROR — Cannot RPC to computer, toofs01; 000006d9 (1753)… Make sure you are logged on as a Domain Admin! Skipping!

Processing ntfrsutl outlog….NTFRSUTL ERROR — Cannot RPC to computer, toofs01; 000006d9 (1753)… Make sure you are logged on as a Domain Admin! Skipping!

Processing ntfrsutl stage….NTFRSUTL ERROR — Cannot RPC to computer, toofs01; 000006d9 (1753)… Make sure you are logged on as a Domain Admin! Skipping!

Processing NTFRS Debug Logs …

NtFrs_0001.log(6/14/2012 5:49:45 PM) … Done

NtFrs_0002.log(6/14/2012 6:11:50 PM) … Done

NtFrs_0003.log(6/14/2012 6:14:43 PM) … Done

NtFrs_0004.log(6/14/2012 6:33:02 PM) … Done

NtFrs_0005.log(6/14/2012 6:38:28 PM) … Done … Done with all logs!

Processing Services and Shares check…Done!

Processing Registry Dump of NtFrs related Keys …Done!

Processing repadmin /showreps….Done!

Processing repadmin /showconn….Done!

All Done!

Please wait, generating .CAB file ….. Done!

FRSDiag v1.7 on 6/15/2012 9:07:07 AM

.toofs01 on 2012-06-15 at 9.07.07 AM

————————————————————

Checking for errors/warnings in FRS Event Log ….

NtFrs 6/14/2012 4:36:15 PM Warning 13508 The File Replication Service is having trouble enabling replication from WAGDC01 to TOOFS01 for f:dfs_jobs using the DNS name wagdc01.easystems.com. FRS will keep retrying. Following are some of the reasons you would
see this warning. [1] FRS can not correctly resolve the DNS name wagdc01.easystems.com from this computer. [2] FRS is not running on wagdc01.easystems.com. [3] The topology information in the Active Directory Domain Services for this replica has not yet replicated
to all the Domain Controllers. This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.

NtFrs 6/14/2012 3:15:53 PM Warning 13508 The File Replication Service is having trouble enabling replication from ARMFS01 to TOOFS01 for f:ea_docsdfs_hr using the DNS name armfs01.easystems.com. FRS will keep retrying. Following are some of the reasons
you would see this warning. [1] FRS can not correctly resolve the DNS name armfs01.easystems.com from this computer. [2] FRS is not running on armfs01.easystems.com. [3] The topology information in the Active Directory Domain Services for this replica has
not yet replicated to all the Domain Controllers. This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.

NtFrs 6/14/2012 3:01:52 PM Warning 13508 The File Replication Service is having trouble enabling replication from ARMFS01 to TOOFS01 for f:dfs_gis using the DNS name armfs01.easystems.com. FRS will keep retrying. Following are some of the reasons you would
see this warning. [1] FRS can not correctly resolve the DNS name armfs01.easystems.com from this computer. [2] FRS is not running on armfs01.easystems.com. [3] The topology information in the Active Directory Domain Services for this replica has not yet replicated
to all the Domain Controllers. This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.

WARNING: Found Event ID 13508 errors without trailing 13509 … see above for (up to) the 3 latest entries!

……… failed 1

Checking for errors in Directory Service Event Log …. passed

Checking for minimum FRS version requirement … passed

Checking for errors/warnings in ntfrsutl ds … could not check!

Checking for Replica Set configuration triggers… could not check!

Checking Overall Disk Space and SYSVOL structure (note: integrity is not checked)…could not check!

Checking for suspicious inlog entries …could not check!

Checking for suspicious outlog entries …could not check!

Checking for appropriate staging area size …could not check!

Checking for errors in debug logs …

ERROR on NtFrs_0004.log : «ERROR_ACCESS_DENIED» : <SndCsMain: 3264: 904: S0: 18:31:54> :SR: Cmd 0d972050, CxtG 074f0f5c, WS ERROR_ACCESS_DENIED, To armfs01.easystems.com Len: (396) [SndFail — Send Penalty]

ERROR on NtFrs_0004.log : «ERROR_ACCESS_DENIED» : <SndCsMain: 3264: 877: S0: 18:31:58> :SR: Cmd 00102310, CxtG 5f2aac19, WS ERROR_ACCESS_DENIED, To armfs01.easystems.com Len: (396) [SndFail — rpc call]

ERROR on NtFrs_0004.log : «ERROR_ACCESS_DENIED» : <SndCsMain: 3264: 904: S0: 18:31:58> :SR: Cmd 00102310, CxtG 5f2aac19, WS ERROR_ACCESS_DENIED, To armfs01.easystems.com Len: (396) [SndFail — Send Penalty]

ERROR on NtFrs_0005.log : «EPT_S_NOT_REGISTERED(This may indicate that DNS returns the IP address of the wrong computer. Check DNS records being returned, Check if FRS is currently running on the target server. Check if Ntfrs is registered with the End-Point-Mapper
on target server!)» : <SndCsMain: 404: 883: S0: 18:34:58> ++ ERROR — EXCEPTION (000006d9) : WStatus: EPT_S_NOT_REGISTERED

ERROR on NtFrs_0005.log : «EPT_S_NOT_REGISTERED(This may indicate that DNS returns the IP address of the wrong computer. Check DNS records being returned, Check if FRS is currently running on the target server. Check if Ntfrs is registered with the End-Point-Mapper
on target server!)» : <SndCsMain: 404: 884: S0: 18:34:58> :SR: Cmd 0c46c680, CxtG 87a832f5, WS EPT_S_NOT_REGISTERED, To armfs01.easystems.com Len: (396) [SndFail — rpc exception]

ERROR on NtFrs_0005.log : «EPT_S_NOT_REGISTERED(This may indicate that DNS returns the IP address of the wrong computer. Check DNS records being returned, Check if FRS is currently running on the target server. Check if Ntfrs is registered with the End-Point-Mapper
on target server!)» : <SndCsMain: 404: 904: S0: 18:34:58> :SR: Cmd 0c46c680, CxtG 87a832f5, WS EPT_S_NOT_REGISTERED, To armfs01.easystems.com Len: (396) [SndFail — Send Penalty]

ERROR on NtFrs_0002.log : «RPC_S_CALL_FAILED_DNE(Indicates RPC Session was established to target, but there was a failure to send RPC call package. Check for Networking problems!)» : <SndCsMain: 836: 883: S0: 17:59:05> ++ ERROR — EXCEPTION (000006bf)
: WStatus: RPC_S_CALL_FAILED_DNE

ERROR on NtFrs_0002.log : «RPC_S_CALL_FAILED_DNE(Indicates RPC Session was established to target, but there was a failure to send RPC call package. Check for Networking problems!)» : <SndCsMain: 836: 884: S0: 17:59:05> :SR: Cmd 235d1770, CxtG 106a5411,
WS RPC_S_CALL_FAILED_DNE, To armfs01.easystems.com Len: (396) [SndFail — rpc exception]

ERROR on NtFrs_0002.log : «RPC_S_CALL_FAILED_DNE(Indicates RPC Session was established to target, but there was a failure to send RPC call package. Check for Networking problems!)» : <SndCsMain: 836: 904: S0: 17:59:05> :SR: Cmd 235d1770, CxtG 106a5411,
WS RPC_S_CALL_FAILED_DNE, To armfs01.easystems.com Len: (396) [SndFail — Send Penalty]

Found 88 ERROR_ACCESS_DENIED error(s)! Latest ones (up to 3) listed above

Found 150 EPT_S_NOT_REGISTERED error(s)! Latest ones (up to 3) listed above

Found 3 RPC_S_CALL_FAILED_DNE error(s)! Latest ones (up to 3) listed above

……… failed with 241 error entries

Checking NtFrs Service (and dependent services) state…

ERROR : Required Service not Running : «File Replication Service» is currently «Stopped»

……… failed 1

Checking NtFrs related Registry Keys for possible problems…passed

Checking Repadmin Showreps for errors…passed

Final Result = Could not grab data ———————— it will be highly appreciated if you can give any assistance how to receover; thanks

Источник

  • #1

Доброго времени суток! Есть два контроллера домена PDC и SDC которые живут в одной подсети /24
Решил прошерстить журнал контроллеров домена на предмет ошибок и нашел вот что:

Служба репликации файлов столкнулась с проблемами при включении репликации с «SDC» на «PDC» для «c:windowssysvoldomain», использующего DNS-имя «SDC.DOMAIN.Local». Служба репликации файлов (FRS) продолжит повторные попытки.
Ниже указаны причины, по которым может выдаваться это предупреждение.

[1] FRS не может разрешить DNS-имя «SDC.DOMAIN.Local» с этого компьютера.
[2] FRS не запущена на «SDC.DOMAIN.Local».
[3] Сведения о топологии в доменных службах Active Directory для этой реплики реплицированы еще не на все контроллеры домена.

Это сообщение об ошибке записывается в журнал для каждого подключения один раз. После исправления ошибки в журнал будет записано другое сообщение, означающее, что соединение установлено.

EventID 13508 от источника NtFrs. Подскажите что это означает? :wtf:

PS repadmin /showrepl показывает что репликация службы каталогов работает успешно..

— -Подумал и добавил — —

UPDATE.

Еще там же в журнале AD обнаружена ошибка:

Служба репликации файлов обнаружила что путь к корню репликации изменен с «c:windowssysvoldomain» на «c:windowssysvoldomain». Если это сделано умышленно, то в новом корне необходимо создать файл с именем NTFRS_CMD_FILE_MOVE_ROOT.
Это было обнаружено для следующего набора реплик:
«DOMAIN SYSTEM VOLUME (SYSVOL SHARE)»

Изменение пути к корню реплики является двухэтапным процессом, который запускается при создании файла NTFRS_CMD_FILE_MOVE_ROOT file.

[1] Во время первого опроса, который происходит в течение 60 минут, этот компьютер будет удален из набора реплик.
[2] Во время следующего опроса, этот компьютер будет вновь добавлен к набору реплик с новым путем к корню. Повторное добавление запустит полную синхронизацию дерева для данного набора реплик. После этой синхронизации все файлы будут находится на новом месте. Удалять те же файлы из их прежнего местоположения зависит от того, нужны они еще там или нет.

Код события 13559

  • #3

Доброго времени суток! Есть два контроллера домена PDC и SDC которые живут в одной подсети /24
Решил прошерстить журнал контроллеров домена на предмет ошибок и нашел вот что:

EventID 13508 от источника NtFrs. Подскажите что это означает? :wtf:

PS repadmin /showrepl показывает что репликация службы каталогов работает успешно..

— -Подумал и добавил — —

UPDATE.

Еще там же в журнале AD обнаружена ошибка:

Код события 13559

Попробуйте сделать на обоих КД

попробуйте проверить права на доступ к папке sysvol

В догонку https://support.microsoft.com/ru-ru…d-the-sysvol-tree-and-its-content-in-a-domain

Источник

I have 2 domain controllers, one physical (physDC4) and one virtual (virtDC5), both are Server 2008 R2.  I’m getting ready to replace the physical one with a VM.

What I’m trying to understand is whether I should bother trying to fix the items below or just continue setting up the new DC and see if it works itself out after the physical one is removed.  If I should fix them, then I’m wondering if these are directly related or not, and which one I should try to fix first.

The event log on physDC4 has an NtFrs warning event 13508 once per day, and the event log on virtDC5 has an NtFrs error event 13568 after every time it’s rebooted.  DCDIAG (below) is showing those errors and warnings for FRS on each DC.

DNS and AD DS work fine and are replicating.

physDC4 DCDIAG

Starting test: FrsEvent

* The File Replication Service Event log test

There are warning or error events within the last 24 hours after the

SYSVOL has been shared. Failing SYSVOL replication problems may cause

Group Policy problems.

A warning event occurred. EventID: 0x800034C4

Time Generated: 04/07/2016 15:17:01

Event String:

The File Replication Service is having trouble enabling replication from virtDC5 to physDC4 for c:windowssysvoldomain using the DNS name virtDC5.domain.com. FRS will keep retrying.

Following are some of the reasons you would see this warning.

[1] FRS can not correctly resolve the DNS name virtDC5.domain.com from this computer.

[2] FRS is not running on virtDC5.domain.com.

[3] The topology information in the Active Directory Domain Services for this replica has not yet replicated to all the Domain Controllers.

This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.

……………………. physDC4 passed test FrsEvent

virtDC5 DCDIAG

Starting test: FrsEvent

* The File Replication Service Event log test

There are warning or error events within the last 24 hours after the

SYSVOL has been shared. Failing SYSVOL replication problems may cause

Group Policy problems.

An error event occurred. EventID: 0xC0003500

Time Generated: 04/08/2016 11:23:31

Event String:

The File Replication Service has detected that the replica set «DOMAIN SYSTEM VOLUME (SYSVOL SHARE)» is in JRNL_WRAP_ERROR.

Replica set name is : «DOMAIN SYSTEM VOLUME (SYSVOL SHARE)»

Replica root path is : «c:windowssysvoldomain»

Replica root volume is : «\.C:»

A Replica set hits JRNL_WRAP_ERROR when the record that it is trying to read from the NTFS USN journal is not found. This can occur because of one of the following reasons.

[1] Volume «\.C:» has been formatted.

[2] The NTFS USN journal on volume «\.C:» has been deleted.

[3] The NTFS USN journal on volume «\.C:» has been truncated. Chkdsk can truncate the journal if it finds corrupt entries at the end of the journal.

[4] File Replication Service was not running on this computer for a long time.

[5] File Replication Service could not keep up with the rate of Disk IO activity on «\.C:».

Setting the «Enable Journal Wrap Automatic Restore» registry parameter to 1 will cause the following recovery steps to be taken to automatically recover from this error state.

[1] At the first poll, which will occur in 5 minutes, this computer will be deleted from the replica set. If you do not want to wait 5 minutes, then run «net stop ntfrs» followed by «net start ntfrs» to restart the File Replication Service.

[2] At the poll following the deletion this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set.

WARNING: During the recovery process data in the replica tree may be unavailable. You should reset the registry parameter described above to 0 to prevent automatic recovery from making the data unexpectedly unavailable if this error condition occurs again.

To change this registry parameter, run regedit.

Click on Start, Run and type regedit.

Expand HKEY_LOCAL_MACHINE.

Click down the key path:

«SystemCurrentControlSetServicesNtFrsParameters»

Double click on the value name

«Enable Journal Wrap Automatic Restore»

and update the value.

If the value name is not present you may add it with the New->DWORD Value function under the Edit Menu item. Type the value name exactly as shown above.

……………………. virtDC5 failed test FrsEvent

Источник

Понравилась статья? Поделить с друзьями:

Не пропустите эти материалы по теме:

  • Яндекс еда ошибка привязки карты
  • Ошибка 13504 opel astra h
  • Ошибка 13500 опель астра h
  • Ошибка 1364 mysql workbench
  • Ошибка 13639427 vag

    • 0 0 голоса
    Рейтинг статьи
    Подписаться
    Уведомить о
    guest

    0 комментариев
    Старые
    Новые Популярные
    Межтекстовые Отзывы
    Посмотреть все комментарии