FRS Errors and LSASS.exe maxing out processors

C

Chris Coates

I have a Win 2000 AD Environment, with multiple remote sites. All DCs in all
sites are running Win2000 SP4

I have been noticing that the DC in one of the remote sites, BRDC1, is
having extremely high processor utilization frequently (Server has duel
866Mhz processors and 1GB RAM.).



I have been watching Task Manager on that server and the excessive processor
utilization is related to LSASS.exe



I am also seeing the following errors in the event logs.



Warning

Brdc1

12/17/2003 23:39:04

12/17/2003 23:39:06

{6BD1CCB2-87F6-4EA6-A225-362DB043A838}

13567

NtFrs

File Replication Service

None



File Replication Service has detected and suppressed an average of 15 or
more file updates

every hour for the last 3 hours because the updates did not change the
contents of

the file. The tracking records in FRS debug logs will have the filename and
event time

for the suppressed updates. The tracking records have the date and time
followed by :T:

as their prefix.



Updates that do not change the content of the file are suppressed to prevent

unnecessary replication traffic. Following are common examples of updates
that do not

change the contents of the file.



[1] Overwriting a file with a copy of the same file.

[2] Setting the same ACLs on a file multiple times.

[3] Restoring an identical copy of the file over an existing one.



Suppression of updates can be disabled by running regedit.



Click on Start, Run and type regedit.



Expand HKEY_LOCAL_MACHINE, SYSTEM, CurrentControlSet, Services, NtFrs,
Parameters,

and create or update the value Suppress Identical Updates To Files to 0
(Default is 1) to force

identical updates to replicate.



And also:



Warning

Brdc1

12/22/2003 16:42:19

12/22/2003 16:42:24

{900CFD95-A82B-4551-8AF2-2CFD42FC51E4}

13522

NtFrs

File Replication Service

None



The File Replication Service paused because the staging area is full.

Replication will resume if staging space becomes available or if the

staging space limit is increased.



The current value of the staging space limit is 1200000 KB.



To change the staging space limit, run regedit.



Click on Start, Run and type regedit.



Expand HKEY_LOCAL_MACHINE, SYSTEM, CurrentControlSet, Services, NtFrs,
Parameters,

and the value Staging Space Limit in KB.





I have already increased the limit once but that has not helped.



And also:



Warning

Brdc1

12/21/2003 15:18:14

12/21/2003 15:18:16

{AC7B275F-A592-44F0-9111-2D1768EACE78}

13508

NtFrs

File Replication Service

None



The File Replication Service is having trouble enabling replication

from SPDC1 to BRDC1 for d:\ using the DNS name spdc1.gfsprod.nt.gfs.com. FRS
will keep retrying.

Following are some of the reasons you would see this warning.



[1] FRS can not correctly resolve the DNS name spdc1.gfsprod.nt.gfs.com
from this computer.

[2] FRS is not running on spdc1.gfsprod.nt.gfs.com.

[3] The topology information in the Active Directory for this replica has
not

yet replicated to all the Domain Controllers.



This event log message will appear once per connection, After the problem

is fixed you will see another event log message indicating that the
connection

has been established.



I have looked and the FRS service is running on the DC SPDC1, also the AD
topology has not changed in 2 years, and BRDC1 can do name resolution to
SPDC1.





The only other things running on these DCs are DNS, WINS and DFS.



The other DCs at remote sites are all set up the same, and have the same
size WAN link in between and I am seeing none of theses issues on them.



Any suggestions are appreciated.



Thanks



ccoates
 
A

Ace Fekay [MVP]

In
Chris Coates said:
I have a Win 2000 AD Environment, with multiple remote sites. All DCs
in all sites are running Win2000 SP4

I have been noticing that the DC in one of the remote sites, BRDC1, is
having extremely high processor utilization frequently (Server has
duel 866Mhz processors and 1GB RAM.).



I have been watching Task Manager on that server and the excessive
processor utilization is related to LSASS.exe



I am also seeing the following errors in the event logs.



Warning

Brdc1

12/17/2003 23:39:04

12/17/2003 23:39:06

{6BD1CCB2-87F6-4EA6-A225-362DB043A838}

13567

NtFrs

File Replication Service

None



File Replication Service has detected and suppressed an average of 15
or more file updates

every hour for the last 3 hours because the updates did not change the
contents of

the file. The tracking records in FRS debug logs will have the
filename and event time

for the suppressed updates. The tracking records have the date and
time followed by :T:

as their prefix.



Updates that do not change the content of the file are suppressed to
prevent

unnecessary replication traffic. Following are common examples of
updates that do not

change the contents of the file.



[1] Overwriting a file with a copy of the same file.

[2] Setting the same ACLs on a file multiple times.

[3] Restoring an identical copy of the file over an existing one.



Suppression of updates can be disabled by running regedit.



Click on Start, Run and type regedit.



Expand HKEY_LOCAL_MACHINE, SYSTEM, CurrentControlSet, Services, NtFrs,
Parameters,

and create or update the value Suppress Identical Updates To Files to
0 (Default is 1) to force

identical updates to replicate.



And also:



Warning

Brdc1

12/22/2003 16:42:19

12/22/2003 16:42:24

{900CFD95-A82B-4551-8AF2-2CFD42FC51E4}

13522

NtFrs

File Replication Service

None



The File Replication Service paused because the staging area is full.

Replication will resume if staging space becomes available or if the

staging space limit is increased.



The current value of the staging space limit is 1200000 KB.



To change the staging space limit, run regedit.



Click on Start, Run and type regedit.



Expand HKEY_LOCAL_MACHINE, SYSTEM, CurrentControlSet, Services, NtFrs,
Parameters,

and the value Staging Space Limit in KB.





I have already increased the limit once but that has not helped.



And also:



Warning

Brdc1

12/21/2003 15:18:14

12/21/2003 15:18:16

{AC7B275F-A592-44F0-9111-2D1768EACE78}

13508

NtFrs

File Replication Service

None



The File Replication Service is having trouble enabling replication

from SPDC1 to BRDC1 for d:\ using the DNS name
spdc1.gfsprod.nt.gfs.com. FRS will keep retrying.

Following are some of the reasons you would see this warning.



[1] FRS can not correctly resolve the DNS name
spdc1.gfsprod.nt.gfs.com from this computer.

[2] FRS is not running on spdc1.gfsprod.nt.gfs.com.

[3] The topology information in the Active Directory for this
replica has not

yet replicated to all the Domain Controllers.



This event log message will appear once per connection, After the
problem

is fixed you will see another event log message indicating that the
connection

has been established.



I have looked and the FRS service is running on the DC SPDC1, also
the AD topology has not changed in 2 years, and BRDC1 can do name
resolution to SPDC1.





The only other things running on these DCs are DNS, WINS and DFS.



The other DCs at remote sites are all set up the same, and have the
same size WAN link in between and I am seeing none of theses issues
on them.



Any suggestions are appreciated.



Thanks



ccoates


Read up on these articles carefully and see if the scenarios/issues they
state apply to your sceanrio, including apps installed (such as AV
software), etc.

http://www.eventid.net/display.asp?eventid=13508&source=
http://www.eventid.net/display.asp?eventid=13522&source=
http://www.eventid.net/display.asp?eventid=13567&source=

I'm aslo going to assume that you do not have your ISP's DNS server in your
IP properties of any machine in your AD infrastructure (DCs or clients).
That will cause numerous similar problems too.


--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.
This posting is provided "AS IS" with no warranties.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top