Re: Help understanding FRS log files in

[Brian [MSFT]]

Rich,
In general, most FRS debug log contents are noise & can be ignored. You do,
however, have a problem with FRS on this machine. As the eventlog notes,
and as the dprints below specify, FRS is not replicating because it has
detected that the replica root (the replicated folder) has somehow changed.
Typical causes for this error: manual deletion & recreation of the replica
root, or restoring a backed-up image of the replica root. FRS stores the
file ID of the original folder in it's database; when a new folder is
created (or restored) it gets a new file ID, which FRS flags as a possible
error.

If the other replication partner is online & healthy, you should simply
follow the instructions in the eventlog: create a file named
NTFRS_CMD_FILE_MOVE_ROOT in the new location. This will trigger a full
re-sync. More complicated strategies might be involved if you don't have
another healthy replication partner, if the replication partners are holding
massive amounts of data, if data access on this machine is critical, or if
the replication partners are separated by slow links. If this is a DFS
link, it would be a good idea to remove this machine as a target until it is
back online. If it is a DC, it will be offline until it has re-synced. I
suggest you download the FRS troubleshooting package which includes SONAR
for monitoring & the "official" FRS troubleshooting document. It is
available here:

http://www.microsoft.com/windows2000/techinfo/reskit/tools/new/sonar-o.asp

If you have further questions, please post again.

--
Brian [MSFT]

Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights. Please do not send e-mail directly to this alias. This alias is
for newsgroup purposes only.

Hello,
We are getting errors in the File Replication Service Event log.
Doing research on the problem led me to the FRS log files located in
C:\Winnt\debug. Filename(s) are NtFrs_000x where x = 1-5.
While FRS was running, I examined the NtFrs_0005 file, which is the current
log file. For easy viewing, I opened the file with Word with page set to
Landscape. Assume approximately 40 lines per page.
In my file, approximately 100 lines into the file on page 3, I find the
first error.


<CfgRegReadDWord: 2116: 2394: S0: 15:10:03> :FK: Value not
found [System\CurrentControlSet\Services\NtFrs\Parameters\SysVol] "SysVol
Information is Committed". WStatus: ERROR_FILE_NOT_FOUND


Toward the bottom of page 4, approximately 155 lines in, I get the
following:



<DbsDBInitialize: 2568: 3690: S1: 15:10:10> FrsOpenTable
(ConfigTable) success
<DbsInitJrnlFilters: 2568: 1731: S0: 15:10:10> ++ DOMAIN SYSTEM
VOLUME (SYSVOL SHARE) - New dir filter:
NtFrs_PreExisting___See_EventLog,DO_NOT_REMOVE_NtFrs_PreInstall_Directory,


A few lines further, info is given on some unknown schedule. Note that they
are all "on".



<DbsOpenReplicaSet: 2568: 2049: S1: 15:10:10> :X: The Jrnl
Cxtion DOMAIN SYSTEM VOLUME (SYSVOL SHARE)\MAINDC\<Jrnl Cxtion> <- <Jrnl
Cxtion> JrnlCxt
<RcsSetCxtionSchedule: 2568: 7356: S0: 15:10:10> :X: 6ba96213,
schedule is on
<RcsSetCxtionSchedule: 2568: 7356: S0: 15:10:10> :X: a43f2541,
schedule is on
<RcsSetCxtionSchedule: 2568: 7356: S0: 15:10:10> :X: d3ffff53,
schedule is on
<RcsSetCxtionSchedule: 2568: 7356: S0: 15:10:10> :X: ebe47081,
schedule is on
<RcsSetCxtionSchedule: 2568: 7356: S0: 15:10:10> :X: 58730d85,
schedule is on
<RcsSetCxtionSchedule: 2568: 7356: S0: 15:10:10> :X: fcad5695,
schedule is on
<RcsSetCxtionSchedule: 2568: 7356: S0: 15:10:10> :X: 1789eab4,
schedule is on
<RcsSetCxtionSchedule: 2568: 7356: S0: 15:10:10> :X: 79a96bbb,
schedule is on
<RcsSetCxtionSchedule: 2568: 7356: S0: 15:10:10> :X: d5d944f5,
schedule is on
<DBService: 2568: 3925: S0: 15:10:10> DataBase has
started.


About 10 more lines down:



<JrnlCommand: 2884: 5397: S0: 15:10:10> Journal has
started.
<ChgOrdAccept: 3064: 1020: S0: 15:10:10> ChangeOrder
Thread is starting.
<ChgOrdAccept: 3064: 1116: S0: 15:10:10> ChangeOrder
Thread has started.
<RcsMain: 2836: 10423: S0: 15:10:10> :S: Replica
subsystem has started.
<RcsHasReplicaRootPathMoved: 2972: 8730: S0: 15:10:10> ERROR - Replica
root guid mismatch for Replica Set (DOMAIN SYSTEM VOLUME (SYSVOL SHARE))
<RcsHasReplicaRootPathMoved: 2972: 8733: S0: 15:10:10> ERROR - Replica
root guid (FS) (37980576-b2f9-4217-95d29caaac9c2aff)
<RcsHasReplicaRootPathMoved: 2972: 8736: S0: 15:10:10> ERROR - Replica
root guid (DB) (b369457b-27a1-4c99-94814295ccc8b2e4)
<RcsHasReplicaRootPathMoved: 2972: 8738: S0: 15:10:10> ERROR - Replica
Set (DOMAIN SYSTEM VOLUME (SYSVOL SHARE)) is marked to be deleted
<FrsPrintEvent: 2972: 606: S0: 15:10:10> :E: Eventlog
written for EVENT_FRS_ROOT_HAS_MOVED (13559) severity: Error at: Tue, Aug
12 2003 15:10:10
<FrsPrintEvent: 2972: 609: S0: 15:10:10> :E: STRINGS:



About 5-10 lines further down:



<RcsStartReplicaSetMember: 2972: 9034: S0: 15:10:11> ERROR Command
file not found at the new root
c:\winnt\sysvol\domain\NTFRS_CMD_FILE_MOVE_ROOT. Can not move root.
<FrsHashCalcString: 2240: 4777: S0: 15:10:24> Name =
S-1-5-21-1258624081-142609888-2068054413-2827


<SERVER_FrsRpcSendCommPkt: 2240: 436: S0: 15:10:24> ++ ERROR -
Invalid Partner: AuthClient:13_MILE\ECORSEDC$,
AuthSid:S-1-5-21-1258624081-142609888-2068054413-2827
<FrsHashCalcString: 2240: 4777: S0: 15:12:16> Name =
S-1-5-21-1258624081-142609888-2068054413-2143




Note 3 lines back up beginning with "AuthClient" is a remote DC. This same
error is repeated a few more times for 3 other DCs.



Questions:

Can anyone help me understand what these errors mean?

Specifically:



<CfgRegReadDWord: 2116: 2394: S0: 15:10:03> :FK: Value not
found [System\CurrentControlSet\Services\NtFrs\Parameters\SysVol] "SysVol
Information is Committed". WStatus: ERROR_FILE_NOT_FOUND




<RcsHasReplicaRootPathMoved: 2972: 8730: S0: 15:10:10> ERROR - Replica
root guid mismatch for Replica Set (DOMAIN SYSTEM VOLUME (SYSVOL SHARE))
<RcsHasReplicaRootPathMoved: 2972: 8733: S0: 15:10:10> ERROR - Replica
root guid (FS) (37980576-b2f9-4217-95d29caaac9c2aff)
<RcsHasReplicaRootPathMoved: 2972: 8736: S0: 15:10:10> ERROR - Replica
root guid (DB) (b369457b-27a1-4c99-94814295ccc8b2e4)
<RcsHasReplicaRootPathMoved: 2972: 8738: S0: 15:10:10> ERROR - Replica
Set (DOMAIN SYSTEM VOLUME (SYSVOL SHARE)) is marked to be deleted
<FrsPrintEvent: 2972: 606: S0: 15:10:10> :E: Eventlog
written for EVENT_FRS_ROOT_HAS_MOVED (13559) severity: Error at: Tue, Aug
12 2003 15:10:10






<SERVER_FrsRpcSendCommPkt: 2240: 436: S0: 15:10:24> ++ ERROR -
Invalid Partner: AuthClient:13_MILE\ECORSEDC$,
AuthSid:S-1-5-21-1258624081-142609888-2068054413-2827
<FrsHashCalcString: 2240: 4777: S0: 15:12:16> Name =
S-1-5-21-1258624081-142609888-2068054413-2143




I know this is a lot to read and digest but I'm really stumped here. I
think this may be the cause of some problmes with setting file/folder
security using some security groups. It may also be affecting a Websense
server controlling Internet access.



TIA,

Rich