Link to home
Create AccountLog in
Avatar of nmmcfk
nmmcfkFlag for United States of America

asked on

FRS Event ID 13568

Hi all,

I recently promoted a 2008 server in my 2003 AD to act as a redundant DC. Everything went fine during the promotion and all but I have a problem with my file replication. On my original 2003 server DC, I get the event ID 13568:

Event Type:      Error
Event Source:      NtFrs
Event Category:      None
Event ID:      13568
Date:            2/23/2010
Time:            6:31:07 AM
User:            N/A
Computer:      NMMC-DC
Description:
The File Replication Service has detected that the replica set "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" is in JRNL_WRAP_ERROR.
 
 Replica set name is    : "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"
 Replica root path is   : "c:\windows\sysvol\domain"
 Replica root volume is : "\\.\C:"
 A Replica set hits JRNL_WRAP_ERROR when the record that it is trying to read from the NTFS USN journal is not found.  This can occur because of one of the following reasons.
 
 [1] Volume "\\.\C:" has been formatted.
 [2] The NTFS USN journal on volume "\\.\C:" has been deleted.
 [3] The NTFS USN journal on volume "\\.\C:" has been truncated. Chkdsk can truncate the journal if it finds corrupt entries at the end of the journal.
 [4] File Replication Service was not running on this computer for a long time.
 [5] File Replication Service could not keep up with the rate of Disk IO activity on "\\.\C:".
 Setting the "Enable Journal Wrap Automatic Restore" registry parameter to 1 will cause the following recovery steps to be taken to automatically recover from this error state.
 [1] At the first poll, which will occur in 5 minutes, this computer will be deleted from the replica set. If you do not want to wait 5 minutes, then run "net stop ntfrs" followed by "net start ntfrs" to restart the File Replication Service.
 [2] At the poll following the deletion this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set.
 
WARNING: During the recovery process data in the replica tree may be unavailable. You should reset the registry parameter described above to 0 to prevent automatic recovery from making the data unexpectedly unavailable if this error condition occurs again.
 
To change this registry parameter, run regedit.
 
Click on Start, Run and type regedit.
 
Expand HKEY_LOCAL_MACHINE.
Click down the key path:
   "System\CurrentControlSet\Services\NtFrs\Parameters"
Double click on the value name
   "Enable Journal Wrap Automatic Restore"
and update the value.
 
If the value name is not present you may add it with the New->DWORD Value function under the Edit Menu item. Type the value name exactly as shown above.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.




And my 2008 server obviously I get Event ID's that the RFS does not replicate. Event ID 13508:


Log Name:      File Replication Service
Source:        NtFrs
Date:          2/23/2010 6:33:20 AM
Event ID:      13508
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      FILE-BK.NMMC-NET.local
Description:
The File Replication Service is having trouble enabling replication from nmmc-dc.NMMC-NET.local to FILE-BK for c:\windows\sysvol\domain using the DNS name nmmc-dc.NMMC-NET.local. FRS will keep retrying.
 Following are some of the reasons you would see this warning.
 
 [1] FRS can not correctly resolve the DNS name nmmc-dc.NMMC-NET.local from this computer.
 [2] FRS is not running on nmmc-dc.NMMC-NET.local.
 [3] The topology information in the Active Directory Domain Services for this replica has not yet replicated to all the Domain Controllers.
 
 This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="NtFrs" />
    <EventID Qualifiers="32768">13508</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2010-02-23T11:33:20.000Z" />
    <EventRecordID>98</EventRecordID>
    <Channel>File Replication Service</Channel>
    <Computer>FILE-BK.NMMC-NET.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>nmmc-dc.NMMC-NET.local</Data>
    <Data>FILE-BK</Data>
    <Data>c:\windows\sysvol\domain</Data>
    <Data>nmmc-dc.NMMC-NET.local</Data>
    <Binary>D5040000</Binary>
  </EventData>
</Event>



Thanks in advance
Avatar of NJComputerNetworks
NJComputerNetworks
Flag of United States of America image

You might have a DNS problem.

1) check to make sure that all servers and clients are using Internal DNS servers (not ISP or Internet DNS servers) listed in thier TCP/IP properties -- DNS tab

2) Use NSLOOKUP command line tool to verify that network resolution is working on the client machines.  In your case, use this tool on the DC's to make sure DNS resolution is working.'

Also, you might want to check you 2008 DC and verify that the FRS service is started.  (services.msc)
Avatar of nmmcfk

ASKER

NSLOOKUP works on both DC .... FRS is also started on te 2008 server. THE DNS entries are all set the these server also. I am not quite updating all the cleints but I dont see why this would cause the FRS to not work ??
how many DNS servers do you have?  Can you describe your DNS and DC setup a little more?  How many sites?
Avatar of nmmcfk

ASKER

I have only 1 site with 2 DNS servers 2 DC .... 1 is the original 2003 server and the other one is the 2008 server I want to setup as a redundant server.
Point all DNS (TCP/IP properties) on both server to the original  2003 server.  (for now, don't put in an alternate... just the origanal server).

Reboot both servers... starting with the 2003 original server... after it completes the boot... reboot the windows 2008 servers.

Check again for errors.
Avatar of nmmcfk

ASKER

OK I will have to wait tomorrow morning to reboot them .......
Avatar of nmmcfk

ASKER

Tried that and still generating the same errors ......
you change the BurFlags value on regedit ?
Avatar of nmmcfk

ASKER

No ...... I red that it could cause a lot of problems .....
Avatar of nmmcfk

ASKER

I am confused with D2 and D4 .......
Avatar of nmmcfk

ASKER

As I am reading this ....It is almost like I need another DC to replicate from but the errors are my main DC that is in production right now ....
Ok, try this

In your dc go to regedit

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\NtFrs\Parameters\Backup/Restore\Process at Startup:

and change the BurFlags value to D4 hex
Avatar of nmmcfk

ASKER

Is it going to wipe out my sysvol and bring down my DC ???
Avatar of nmmcfk

ASKER

I think i will wait tomorrow morning to do it ... that way It will give me more time to fix any issues ....
Avatar of nmmcfk

ASKER

See this documents says to use D2 and you said to use D4 .....
my mistake

first try use the d2, if don't work use d4

D2:
Nonauthoritative restores are the most common way to reinitialize individual members of FRS replica sets that are having difficulty. These difficulties may include:
Assertions in the FRS service
Corruption of the local jet database
Journal wrap errors
FRS replication failures

D4:
Use authoritative restores only as a final option, such as in the case of directory collisions.

For example, you may require an authoritative restore if you must recover an FRS replica set where replication has completely stopped and requires a rebuild from scratch.
Avatar of nmmcfk

ASKER

I did that and now my outlook client can't connect .... it prompts for a password ??
Avatar of nmmcfk

ASKER

Looks like my exchange server stop reponding with my DC ...... not good at all .....
you restart the FRS service ?
Avatar of nmmcfk

ASKER

Yes I did and now the exchange server services stop reponding on my excnahge server .....
Avatar of nmmcfk

ASKER

The replication still does not work also .....
Avatar of nmmcfk

ASKER

I get this error in the Event viewer ........

Event Type:      Warning
Event Source:      NtFrs
Event Category:      None
Event ID:      13508
Date:            2/25/2010
Time:            7:49:48 AM
User:            N/A
Computer:      NMMC-DC
Description:
The File Replication Service is having trouble enabling replication from FILE-BK to NMMC-DC for c:\windows\sysvol\domain using the DNS name FILE-BK.NMMC-NET.local. FRS will keep retrying.
 Following are some of the reasons you would see this warning.
 
 [1] FRS can not correctly resolve the DNS name FILE-BK.NMMC-NET.local from this computer.
 [2] FRS is not running on FILE-BK.NMMC-NET.local.
 [3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers.
 
 This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00               ....    
Avatar of nmmcfk

ASKER

what does that D2 and D4 does anyway ......
ASKER CERTIFIED SOLUTION
Avatar of abolinhas
abolinhas
Flag of Portugal image

Link to home
membership
Create an account to see this answer
Signing up is free. No credit card required.
Create Account
Avatar of nmmcfk

ASKER

Why did my exchange services wont start ... it is almost like the domain doesnt exist for them ......
on your exchange server go to event view and search for errors
Avatar of nmmcfk

ASKER

Now I am rebooting the DC and it is stuck on Preparing Network Connections for the last 15 minutes ....
Avatar of nmmcfk

ASKER

My DC wont boot up ..... not good at all ....
Avatar of nmmcfk

ASKER

It is almost like the domain does not exist anymore .......
your server has started ?
Avatar of nmmcfk

ASKER

It is up but i cant see the AD ......
Avatar of nmmcfk

ASKER

nobody csnt authenticate to the DC / AD ......
Avatar of nmmcfk

ASKER

This look like somthing si milar to what we have here .... do you think we should try this ???


OK, so here is the summary of what went wrong, why it went wrong, and how MS fixed it for me:

When I added the new DC, the existing DC was already in a "Journal Wrap" state. This is what stopped it replicating to the new DC.

The fix for Journal Wrap described in the event viewer is to copy all the sysvol files, and then perform an "non-authoritative restore" - basically replicating from another DC.

Unfortunately, because my DC was the only DC with a sysvol, it couldn't do this, so it just crapped out.

The fix from Microsoft Support was to copy the two folders (policies/scripts) back from  C:\windows\sysvol\sysvol\TIS.local\NtFrs_PreExisting___See_EventLog to the C:\windows\sysvol\sysvol\TIS.local\ folder, then stop the NTFRS service, then set the BurFlags key to D4, which does an Authoritative restore.

Bingo, my sysvol and netlogon are back, the Journal Wrap error is gone and we have replication over to the new DC - too easy.

He pointed me at this for future refernece:

http://support.microsoft.com/kb/290762

In some ways I feel bad for panicking and not working it out myself, but in other ways I don't.

When you do the Journal Wrap Fix/Non-Authoritative restore, there is nothing to tell you clearly that is has all failed.

All the articles on the D4 Authoritative Restore are quite scary, and I was worried I was just going to make things worse.

I am just glad MS had my back!

A
Avatar of nmmcfk

ASKER

I fixed it with the last articles ......
now what is the point of situation ?
Avatar of nmmcfk

ASKER

Now it looks like the solution the article above suggested..... restoring theses 2 files and do a D4 fixed everything ... even the replication between the 2 DC's ....

Thank you very much for your help and also thanks to Arrowtech .....
Avatar of nmmcfk

ASKER

It is resolved