Excessive Replication and High CPU and Disk Usage by Ntfrs.exe

FRS event ID 13567 occurs when FRS detects and suppresses excessive replication. Excessive replication is typically caused by applications that change all or most of the files in a replica tree on a regular basis without actually altering the file content — in other words, these applications perform writes that do not change the file. Because FRS monitors the USN journal for changes, if FRS finds a change, then it replicates the file. Excessive replication can cause FRS to use excessive amounts of disk I/O or CPU as it tracks this activity. Common cases of applications that cause extensive replication are those that rewrite the existing ACL (file security policy, antivirus software) or rewrite the existing file (defragmentation programs).

The effect of excessive replication depends on the version of FRS being used:

High CPU usage without event ID 13567 can be caused in the following situations:


Identify the cause of excessive replication and high CPU and disk usage by doing the following:

For additional information, see the following articles: