Excessive Replication and High CPU and Disk Usage by
Ntfrs.exe
FRS event ID 13567 occurs when FRS
detects and suppresses excessive replication. Excessive replication
is typically caused by applications that change all or most of the
files in a replica tree on a regular basis without actually
altering the file content — in other words, these applications
perform writes that do not change the file. Because FRS monitors
the USN journal for changes, if FRS finds a change, then it
replicates the file. Excessive replication can cause FRS to use
excessive amounts of disk I/O or CPU as it tracks this activity.
Common cases of applications that cause extensive replication are
those that rewrite the existing ACL (file security policy,
antivirus software) or rewrite the existing file (defragmentation
programs).
The effect of excessive replication depends on the version of
FRS being used:
From Windows 2000 Service Pack 3 and later and Windows
Server 2003, FRS event ID 13567 records that this kind of
non-change was suppressed to prevent unnecessary replication.
However, the underlying cause should still be investigated, because
it is causing unnecessarily high disk and CPU usage on that replica
member.
For Windows 2000 versions prior to SP3, excessive
replication generators were the most common cause of replication
backlogs and for staging directories to fill up. On these versions
of FRS, administrators should investigate this problem
urgently.
High CPU usage without event ID 13567 can be caused in the
following situations:
The number of connections is not balanced between hub
servers.
There are more than 50 incoming connections to the server.
The KCC chose a server that was not intended to be a hub
server.
Other applications, such as Exchange or SQL Server, are running
on the server.
The staging directory is too small, which causes staging files
to be regenerated and increases CPU and disk usage.
Resolution
Identify the cause of excessive replication and high CPU and
disk usage by doing the following:
If the connections aren’t balanced or the server has too many
simultaneous incoming connections, adjust the schedule by using the
guidelines in Optimizing FRS
Replication Schedules.
If high CPU usage is caused by other applications, upgrade the
hardware or move the application to another server.
If FRS event ID 13567 is present in the File Replication
Service event log, do the following:
Selectively turn off common causes of excessive replication,
such as antivirus products, backup programs, and defragmentation
tools, to determine if excessive replication declines.
Determine whether your organization has set file system policy
on replicated data.
Use the FileSpy tool from the Windows 2000 Resource Kit to
identify file information.
Run FRSDiag.exe and inspect the Ntfrs_outlog.txt file to see
which files are being replicated. See "IOLogSum Remarks" for more
information on interpreting this file.
For additional information, see the following articles:
815263, "Antivirus, Backup, and Disk Optimization Programs That
Are Compatible with the File Replication Service" at http://support.microsoft.com/?id=815263.
284947, "Antivirus Programs May Modify Security Descriptors and
Cause Excessive Replication of FRS Data in Sysvol and DFS" at
http://support.microsoft.com/?id=284947.
279156, "The Effects of Setting the File System Policy on a
Disk Drive or Folder Replicated by the File Replication Service" at
http://support.microsoft.com/?id=279156.