Troubleshooting FRS Using Event Logs

If you are not using an FRS monitoring tool, the File Replication Service event logs are a key source of monitoring information. The following table summarizes the main File Replication Service event log entries that should be monitored on a regular basis and the actions required to troubleshoot each case.

FRS Event Log Messages   

Event ID Priority Summary Actions Required
13508 (depends) Unable to RPC to a replication partner Wait for 13509. If no 13509 follows within 4 hours (rule of thumb) then investigate.

See Troubleshooting FRS Events 13508 without FRS Event 13509.

13509 (none) Able to RPC to a replication partner No action; this event indicates that the 13508 wait is over.
13511 P1 FRS database is out of disk space Make more space available for FRS database.

See Not Enough Disk Space for the FRS Database.

13512 (none) Enabled disk cache detected Typically no action required.
13522 Windows 2000 SP2: P1

Windows 2000 SP3: P3

Staging area full On Windows 2000 before SP3, requires administrator intervention to clear replication backlog.

In Windows Server 2003 and Windows 2000 SP3 and later, automatic processes trim the size of the staging area and treat it like a cache. Administrators should investigate increase as an optimization if this is repeatedly logged.

See Staging Directory is Full.

13526 P1 SID cannot be determined from the distinguished name. This can occur when the domain controller is unreachable. Restart FRS on that system.

See Domain Controller is Unreachable.

13548 P1 Systems clocks are too far apart Correct clocks on one or more replica members.

See Clock Skew.

13557 P1 Duplicate connections configured Delete the unnecessary connection object.
13567 P2 Excessive replication detected and suppressed Investigate what is causing excessive replication work; in the meantime, the FRS server uses CPU and disk resources to damp the replication traffic by comparing files to previously sent copies.

See Excessive Replication and High CPU and Disk Usage by Ntfrs.exe.

13568 Windows 2000 SP2: P2

Windows 2000 SP3: P1

Journal wrap Depends on FRS version.

See USN Journal Wrap.

13573 P1 Sharing violation A file is held open on a server, preventing the file from replicating.

See Sharing Violations.