If you are not using an FRS monitoring tool, the File Replication Service event logs are a key source of monitoring information. The following table summarizes the main File Replication Service event log entries that should be monitored on a regular basis and the actions required to troubleshoot each case.
FRS Event Log Messages
| Event ID | Priority | Summary | Actions Required |
|---|---|---|---|
| 13508 | (depends) | Unable to RPC to a replication partner | Wait for 13509. If no 13509 follows within 4 hours (rule of
thumb) then investigate.
See Troubleshooting FRS Events 13508 without FRS Event 13509. |
| 13509 | (none) | Able to RPC to a replication partner | No action; this event indicates that the 13508 wait is over. |
| 13511 | P1 | FRS database is out of disk space | Make more space available for FRS database. |
| 13512 | (none) | Enabled disk cache detected | Typically no action required. |
| 13522 | Windows 2000 SP2: P1
Windows 2000 SP3: P3 |
Staging area full | On Windows 2000 before SP3, requires administrator
intervention to clear replication backlog.
In Windows Server 2003 and Windows 2000 SP3 and later, automatic processes trim the size of the staging area and treat it like a cache. Administrators should investigate increase as an optimization if this is repeatedly logged. |
| 13526 | P1 | SID cannot be determined from the distinguished name. This can occur when the domain controller is unreachable. | Restart FRS on that system. |
| 13548 | P1 | Systems clocks are too far apart | Correct clocks on one or more replica members.
See Clock Skew. |
| 13557 | P1 | Duplicate connections configured | Delete the unnecessary connection object. |
| 13567 | P2 | Excessive replication detected and suppressed | Investigate what is causing excessive replication work; in the
meantime, the FRS server uses CPU and disk resources to damp the
replication traffic by comparing files to previously sent copies.
See Excessive Replication and High CPU and Disk Usage by Ntfrs.exe. |
| 13568 | Windows 2000 SP2: P2
Windows 2000 SP3: P1 |
Journal wrap | Depends on FRS version.
See USN Journal Wrap. |
| 13573 | P1 | Sharing violation | A file is held open on a server, preventing the file from
replicating.
See Sharing Violations. |