If you are not using an FRS monitoring tool, the File Replication Service event logs are a key source of monitoring information. The following table summarizes the main File Replication Service event log entries that should be monitored on a regular basis and the actions required to troubleshoot each case.
FRS Event Log Messages
|Event ID||Priority||Summary||Actions Required|
|13508||(depends)||Unable to RPC to a replication partner||Wait for 13509. If no 13509 follows within 4 hours (rule of thumb) then investigate.|
|13509||(none)||Able to RPC to a replication partner||No action; this event indicates that the 13508 wait is over.|
|13511||P1||FRS database is out of disk space||Make more space available for FRS database.|
|13512||(none)||Enabled disk cache detected||Typically no action required.|
|13522||Windows 2000 SP2: P1
Windows 2000 SP3: P3
|Staging area full||On Windows 2000 before SP3, requires administrator
intervention to clear replication backlog.
In Windows Server 2003 and Windows 2000 SP3 and later, automatic processes trim the size of the staging area and treat it like a cache. Administrators should investigate increase as an optimization if this is repeatedly logged.
|13526||P1||SID cannot be determined from the distinguished name. This can occur when the domain controller is unreachable.||Restart FRS on that system.|
|13548||P1||Systems clocks are too far apart||Correct clocks on one or more replica members.
See Clock Skew.
|13557||P1||Duplicate connections configured||Delete the unnecessary connection object.|
|13567||P2||Excessive replication detected and suppressed||Investigate what is causing excessive replication work; in the meantime, the FRS server uses CPU and disk resources to damp the replication traffic by comparing files to previously sent copies.|
|13568||Windows 2000 SP2: P2
Windows 2000 SP3: P1
|Journal wrap||Depends on FRS version.
See USN Journal Wrap.
|13573||P1||Sharing violation||A file is held open on a server, preventing the file from
See Sharing Violations.