Event id: 13568

while restarting ntfrs service getting event id : 13568 , below event details.

 

event type: error

event source: ntfrs

event category: none

event id: 13568

date: 1/18/2012

time: 6:41:28 pm

user: n/a

computer: mdc

description:

the file replication service has detected replica set "domain system volume (sysvol share)" in jrnl_wrap_error. 

 

 replica set name    : "domain system volume (sysvol share)" 

 replica root path   : "c:\windows\sysvol\domain" 

 replica root volume : "\\.\c:" 

 a replica set hits jrnl_wrap_error when record trying read ntfs usn journal not found.  this can occur because of 1 of following reasons. 

 

 [1] volume "\\.\c:" has been formatted. 

 [2] ntfs usn journal on volume "\\.\c:" has been deleted. 

 [3] ntfs usn journal on volume "\\.\c:" has been truncated. chkdsk can truncate journal if finds corrupt entries @ end of journal. 

 [4] file replication service not running on computer long time. 

 [5] file replication service not keep rate of disk io activity on "\\.\c:". 

 setting "enable journal wrap automatic restore" registry parameter 1 cause following recovery steps taken automatically recover error state. 

 [1] @ first poll, occur in 5 minutes, computer deleted replica set. if not want wait 5 minutes, run "net stop ntfrs" followed "net start ntfrs" restart file replication service. 

 [2] @ poll following deletion computer re-added replica set. re-addition trigger full tree sync replica set. 

 

warning: during recovery process data in replica tree may unavailable. should reset registry parameter described above 0 prevent automatic recovery making data unexpectedly unavailable if error condition occurs again. 

 

to change registry parameter, run regedit. 

 

click on start, run , type regedit. 

 

expand hkey_local_machine. 

click down key path: 

   "system\currentcontrolset\services\ntfrs\parameters" 

double click on value name 

   "enable journal wrap automatic restore" 

and update value. 

 

if value name not present may add new->dword value function under edit menu item. type value name shown above.

 

for more information, see , support center @ http://go.microsoft.com/fwlink/events.asp.

hi,

according event id:13568, indicates there domain controller in journal wrap state.

to troubleshoot cause of journal wrap, see following article in microsoft knowledge base:

troubleshooting journal_wrap errors on sysvol , dfs replica sets

http://support.microsoft.com/?id=292438

after determine cause of journal wrap or after have taken steps prevent future journal wraps, @ convenient time, make following changes registry:

1.	stop frs.
2.	start registry editor (regedt32.exe).
3.	locate , click following key in registry: hkey_local_machine\system\currentcontrolset\services\ ntfrs\parameters\backup\restore\process @ startup
4.	on edit menu, click add value , , add following registry value: value name: burflags data type: reg_dword radix: hexadecimal value data: d2
5.	quit registry editor.
6.	restart frs.

 

best regards,

yan li

technet subscriber support

if are technet subscription user , have feedback on our support quality, please send feedback here.

 

---

yan li

technet community support

Windows Server  >  Directory Services