FRS Event 13567 Is Recorded in the File Replication Service Event Log After You Install Service Pack 3 (315045)


The information in this article applies to:

  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Advanced Server
This article was previously published under Q315045
IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry

SYMPTOMS

After you install Windows 2000 Service Pack 3 (SP3), the following event may be recorded in the File Replication Service (FRS) event log:
Event Type: Warning
Event Source: NtFrs
Event Category: None
Event ID: 13567
Date: 12/12/2001
Time: 2:03:32 PM
User: N/A
Computer: NA-DC-01
Description:
File Replication Service has detected and suppressed an average of %1 or more file updates every hour for the last %2 hours because the updates did not change the contents of the file. The tracking records in FRS debug logs will have a filename and event time for the suppressed updates. The tracking records have the date and time followed by :T: as their prefix.

Updates that do not change the content of the file are suppressed to prevent unnecessary replication traffic. Following are common examples of updates that do not change the contents of the file.

[1] Overwriting a file with a copy of the same file.
[2] Setting the same ACLs on a file multiple times.
[3] Restoring an identical copy of the file over an existing one.

Suppression of updates can be disabled by running regedit.

Click on Start, Run and type regedit.

Expand HKEY_LOCAL_MACHINE, SYSTEM, CurrentControlSet, Services, NtFrs, Parameters, and create or update the value "Suppress Identical Updates to Files" to 0 (Default is 1) to force identical updates to replicate.

CAUSE

FRS was updated in SP3 to detect and suppress duplicate updates. This conserves network bandwidth. Event 13567 is logged to inform the administrator that this suppression has occurred.

More specifically, this event is logged when FRS detects that 15 identical updates were made to FRS replicated files within a one-hour period and this condition has occurred over 3 consecutive hours. The duplicate changes might have occurred on a single file 15 times, or 15 unique files one time each, or any combination between those two. Identical updates are changes to existing files where the MD5 checksum for the last change is identical to the previous change to that same file. Duplicate changes are common when administrators or programs make repetitive changes to FRS replicated files, which may result in excessive replication or backlogs that delay data consistency between replication partners. The above thresholds apply only to event logging. FRS suppression works continuously. FRS suppression does not apply to folders. Therefore, frequent changes to folders may affect FRS replication and staging even when suppression is turned on. Common causes of duplicate changes in FRS replicated folders include:
  • Antivirus programs. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

    284947 Antivirus Programs May Modify Security Descriptors and Cause Excessive Replication of FRS Data in Sysvol and DFS

  • Disk optimization tools.For additional information, click the article number below to view the article in the Microsoft Knowledge Base:

    282791 FRS: Disk Defragmentation Causes Excessive FRS Replication Traffic

  • File system policy or the importing of security templates in Group Policy that apply security permissions.For additional information, click the article number below to view the article in the Microsoft Knowledge Base:

    279156 The Effects of Setting the File System Policy on a Disk Drive or Folder Replicated by the File Replication Service

  • Administrators redefining security permissions in FRS replicated trees using Windows Explorer or an equivalent program.
  • Inefficient programs that aggressively update user rights assignments or other elements of Group Policy during installation, startup or at regularly scheduled intervals.

RESOLUTION

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

You can prevent the suppression by modifying the registry. To prevent suppressing duplicate updates:
  1. Start Registry Editor (Regedt32.exe).
  2. Locate and click the following key in the registry:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters

  3. On the Edit menu, click Add Value, and then add the following registry value:

    Value name: Suppress Identical Updates to Files
    Data type: REG_DWORD
    Radix: Hexadecimal
    Value data: 0

    Note that there are two valid data values for the Suppress Identical Updates to Files registry value:

    • 1 = Suppression activated (this is the default). Files that have not changed in content or security attributes will not be replicated.
    • 0 = Suppression deactivated. Files are replicated if they are updated, whether or not there is an actual change to the file.
  4. Quit Registry Editor.

MORE INFORMATION

For additional information about SP3 updates to FRS, click the following article number to view the article in the Microsoft Knowledge Base:

307319 Changes to the File Replication Service

Modification Type:MajorLast Reviewed:11/21/2003
Keywords:kbprb KB315045
©2003 Microsoft Corporation. All rights reserved.