Event ID 13561 is logged on Windows Server 2003-based DFS replica members and domain controllers (912026)


The information in this article applies to:

  • Microsoft Windows Server 2003, Web Edition
  • Microsoft Windows Server 2003, Standard Edition
  • Microsoft Windows Server 2003, Enterprise Edition
  • Microsoft Windows Server 2003, Datacenter Edition
  • Microsoft Windows Server 2003, 64-Bit Enterprise Edition
  • Microsoft Windows Server 2003, 64-Bit Datacenter Edition

SYMPTOMS

On Microsoft Windows Server 2003-based Distributed File System (DFS) replica members and domain controllers that are hosting a SYSVOL replica set, the File Replication service (FRS) may experience a journal wrap error. Additionally, the following error may be logged in the System event log:
Event ID: 13561
Event Type: Error
Rule: Alert suppressed based on ID, source, computer - state to look for event ID 13560 to indicate that the error is auto recover
Message Text:
The File Replication Service has detected that the replica set "%1" is in JRNL_WRAP_ERROR. Replica set name is : "%1" Replica root path is : "%2" Replica root volume is : "%3" A Replica set hits JRNL_WRAP_ERROR when the record that it is trying to read from the NTFS USN journal is not found. This can occur because of one of the following reasons.

[1] Volume "%3" has been formatted.

[2] The NTFS USN journal on volume "%3" has been deleted.

[3] The NTFS USN journal on volume "%3" has been truncated. Chkdsk can truncate the journal if it finds corrupt entries at the end of the journal.

[4] File Replication Service was not running on this computer for a long time.

[5] File Replication Service could not keep up with the rate of Disk IO activity on "%3".

Following recovery steps will be taken to automatically recover from this error state.

[1] At the first poll which will occur in %4 minutes this computer will be deleted from the replica set.

[2] At the poll following the deletion this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set.

CAUSE

This issue occurs if the following conditions are true:
  • You are running the Legato NetWorker program to back up volumes.
  • The Legato NetWorker program uses the Update Sequence Number (USN) journal to log all changes that are made to the files in these volumes.

RESOLUTION

To resolve this issue, do not configure the Legato NetWorker program to use the USN journal to log changes. You must perform a non-authoritative restore operation on the DFS replica members and domain controllers that are experiencing this issue. For more information about USN journal wraps and non-authoritative restore operations, click the following article number to view the article in the Microsoft Knowledge Base:

292438 Troubleshooting journal_wrap errors on Sysvol and DFS replica sets

MORE INFORMATION

For more information about FRS, click the following article number to view the article in the Microsoft Knowledge Base:

840675 Configuration and operational recommendations for the File Replication service in Windows Server 2003 and Windows 2000 Server


The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.
Modification Type:MajorLast Reviewed:1/17/2006
Keywords:kbFilePrintservices kbwinservnetwork kbtshoot kbprb KB912026 kbAudITPRO
©2004 Microsoft Corporation. All rights reserved.