none
Understanding the DNS Scavenge Event ID 2501 - What are the 'Visited Nodes?' RRS feed

  • Question

  • Hi All,

    I realized our company didn't have DNS Scavenging turned on, which led to some fun issues when trying to remote to some computers...so I got it setup.

    Thing is, I don't understand how to interpret the Event ID 2501 and I was hoping you do.  

    Gathering the info:

    $myScavenge = get-winevent -ComputerName MYDNSSERVER -FilterHashtable @{logname="dns server"; id=2501} -MaxEvents 1
    $myScavenge | fl *

    Result:

    Message              : The DNS server has completed a scavenging cycle:
                           Visited Zones     = 10,
                           Visited Nodes     = 6623,
                           Scavenged Nodes   = 29,
                           Scavenged Records = 29.

    I think that Nodes pertains to what I'd consider as DNS Zone records, but heck...I'm not sure.  So, if you know what the 'Visited Nodes' are, I'd be in your debt.

    Thank you

    Friday, May 5, 2017 9:13 PM

Answers

  • Hi,

    >how to interpret the Event ID 2501

    Event ID 2501 is an information, they do not signify any health state of the DNS server. So, we do not need to worry about this event;

    >I think that Nodes pertains to what I'd consider as DNS Zone records, but heck...

    When DNS data is stored in Active Directory, each DNS zone is an Active Directory container object (class  dnsZone ). The dnsZone object contains a DNS node object (class dnsNode ) for every unique name within that zone. The dnsNode object has a dnsRecord multivalue attribute that contains a value for every resource record that is associated with an object's name.

    So, the Nodes number is approximately equal to DNS records number. And the "visited nodes" is the number the scavenge progress scanned.

    https://technet.microsoft.com/en-us/library/cc978010.aspx

    Best Regards,

    Anne


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, May 8, 2017 6:32 AM
    Moderator

All replies

  • Event ID 2501- I think, this is a normal condition. No further action is required.

    for a glance,

    DNS Scavenging

    These features are provided as a mechanism for performing cleanup and removal of stale resource records, which can accumulate in zone data over time.


    Technet microsoft solutions.

    • Proposed as answer by premraj subbu Sunday, May 7, 2017 7:09 AM
    Saturday, May 6, 2017 8:15 AM
  • Further if you need to check that your DNS server working properly,

    Start Nslookup by typing Nslookup at the command prompt and then pressing ENTER. Enter the IP address of the computer whose PTR resource record you want to verify, and then press ENTER. If the reverse lookup zone and PTR resource record are configured correctly, Nslookup returns the name of the computer.


    Technet microsoft solutions.

    Saturday, May 6, 2017 8:18 AM
  • Hi,

    >how to interpret the Event ID 2501

    Event ID 2501 is an information, they do not signify any health state of the DNS server. So, we do not need to worry about this event;

    >I think that Nodes pertains to what I'd consider as DNS Zone records, but heck...

    When DNS data is stored in Active Directory, each DNS zone is an Active Directory container object (class  dnsZone ). The dnsZone object contains a DNS node object (class dnsNode ) for every unique name within that zone. The dnsNode object has a dnsRecord multivalue attribute that contains a value for every resource record that is associated with an object's name.

    So, the Nodes number is approximately equal to DNS records number. And the "visited nodes" is the number the scavenge progress scanned.

    https://technet.microsoft.com/en-us/library/cc978010.aspx

    Best Regards,

    Anne


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, May 8, 2017 6:32 AM
    Moderator
  • Hi Anne,

    Thank you very much for the clarification and the reference URL!

    Monday, May 8, 2017 3:36 PM