none
Event id: 13568 RRS feed

  • Question

  • While restarting ntfrs service getting event id : 13568 and below event details.

     

    Event Type: Error

    Event Source: NtFrs

    Event Category: None

    Event ID: 13568

    Date: 1/18/2012

    Time: 6:41:28 PM

    User: N/A

    Computer: MDC

    Description:

    The File Replication Service has detected that the replica set "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" is in JRNL_WRAP_ERROR. 

     

     Replica set name is    : "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" 

     Replica root path is   : "c:\windows\sysvol\domain" 

     Replica root volume is : "\\.\C:" 

     A Replica set hits JRNL_WRAP_ERROR when the record that it is trying to read from the NTFS USN journal is not found.  This can occur because of one of the following reasons. 

     

     [1] Volume "\\.\C:" has been formatted. 

     [2] The NTFS USN journal on volume "\\.\C:" has been deleted. 

     [3] The NTFS USN journal on volume "\\.\C:" has been truncated. Chkdsk can truncate the journal if it finds corrupt entries at the end of the journal. 

     [4] File Replication Service was not running on this computer for a long time. 

     [5] File Replication Service could not keep up with the rate of Disk IO activity on "\\.\C:". 

     Setting the "Enable Journal Wrap Automatic Restore" registry parameter to 1 will cause the following recovery steps to be taken to automatically recover from this error state. 

     [1] At the first poll, which will occur in 5 minutes, this computer will be deleted from the replica set. If you do not want to wait 5 minutes, then run "net stop ntfrs" followed by "net start ntfrs" to restart the File Replication Service. 

     [2] At the poll following the deletion this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set. 

     

    WARNING: During the recovery process data in the replica tree may be unavailable. You should reset the registry parameter described above to 0 to prevent automatic recovery from making the data unexpectedly unavailable if this error condition occurs again. 

     

    To change this registry parameter, run regedit. 

     

    Click on Start, Run and type regedit. 

     

    Expand HKEY_LOCAL_MACHINE. 

    Click down the key path: 

       "System\CurrentControlSet\Services\NtFrs\Parameters" 

    Double click on the value name 

       "Enable Journal Wrap Automatic Restore" 

    and update the value. 

     

    If the value name is not present you may add it with the New->DWORD Value function under the Edit Menu item. Type the value name exactly as shown above.

     

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

    Wednesday, January 18, 2012 1:12 PM

Answers

  • Hi,

    According to the event ID:13568, it indicates that there is a domain controller is in a journal wrap state.

    To troubleshoot the cause of a journal wrap, see the following article in the Microsoft Knowledge Base:

    Troubleshooting Journal_Wrap Errors on Sysvol and DFS Replica Sets

    http://support.microsoft.com/?id=292438

    After you determine the cause of a journal wrap or after you have taken steps to prevent future journal wraps, at a convenient time, make the following changes to the registry:

    1.

    Stop FRS.

    2.

    Start Registry Editor (Regedt32.exe).

    3.

    Locate and click the following key in the registry:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\

    NtFrs\Parameters\Backup\Restore\Process at Startup

    4.

    On the Edit menu, click Add Value , and then add the following registry value:

    Value name: BurFlags
    Data type: REG_DWORD
    Radix: Hexadecimal
    Value data: D2

    5.

    Quit Registry Editor.

    6.

    Restart FRS.

     

    Best Regards,

    Yan Li

    TechNet Subscriber Support

    If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.

     


    Yan Li

    TechNet Community Support




    Thursday, January 19, 2012 6:14 AM
    Moderator
  • The error message you have posted indicates that FRS is in Jornal Wrap error state.In the event itself the the recovery procedure is given.

    Your first step should be finding why JRNL_WRAP_ERROR error has occurred. Normally, JRNL_WRAP_ERROR occurs due to drive/partition being corrupted, antivirus locking and corrupting the file during sysvol scan, heavy size of the files inside sysvol and netlogon shares.

    The solution is listed in your event log.

    Click on Start, Run and type regedit.
     
    Expand HKEY_LOCAL_MACHINE.
    Click down the key path:
       "System\CurrentControlSet\Services\NtFrs\Parameters"
    Double click on the value name
       "Enable Journal Wrap Automatic Restore"
    and update the value.

    If the value name(Enable Journal Wrap Automatic Restore) is not present you may add it with the New->DWORD Value and set the value to 1 and restart FRS service.
    Once the recovery is completed make sure that the Enable Journal Wrap Automatic Restore is set to 0 or delete the key.

    If the JRNL_WRAP_ERROR occurs frequently, you need to exclude sysvol/netlogon from antvirus scan, check the drive for corruption or bad sector and also restore a sysvol using burflag key.

    http://msdn.microsoft.com/en-us/library/windows/desktop/cc507518%28v=vs.85%29.aspx

    You can also fix the same by performing authorative and non authorative of sysvol folder as other mentioned.
    http://support.microsoft.com/kb/290762

    1) Normally for an Authoritative Restore you stop at NTFRS services on all DCs.
    2) Set burflags to D4 on a known good sysvol (or at this time restore sysvol data from backup then set burflags to D4) then start NTFRS on this server.  You may want to rename the old folders with .old extensions prior to restoring good data.
    3) Clean up the folders on all the remaining servers (Policies, Scripts, etc) - renamed them with .old extensions.
    4) Set burflags to D2 on all remaining servers and start NTFRS.
    5) Wait for FRS to replicate.
    6) Clean up the .old stuff if things look good.

    This is probably what you need to do to get it back.

    Note:Kindly take the backup of sysvol folder(Policies & Script) before you proceed.

    Hope this helps

    Regards,
    Sandesh Dubey.
    -------------------------------
    MCSE|MCSA:Messaging|MCTS|MCITP:Enterprise Adminitrator
    My Blog: http://sandeshdubey.wordpress.com
    This posting is provided AS IS with no warranties, and confers no rights.

    <input id="374cdf54-c063-441c-a1f8-c2b8861ccf84_attachments" type="hidden" />
    Thursday, January 19, 2012 6:54 AM

All replies

  • If you have multiple DC's, I would consider rebuilding sysvol on this DC.  Journal Wrap errors can be a real painful issue and doing a non-authoritative restore should help clear this up.  Just make sure you run a back up first and remember do the Non-Authoritatve restore (NOT Authoritative).
    http://support.microsoft.com/kb/315457

    --
    Paul Bergson
    MVP - Directory Services
    MCITP: Enterprise Administrator
    MCTS, MCT, MCSE, MCSA, Security+, BS CSci
    2008, Vista, 2003, 2000 (Early Achiever), NT4
    http://www.pbbergs.com    Twitter @pbbergs
    http://blogs.dirteam.com/blogs/paulbergson

    Please no e-mails, any questions should be posted in the NewsGroup. This posting is provided "AS IS" with no warranties, and confers no rights.

    • Proposed as answer by Meinolf Weber Wednesday, January 18, 2012 1:17 PM
    Wednesday, January 18, 2012 1:15 PM
    Moderator
  • Hello,

    agree with Paul here, remove the broken machine and run metadata cleanup, then rebuilt the server:

    http://msmvps.com/blogs/mweber/archive/2010/05/16/active-directory-metadata-cleanup.aspx


    Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
    Wednesday, January 18, 2012 1:19 PM
  • If its occurring frequently, you need to troubleshoot why its happening, because there can be network issues, antivirus locking the file during scanning, large size of the file etc. This has been corrected in windows 2008 with DFSR.

    You can perform non-authoritative restore of the sysvol followed by reinitializing the FRS service.

    http://support.microsoft.com/kb/840674

    http://support.microsoft.com/kb/290762

    To know more about Journal Wrap error occurs, see below article.

    http://blogs.technet.com/b/instan/archive/2009/07/14/what-happens-in-a-journal-wrap.aspx

     

    Regards  


    Awinish Vishwakarma

    MY BLOG:  awinish.wordpress.com


    This posting is provided AS-IS with no warranties/guarantees and confers no rights.
    Wednesday, January 18, 2012 1:53 PM
    Moderator
  • Hi,

    According to the event ID:13568, it indicates that there is a domain controller is in a journal wrap state.

    To troubleshoot the cause of a journal wrap, see the following article in the Microsoft Knowledge Base:

    Troubleshooting Journal_Wrap Errors on Sysvol and DFS Replica Sets

    http://support.microsoft.com/?id=292438

    After you determine the cause of a journal wrap or after you have taken steps to prevent future journal wraps, at a convenient time, make the following changes to the registry:

    1.

    Stop FRS.

    2.

    Start Registry Editor (Regedt32.exe).

    3.

    Locate and click the following key in the registry:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\

    NtFrs\Parameters\Backup\Restore\Process at Startup

    4.

    On the Edit menu, click Add Value , and then add the following registry value:

    Value name: BurFlags
    Data type: REG_DWORD
    Radix: Hexadecimal
    Value data: D2

    5.

    Quit Registry Editor.

    6.

    Restart FRS.

     

    Best Regards,

    Yan Li

    TechNet Subscriber Support

    If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.

     


    Yan Li

    TechNet Community Support




    Thursday, January 19, 2012 6:14 AM
    Moderator
  • The error message you have posted indicates that FRS is in Jornal Wrap error state.In the event itself the the recovery procedure is given.

    Your first step should be finding why JRNL_WRAP_ERROR error has occurred. Normally, JRNL_WRAP_ERROR occurs due to drive/partition being corrupted, antivirus locking and corrupting the file during sysvol scan, heavy size of the files inside sysvol and netlogon shares.

    The solution is listed in your event log.

    Click on Start, Run and type regedit.
     
    Expand HKEY_LOCAL_MACHINE.
    Click down the key path:
       "System\CurrentControlSet\Services\NtFrs\Parameters"
    Double click on the value name
       "Enable Journal Wrap Automatic Restore"
    and update the value.

    If the value name(Enable Journal Wrap Automatic Restore) is not present you may add it with the New->DWORD Value and set the value to 1 and restart FRS service.
    Once the recovery is completed make sure that the Enable Journal Wrap Automatic Restore is set to 0 or delete the key.

    If the JRNL_WRAP_ERROR occurs frequently, you need to exclude sysvol/netlogon from antvirus scan, check the drive for corruption or bad sector and also restore a sysvol using burflag key.

    http://msdn.microsoft.com/en-us/library/windows/desktop/cc507518%28v=vs.85%29.aspx

    You can also fix the same by performing authorative and non authorative of sysvol folder as other mentioned.
    http://support.microsoft.com/kb/290762

    1) Normally for an Authoritative Restore you stop at NTFRS services on all DCs.
    2) Set burflags to D4 on a known good sysvol (or at this time restore sysvol data from backup then set burflags to D4) then start NTFRS on this server.  You may want to rename the old folders with .old extensions prior to restoring good data.
    3) Clean up the folders on all the remaining servers (Policies, Scripts, etc) - renamed them with .old extensions.
    4) Set burflags to D2 on all remaining servers and start NTFRS.
    5) Wait for FRS to replicate.
    6) Clean up the .old stuff if things look good.

    This is probably what you need to do to get it back.

    Note:Kindly take the backup of sysvol folder(Policies & Script) before you proceed.

    Hope this helps

    Regards,
    Sandesh Dubey.
    -------------------------------
    MCSE|MCSA:Messaging|MCTS|MCITP:Enterprise Adminitrator
    My Blog: http://sandeshdubey.wordpress.com
    This posting is provided AS IS with no warranties, and confers no rights.

    <input id="374cdf54-c063-441c-a1f8-c2b8861ccf84_attachments" type="hidden" />
    Thursday, January 19, 2012 6:54 AM
  • Hi Li,

    Gr8 work, it worked for me the error has been resolved but i am having an alert with "Large FRS backlogged connection" due you have any solution for this error.

    Event Type: Warning
    Event Source: NtFrs
    Event Category: None
    Event ID: 13520
    Date: 1/7/2013
    Time: 5:10:28 PM
    User: N/A
    Computer: MRF-MEDAK
    Description:
    The File Replication Service moved the preexisting files in c:\windows\sysvol\domain to c:\windows\sysvol\domain\NtFrs_PreExisting___See_EventLog. 
     
    The File Replication Service may delete the files in c:\windows\sysvol\domain\NtFrs_PreExisting___See_EventLog at any time. Files can be saved from deletion by copying them out of c:\windows\sysvol\domain\NtFrs_PreExisting___See_EventLog. Copying the files into c:\windows\sysvol\domain may lead to name conflicts if the files already exist on some other replicating partner. 
     
    In some cases, the File Replication Service may copy a file from c:\windows\sysvol\domain\NtFrs_PreExisting___See_EventLog into c:\windows\sysvol\domain instead of replicating the file from some other replicating partner. 
     
    Space can be recovered at any time by deleting the files in c:\windows\sysvol\domain\NtFrs_PreExisting___See_EventLog.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

    Monday, January 7, 2013 11:51 AM
  • its work fine for me in windows server 2012
    Monday, February 5, 2018 4:34 AM