Windows 2000 SP2 will implement the following logging changes, to ease any trouble-shooting tasks in FRS:
- The default logging severity for FRS is reduced to 2 which means that less volume is logged.
- Some of the event log messages are improved, such as, event log messages 13508 and 13514. The 13058 event log message now details a background on the error as well as suggestions for the possible causes of the problems.
- There are a number of new event IDs. Their event messages are detailed in the following list:
- 13559 - Replica root path has changed.
- 13560 - Removing member from replica set to recover from error, will be added back later. Full Replica will be initiated.
- 13561 - FRS has detected JOURNAL_WRAP_ERROR. Removing member from replica set to recover.
- 13562 - Reporting DS access errors:
- Error searching DS with filter ...
- Could not bind to a Domain Controller. Will try again at next polling cycle.
- Could not find computer object for this computer. Will try again at next polling cycle.
- This computer is not part of any valid replica set.
- The object XXX has a invalid value for the attribute...
- The nTFRSSubscriber object XXX is conflicting...
- The nTDSConnection object XXX is conflicting with...
- The NTFRS log files in nt\debug now also log information on change logs. These entries are marked with ":T:".
The tracking log entry summarizes the Change Order (CO) that has finished or is in the process of updating a given file or directory. Each tracking log record contains a date and time stamp and an identifying string ":T:" so that they can be filtered from the rest of the FRS log contents. The individual fields that make up a tracking log entry are:
CoG Change Order GUID - Uniquely identifies a create or delete or rename or modify action for a file. CxtG Connection GUID - Identifies the connection object in the topology connecting an upstream computer to this computer that delivered this Change Order. \[Change Order Type\] RemCo - Remote Change Order RemCo, Abort - Remote Change Order that has been aborted. LclCo - Local Change Order LclCo, Abort - Local Change Order that has been aborted. Name File name EventTime Time (UTC) at which the file change had been performed. Ver Version number of the file (decimal). Incremented each time a local Change Order is created. FileG File GUID - Uniquely identifies the file or directory and is used as the NTFS object ID on the file or directory. The corresponding file or directory on each replica member have the same File GUID. FID File ID - The NTFS volume-specific file ID (also known as File Reference Number). This is member specific. ParentG Parent GUID - The GUID of the parent directory that contains this file or directory. Size The approximate size of the file or directory (hex). OrigG Originator GUID - The GUID associated with a given member of the replica set that originated this update. Attr File Attributes - The attribute flags for the file or directory. LocnCmd Location Command - One of Create, Delete, NoCmd, MoveDir; indicating that the file is being created, deleted, updated, or is changing parent directories. ReplicaName The name of the replica set containing this file or directory.
UsnReason: Flags set in the NTFS change log describing modifications to the file.
Close Change log close record Create File or directory has been created Delete File or directory has been deleted RenNew File or directory has been renamed DatOvrWrt Main file data stream has been overwritten DatExt Main file data stream has been extended DatTrunc Main file data stream has been truncated Info Basic information change (for example, attribute, last write time) Oid Object ID change StreamNam Alternate data stream name change StrmOvrWrt Alternate data stream has been overwritten StrmExt Alternate data stream has been extended StrmTrunc Alternate data stream has been truncated EAChg Extended file attribute has been changed Security File access permissions changes IndexableChg File change requires reindexing HLink Hardlink change CompressChg File compression attribute changed EncryptChg File encryption changed Reparse Reparse point changed
The following tracking record describes a remote Change Order that creates a new file called test_foo4 in Replica-A. The version number is zero.
7/31-08:40:08 :T: CoG: d42cda60 CxtG: 000001b7 \[RemCo \] Name: test_foo4 7/31-08:40:08 :T: EventTime: Mon Jul 31, 2000 08:40:04 Ver: 0 7/31-08:40:08 :T: FileG: ceff96a6-5c9f-433a-989c841454a1593b FID: 61a70000 0000036c 7/31-08:40:08 :T: ParentG: 1a89f4e1-a0c0-43e4-aedbe869f767f372 Size: 00000000 00000008 7/31-08:40:08 :T: OrigG: 2eea81b4-f92d-4941-9f269d4bbdd7ea05 Attr: 00000020 7/31-08:40:08 :T: LocnCmd: Create State: IBCO_COMMIT_STARTED ReplicaName: Replica-A (1) 7/31-08:40:08 :T: CoFlags: 0000040c \[Content Locn NewFile \] 7/31-08:40:08 :T: UsnReason: 00000002 \[DatExt \]
The following tracking record describes a remote Change Order that is updating the test_foo4 file. The version number is now one.
7/31-08:43:03 :T: CoG: e1304b2d CxtG: 000001b7 \[RemCo \] Name: test_foo4 7/31-08:43:03 :T: EventTime: Mon Jul 31, 2000 08:43:00 Ver: 1 7/31-08:43:03 :T: FileG: ceff96a6-5c9f-433a-989c841454a1593b FID: 61a70000 0000036c 7/31-08:43:03 :T: ParentG: 1a89f4e1-a0c0-43e4-aedbe869f767f372 Size: 00000000 00000010 7/31-08:43:03 :T: OrigG: 2eea81b4-f92d-4941-9f269d4bbdd7ea05 Attr: 00000020 7/31-08:43:03 :T: LocnCmd: NoCmd State: IBCO_COMMIT_STARTED ReplicaName: Replica-A (1) 7/31-08:43:03 :T: CoFlags: 00000004 \[Content \] 7/31-08:43:03 :T: UsnReason: 00000002 \[DatExt \]
The following tracking record describes a local Change Order (that is, it originated on the computer that produced this log) that updates the test_foo4 file. The version number is now two. The originator GUID is different from the preceding two tracking records and the File GUID and parent GUIDs are the same for all three Change Orders because the same file is involved and it has not changed parent directories.
7/31-08:56:55 :T: CoG: cd55ad6f CxtG: 37b12c93 \[LclCo \] Name: test_foo4 7/31-08:56:55 :T: EventTime: Mon Jul 31, 2000 08:56:52 Ver: 2 7/31-08:56:55 :T: FileG: ceff96a6-5c9f-433a-989c841454a1593b FID: 61a70000 0000036c 7/31-08:56:55 :T: ParentG: 1a89f4e1-a0c0-43e4-aedbe869f767f372 Size: 00000000 00000200 7/31-08:56:55 :T: OrigG: 8f759ded-e611-43c4-be05c10138dfdea4 Attr: 00000020 7/31-08:56:55 :T: LocnCmd: NoCmd State: IBCO_COMMIT_STARTED ReplicaName: Replica-A (1) 7/31-08:56:55 :T: CoFlags: 00000024 \[Content LclCo \] 7/31-08:56:55 :T: UsnReason: 00000002 \[DatExt \]