Windows 2000 SP2 will implement the following logging changes, to ease any trouble-shooting tasks in FRS:

  • The default logging severity for FRS is reduced to 2 which means that less volume is logged.


  • Some of the event log messages are improved, such as, event log messages 13508 and 13514. The 13058 event log message now details a background on the error as well as suggestions for the possible causes of the problems.


  • There are a number of new event IDs. Their event messages are detailed in the following list:


    • 13559 - Replica root path has changed.


    • 13560 - Removing member from replica set to recover from error, will be added back later. Full Replica will be initiated.


    • 13561 - FRS has detected JOURNAL_WRAP_ERROR. Removing member from replica set to recover.


    • 13562 - Reporting DS access errors:


      • Error searching DS with filter ...
      • Could not bind to a Domain Controller. Will try again at next polling cycle.
      • Could not find computer object for this computer. Will try again at next polling cycle.
      • This computer is not part of any valid replica set.
      • The object XXX has a invalid value for the attribute...
      • The nTFRSSubscriber object XXX is conflicting...
      • The nTDSConnection object XXX is conflicting with...
  • The NTFRS log files in nt\debug now also log information on change logs. These entries are marked with ":T:".

    The tracking log entry summarizes the Change Order (CO) that has finished or is in the process of updating a given file or directory. Each tracking log record contains a date and time stamp and an identifying string ":T:" so that they can be filtered from the rest of the FRS log contents. The individual fields that make up a tracking log entry are:

    CoG Change Order GUID - Uniquely identifies a create or delete or rename or modify action for a file.
    CxtG Connection GUID - Identifies the connection object in the topology connecting an upstream computer to this computer that delivered this Change Order.
    \[Change Order Type\] RemCo - Remote Change Order
    RemCo, Abort - Remote Change Order that has been aborted.
    LclCo - Local Change Order
    LclCo, Abort - Local Change Order that has been aborted.
    Name File name
    EventTime Time (UTC) at which the file change had been performed.
    Ver Version number of the file (decimal). Incremented each time a local Change Order is created.
    FileG File GUID - Uniquely identifies the file or directory and is used as the NTFS object ID on the file or directory. The corresponding file or directory on each replica member have the same File GUID.
    FID File ID - The NTFS volume-specific file ID (also known as File Reference Number). This is member specific.
    ParentG Parent GUID - The GUID of the parent directory that contains this file or directory.
    Size The approximate size of the file or directory (hex).
    OrigG Originator GUID - The GUID associated with a given member of the replica set that originated this update.
    Attr File Attributes - The attribute flags for the file or directory.
    LocnCmd Location Command - One of Create, Delete, NoCmd, MoveDir; indicating that the file is being created, deleted, updated, or is changing parent directories.
    ReplicaName The name of the replica set containing this file or directory.

    UsnReason: Flags set in the NTFS change log describing modifications to the file.
    Close Change log close record
    Create File or directory has been created
    Delete File or directory has been deleted
    RenNew File or directory has been renamed
    DatOvrWrt Main file data stream has been overwritten
    DatExt Main file data stream has been extended
    DatTrunc Main file data stream has been truncated
    Info Basic information change (for example, attribute, last write time)
    Oid Object ID change
    StreamNam Alternate data stream name change
    StrmOvrWrt Alternate data stream has been overwritten
    StrmExt Alternate data stream has been extended
    StrmTrunc Alternate data stream has been truncated
    EAChg Extended file attribute has been changed
    Security File access permissions changes
    IndexableChg File change requires reindexing
    HLink Hardlink change
    CompressChg File compression attribute changed
    EncryptChg File encryption changed
    Reparse Reparse point changed


    The following tracking record describes a remote Change Order that creates a new file called test_foo4 in Replica-A. The version number is zero.
    7/31-08:40:08 :T: CoG: d42cda60  CxtG: 000001b7    \[RemCo         \]  Name: test_foo4
    7/31-08:40:08 :T: EventTime: Mon Jul 31, 2000 08:40:04                Ver:  0
    7/31-08:40:08 :T: FileG:     ceff96a6-5c9f-433a-989c841454a1593b      FID:  61a70000 0000036c
    7/31-08:40:08 :T: ParentG:   1a89f4e1-a0c0-43e4-aedbe869f767f372      Size: 00000000 00000008
    7/31-08:40:08 :T: OrigG:     2eea81b4-f92d-4941-9f269d4bbdd7ea05      Attr: 00000020
    7/31-08:40:08 :T: LocnCmd:   Create   State: IBCO_COMMIT_STARTED      ReplicaName: Replica-A (1)
    7/31-08:40:08 :T: CoFlags:   0000040c   \[Content Locn NewFile \]
    7/31-08:40:08 :T: UsnReason: 00000002   \[DatExt \]

    The following tracking record describes a remote Change Order that is updating the test_foo4 file. The version number is now one.
    7/31-08:43:03 :T: CoG: e1304b2d  CxtG: 000001b7    \[RemCo         \]  Name: test_foo4
    7/31-08:43:03 :T: EventTime: Mon Jul 31, 2000 08:43:00                Ver:  1
    7/31-08:43:03 :T: FileG:     ceff96a6-5c9f-433a-989c841454a1593b      FID:  61a70000 0000036c
    7/31-08:43:03 :T: ParentG:   1a89f4e1-a0c0-43e4-aedbe869f767f372      Size: 00000000 00000010
    7/31-08:43:03 :T: OrigG:     2eea81b4-f92d-4941-9f269d4bbdd7ea05      Attr: 00000020
    7/31-08:43:03 :T: LocnCmd:   NoCmd    State: IBCO_COMMIT_STARTED      ReplicaName: Replica-A (1)
    7/31-08:43:03 :T: CoFlags:   00000004   \[Content \]
    7/31-08:43:03 :T: UsnReason: 00000002   \[DatExt \]

    The following tracking record describes a local Change Order (that is, it originated on the computer that produced this log) that updates the test_foo4 file. The version number is now two. The originator GUID is different from the preceding two tracking records and the File GUID and parent GUIDs are the same for all three Change Orders because the same file is involved and it has not changed parent directories.
    7/31-08:56:55 :T: CoG: cd55ad6f  CxtG: 37b12c93    \[LclCo         \]  Name: test_foo4
    7/31-08:56:55 :T: EventTime: Mon Jul 31, 2000 08:56:52                Ver:  2
    7/31-08:56:55 :T: FileG:     ceff96a6-5c9f-433a-989c841454a1593b      FID:  61a70000 0000036c
    7/31-08:56:55 :T: ParentG:   1a89f4e1-a0c0-43e4-aedbe869f767f372      Size: 00000000 00000200
    7/31-08:56:55 :T: OrigG:     8f759ded-e611-43c4-be05c10138dfdea4      Attr: 00000020
    7/31-08:56:55 :T: LocnCmd:   NoCmd    State: IBCO_COMMIT_STARTED      ReplicaName: Replica-A (1)
    7/31-08:56:55 :T: CoFlags:   00000024   \[Content LclCo \]
    7/31-08:56:55 :T: UsnReason: 00000002   \[DatExt \]