ID Evenement: 13568

Source NtFrs 

Type Error 


The File Replication Service has detected that the replica set "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" is in JRNL_WRAP_ERROR.

Replica set name is    : "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"
Replica root path is   : "c:\winnt\sysvol\domain"
Replica root volume is : "\\.\C:"
A Replica set hits JRNL_WRAP_ERROR when the record that it is trying to read from the NTFS USN journal is not found.  This can occur because of one of the following reasons.

[1] Volume "\\.\C:" has been formatted.
[2] The NTFS USN journal on volume "\\.\C:" has been deleted.
[3] The NTFS USN journal on volume "\\.\C:" has been truncated. Chkdsk can truncate the journal if it finds corrupt entries at the end of the journal.
[4] File Replication Service was not running on this computer for a long time.
[5] File Replication Service could not keep up with the rate of Disk IO activity on "\\.\C:".
Setting the "Enable Journal Wrap Automatic Restore" registry parameter to 1 will cause the following recovery steps to be taken to automatically recover from this error state.
[1] At the first poll, which will occur in 5 minutes, this computer will be deleted from the replica set. If you do not want to wait 5 minutes, then run "net stop ntfrs" followed by "net start ntfrs" to restart the File Replication Service.
[2] At the poll following the deletion this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set.

WARNING: During the recovery process data in the replica tree may be unavailable. You should reset the registry parameter described above to 0 to prevent automatic recovery from making the data unexpectedly unavailable if this error condition occurs again.

To change this registry parameter, run regedit.

Click on Start, Run and type regedit.

Click down the key path:
Double click on the value name
   "Enable Journal Wrap Automatic Restore"
and update the value.

If the value name is not present you may add it with the New->DWORD Value function under the Edit Menu item. Type the value name exactly as shown above. 


CommentsTom McMeekin


After speaking with MS Technical Support, I was emailed a Q article, which did fix the problem. See Q315070 ("Event 13568 Is Logged in the File Replication Service Event Log[ntrelease]").

The Q article does not appear to be available anymore so here is the content (please note that if the article is not available anymore then it probably means that is no longer valid or was wrong!):

Event 13568 Is Logged in the File Replication Service Event Log[ntrelease]
ID: Q315070    CREATED: 18-DEC-2001   MODIFIED: 06-AUG-2002

The information in this article applies to:
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Server

The following event may be logged in the File Replication service (FRS) event
log after you install Windows 2000 Service Pack 3 (SP3):

   Event Type: Warning
   Event Source: NtFrs
   Event Category: None
   Event ID: 13568
   Date: 12/12/2001
   Time: 2:03:32 PM
   User: N/A
   Computer: NA-DC-01
[... event description...]


This error message is logged because the requested data is not available due to
the following series of events:

- FRS uses the NTFS file system journal to track changes to files and to
   folders that are in a replica tree to propagate those changes to other
   members of the replica set.

- If FRS does not record the changes, the journal wraps and FRS does not know
   which change to process next. FRS may not record the changes because:
    - FRS is off for an extended period of time.
    - The changes are occurring faster than FRS can process them.

- To recover from this error state, FRS needs to:
    - Re-initialize the content of the replicated directory.
    - Resume tracking the NTFS journal from a known good starting point.

- To re-initialize the replica tree, FRS moves all content into the
   NTFRS_Pre-Existing folder, and then FRS rejoins the replica set by sourcing
   from an upstream partner. Based on the contents of the file, one of the
   following events occurs:
    - If a file on the upstream partner is identical to the file that is in the NTFRS_Pre-Existing folder, the local copy is moved into the replica tree.
    - If the file is different, or if new files have been added to the replica  set, FRS replicates the update from the upstream partner and moves it into the replica tree.
- During this procedure, the data on that particular member becomes

In Service Pack 2 (SP2), this re-initialization takes place automatically, which may take the data offline at an inopportune time. In SP3, the event is logged by default and an administrator can re-initialize the replica tree at a convenient time.



To modify the default behavior, make the following changes in the registry to
instruct FRS to handle the JRNL_WRAP_ERROR status automatically:
1. Stop FRS.
2. Start Registry Editor (Regedt32.exe).
3. Locate and click the following key in the registry:
4. On the Edit menu, click Add Value, and then add the following registry value:
   Value name: Enable Journal Wrap Automatic Restore
   Data type: REG_DWORD
   Radix: Hexadecimal
   Value data: 1 (Default 0)
5. Quit Registry Editor.
6. Restart FRS.

If these steps do not modify the default settings and the automatic
re-initialization is not turned on, you need to manually re-initialize the
replica tree. At a convenient time, make the following changes to the registry:

1. Stop FRS.
2. Start Registry Editor (Regedt32.exe).
3. Locate and click the following key in the registry:
   at Startup
4. On the Edit menu, click Add Value, and then add the following registry value:
   Value name: BurFlags
   Data type: REG_DWORD
   Radix: Hexadecimal
   Value data: D2
5. Quit Registry Editor.
6. Restart FRS.

For additional information about SP3 updates to the File Replication service,
click the article number below to view the article in the Microsoft Knowledge
   Q307319 File Replication Service Improvements in Windows 2000 SP3  

Links Q315070