Home
  •  

FRS has not replicated one or more files in the Sysvol to other domain controllers

FRS_has_not_replicated_one_or_more_files_in_the_Sysvol_to_other_domain_controllers_5_Rule (Rule)

Knowledge Base article:

Summary

One or more files in the SYSVOL could not replicate.

For more in-depth monitoring of SYSVOL and FRS, download and install the Ultrasound tool from the Microsoft Web site at http://go.microsoft.com/fwlink/?LinkId=25827. Ultrasound shows health ratings and historical information about FRS replica sets. You can use it to monitor the progress of replication and to detect problems that can cause replication to become backlogged or stop. Ultrasound also provides detailed views for troubleshooting and a framework that you can use to customize alerts and views for your organization.

Causes

An application may still have a file open.

Resolutions

Close the application that is holding these files open.

External

Element properties:

TargetMicrosoft.Windows.Server.2003.AD.DomainControllerRole
CategoryEventCollection
EnabledTrue
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityNormal
RemotableTrue
Alert Message
FRS has not replicated one or more files in the Sysvol to other domain controllers
{0}
Event LogFile Replication Service
CommentMom2005ID='{E9CADC28-AA5A-4599-9088-533146ED9128}';MOM2005GroupID=

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
CollectEventData WriteAction Microsoft.SystemCenter.CollectEvent Default
CollectEventDataWarehouse WriteAction Microsoft.SystemCenter.DataWarehouse.PublishEventData Default
GenerateAlert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="FRS_has_not_replicated_one_or_more_files_in_the_Sysvol_to_other_domain_controllers_5_Rule" Comment="Mom2005ID='{E9CADC28-AA5A-4599-9088-533146ED9128}';MOM2005GroupID=" Enabled="onEssentialMonitoring" Target="AD2003Core!Microsoft.Windows.Server.2003.AD.DomainControllerRole" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>File Replication Service</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>13569</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>NtFrs</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>Params/Param[1]</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>DOMAIN SYSTEM VOLUME (SYSVOL SHARE)</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertOwner>$Data/PublisherName$</AlertOwner>

      <AlertMessageId>$MPElement[Name="FRS_has_not_replicated_one_or_more_files_in_the_Sysvol_to_other_domain_controllers_5_Rule.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue/>

      </Suppression>

    </WriteAction>

    <WriteAction ID="CollectEventData" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="CollectEventDataWarehouse" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>