This object monitors the DFS Replication debug log, and creates a Warning alert if it detects that DFS Replication was unable to write to the log.
This object monitors the DFS Replication debug log, and creates a Warning alert if it detects that DFS Replication was unable to write to the log. It does so by looking for the presence of DFS Replication Event 1302.
An unhealthy state of this monitor indicates that debug logging is disabled because DFS Replication was unable to write to the debug log. This usually occurs when DFS Replication cannot access the path of the debug log folder. This can occur for the following reasons:
The volume hosting the debug log folder is offline or on a network share.
The volume hosting the debug log folder is out of disk space.
The debug log folder has exceeded a quota set on the folder or volume hosting the folder.
Incorrect permissions are set on the debug log folder.
Locate the debug log files
To find the path configured for debug logs, type the following command on the affected computer:
wmic /namespace:\\root\microsoftdfs path DfsrMachineConfig get DebugLogFilePath
Verify that the path exists and that it is local to the affected computer. It must not be a UNC address or network path.
If the path does not exist, you can either create the path or change the default debug log location. To change the debug log location, type the following command, where <new_target_path> is the new path for the debug logs:
wmic /namespace:\\root\microsoftdfs path DfsrMachineConfig set DebugLogFilePath="<new_target_path>''
Increase available disk space
If the volume hosting the staging folder or debug log files is low on disk space, increase the available disk space on the volume, increase the size of the volume, or change the path of the staging folder to a volume with more available disk space.
To manually check the amount of available disk space, open a command prompt window and type the following command, where <servername> is the name of the server hosting the affected folder and <domain\user> is your user name:
WMIC /node: "<servername>" /user: <domain\user> volume list status.
After freeing up space, restart the DFS Replication service.
Adjust quotas
If a quota (NTFS disk quota or File Server Resource Manager quota) is limiting the affected folder or volume, consider increasing the quota size.
To adjust folders created with File Server Resource Manager, see Quota Management (http://go.microsoft.com/fwlink/?LinkId=187098).
To adjust NTFS disk quotas, use the Fsutil quota command, as discussed in FSutil quota (http://go.microsoft.com/fwlink/?LinkId=187104).
Correct the debug log folder permissions
If the DFS Replication service doesn’t have Full Control permissions to the debug log folder, logging will fail. To resolve this issue, grant the local System account Full Controlpermissions to the debug log folder.
Verification
This monitor automatically resets to a healthy state when the issue is resolved.
DFS Replication Event 1302 (http://go.microsoft.com/fwlink/?LinkId=187119)
Target | Microsoft.Windows.FileServer.DFSR.Service | ||
Parent Monitor | Microsoft.Windows.FileServer.DFSR.LoggingAggregateMonitor | ||
Category | StateCollection | ||
Enabled | True | ||
Alert Generate | True | ||
Alert Severity | Warning | ||
Alert Priority | Normal | ||
Alert Auto Resolve | True | ||
Monitor Type | Microsoft.Windows.2SingleEventLog2StateMonitorType | ||
Remotable | True | ||
Accessibility | Public | ||
Alert Message |
| ||
RunAs | Default |
<UnitMonitor ID="Microsoft.Windows.FileServer.DFSR.DebugLoggingFailureMonitor" Accessibility="Public" Enabled="true" Target="Microsoft.Windows.FileServer.DFSR.Service" ParentMonitorID="Microsoft.Windows.FileServer.DFSR.LoggingAggregateMonitor" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.2SingleEventLog2StateMonitorType" ConfirmDelivery="true">
<Category>StateCollection</Category>
<AlertSettings AlertMessage="Microsoft.Windows.FileServer.DFSR.DebugLoggingFailureMonitor_AlertMessageResourceID">
<AlertOnState>Warning</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>Normal</AlertPriority>
<AlertSeverity>Warning</AlertSeverity>
<AlertParameters>
<AlertParameter1>$Data/Context/EventDescription$</AlertParameter1>
</AlertParameters>
</AlertSettings>
<OperationalStates>
<OperationalState ID="FirstEventRaised" MonitorTypeStateID="FirstEventRaised" HealthState="Warning"/>
<OperationalState ID="SecondEventRaised" MonitorTypeStateID="SecondEventRaised" HealthState="Success"/>
</OperationalStates>
<Configuration>
<FirstComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstComputerName>
<FirstLogName>DFS Replication</FirstLogName>
<FirstExpression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">1302</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">DFSR</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</FirstExpression>
<SecondComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondComputerName>
<SecondLogName>DFS Replication</SecondLogName>
<SecondExpression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">DFSR</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">1304</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">1004</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
</And>
</SecondExpression>
</Configuration>
</UnitMonitor>