此对象可监视 NTFS 更改日志,如果过去 24 小时内日志在托管已复制文件夹的卷上覆盖(覆盖旧日志条目)两次,将会创建“警告”警报。
此对象可监视 NTFS 更改日志,如果过去 24 小时内日志在托管已复制文件夹的卷上覆盖(覆盖旧日志条目)两次,将会创建“警告”警报。
此监视器的不正常状态表示过去 24 小时内,在托管已复制文件夹的卷上,NTFS 更改日志覆盖两次。当更改日志无法存储所有条目且必须覆盖旧日志条目时,将会出现日志覆盖。这可能是由以下原因引起的:
更改日志已被截断,可能是因为 Chkdsk 在日志结尾发现损坏的条目。
此卷未彻底卸除,或者计算机意外关机。
DFS Replication 服务已停止较长时间。
已复制文件夹中的文件更改频率过高。
等待 NTFS 更改日志恢复完成
不需要任何操作。
DFS 复制会自动启动日志恢复进程。
重要事项:确保 DFS Replication 服务在复制组成员上不会长时间停止。
增加 NTFS 更改日志的大小
如果受影响的卷上的已复制文件更改频率过高,请增加更改日志的大小。增加 USN 日志大小,从而增加日志“覆盖”之前可容纳的更改数,以降低 USN 日志覆盖发生的可能性。
要增加 USN 更改日志大小,请与 Microsoft 客户服务和支持 (http://support.microsoft.com) 联系。
验证
此监视器将在通过 NTFS 更改日志恢复进行恢复后自动重置为正常状态。
更改日志 (http://go.microsoft.com/fwlink/?LinkId=187090)
Target | Microsoft.Windows.FileServer.DFSR.Volume | ||
Parent Monitor | System.Health.ConfigurationState | ||
Category | StateCollection | ||
Enabled | True | ||
Alert Generate | True | ||
Alert Severity | Warning | ||
Alert Priority | Normal | ||
Alert Auto Resolve | True | ||
Monitor Type | Microsoft.Windows.RepeatedEventLogSingleEventLog2StateMonitorType | ||
Remotable | True | ||
Accessibility | Public | ||
Alert Message |
| ||
RunAs | Default |
<UnitMonitor ID="Microsoft.Windows.FileServer.DFSR.FrequentChangeJournalWrapsMonitor" Accessibility="Public" Enabled="true" Target="Microsoft.Windows.FileServer.DFSR.Volume" ParentMonitorID="Health!System.Health.ConfigurationState" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.RepeatedEventLogSingleEventLog2StateMonitorType" ConfirmDelivery="true">
<Category>StateCollection</Category>
<AlertSettings AlertMessage="Microsoft.Windows.FileServer.DFSR.FrequentChangeJournalWrapsMonitor_AlertMessageResourceID">
<AlertOnState>Warning</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>Normal</AlertPriority>
<AlertSeverity>Warning</AlertSeverity>
<AlertParameters>
<AlertParameter1>$Data/Context/Params/Param[2]$</AlertParameter1>
<AlertParameter2>$Data/Context/Params/Param[1]$</AlertParameter2>
</AlertParameters>
</AlertSettings>
<OperationalStates>
<OperationalState ID="RepeatedEventRaised" MonitorTypeStateID="RepeatedEventRaised" HealthState="Warning"/>
<OperationalState ID="EventRaised" MonitorTypeStateID="EventRaised" HealthState="Success"/>
</OperationalStates>
<Configuration>
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>DFS Replication</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">DFSR</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">1004</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">1104</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">Params/Param[1]</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">$Target/Property[Type="Microsoft.Windows.FileServer.DFSR.Volume"]/VolumeGUID$</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">2206</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">2208</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">2002</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">2008</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">2010</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
</And>
</Expression>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">9111</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<RegExExpression>
<ValueExpression>
<XPathQuery Type="String">Params/Param[2]</XPathQuery>
</ValueExpression>
<Operator>ContainsSubstring</Operator>
<Pattern>$Target/Property[Type="System!System.Entity"]/DisplayName$</Pattern>
</RegExExpression>
</Expression>
</And>
</Expression>
</Or>
</Expression>
</And>
</Expression>
<RepeatedComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</RepeatedComputerName>
<RepeatedLogName>DFS Replication</RepeatedLogName>
<RepeatedExpression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">2202</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">DFSR</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">Params/Param[1]</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">$Target/Property[Type="Microsoft.Windows.FileServer.DFSR.Volume"]/VolumeGUID$</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</RepeatedExpression>
<Consolidator>
<ConsolidationProperties>
<PropertyXPathQuery>EventDisplayNumber</PropertyXPathQuery>
<PropertyXPathQuery>PublisherName</PropertyXPathQuery>
<PropertyXPathQuery>LoggingComputer</PropertyXPathQuery>
</ConsolidationProperties>
<TimeControl>
<WithinTimeSchedule>
<Interval>86400</Interval>
</WithinTimeSchedule>
</TimeControl>
<CountingCondition>
<Count>2</Count>
<CountMode>OnNewItemTestOutputRestart_OnTimerRestart</CountMode>
</CountingCondition>
</Consolidator>
</Configuration>
</UnitMonitor>