DFS-R: NTFS Change Journal Recovery

Microsoft.Windows.FileServer.DFSR.JournalWrapRecoveryFailureMonitor (UnitMonitor)

This object monitors the ability of DFS Replication to recover from a wrap (overwrite of old journal entries) of the NTFS change journal.

Knowledge Base article:

Summary

This object monitors the ability of DFS Replication to recover from a wrap (overwrite of old journal entries) of the NTFS change journal. It does so by looking for the presence of DFS Replication Event 2208.

Causes

An unhealthy state of this monitor indicates that DFS Replication failed to recover from a journal wrap or loss. This can occur due to DFS Replication service internal error conditions or if the volume on which the journal recovery failed does not have at least 512 MB of free disk space.

Resolutions

Wait for NTFS change journal recovery to complete

No action is required.

DFS Replication automatically initiates a journal recovery process.

Increase available disk space

If the volume hosting the staging folder or debug log files is low on disk space, increase the available disk space on the volume, increase the size of the volume, or change the path of the staging folder to a volume with more available disk space.

To manually check the amount of available disk space, open a command prompt window and type the following command, where [servername] is the name of the server hosting the affected folder and [domain\user] is your user name:

WMIC /node: "[servername]" /user: [domain\user] volume list status.

After freeing up space, restart the DFS Replication service.

If the change journal has an internal error and 512 MB of space cannot be recovered by moving or deleting files, run chkdsk on the volume to recover the space used by the corrupt journal.

Additional

DFS Replication Event 2208 (http://go.microsoft.com/fwlink/?LinkId=187127)
Change Journals (http://go.microsoft.com/fwlink/?LinkId=187090)

Element properties:

Target

Microsoft.Windows.FileServer.DFSR.Volume

Parent Monitor

System.Health.AvailabilityState

Category

StateCollection

Enabled

True

Alert Generate

True

Alert Severity

Warning

Alert Priority

Normal

Alert Auto Resolve

True

Monitor Type

Microsoft.Windows.2SingleEventLog2StateMonitorType

Remotable

True

Accessibility

Public

Alert Message

DFS-R: Unable to Recover from NTFS Change Journal Wrap or Loss

DFS Replication failed to recover from an NTFS change journal wrap or loss. DFS Replication will try again.
Additional Information:
Time until next recovery attempt (in seconds): {0}
Error: {1} ({2})
Volume: {3}
GUID: {4}

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.Windows.FileServer.DFSR.JournalWrapRecoveryFailureMonitor" Accessibility="Public" Enabled="true" Target="Microsoft.Windows.FileServer.DFSR.Volume" ParentMonitorID="Health!System.Health.AvailabilityState" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.2SingleEventLog2StateMonitorType" ConfirmDelivery="true">

  <Category>StateCollection</Category>

  <AlertSettings AlertMessage="Microsoft.Windows.FileServer.DFSR.JournalWrapRecoveryFailureMonitor_AlertMessageResourceID">

    <AlertOnState>Warning</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>Warning</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/Params/Param[3]$</AlertParameter1>

      <AlertParameter2>$Data/Context/Params/Param[4]$</AlertParameter2>

      <AlertParameter3>$Data/Context/Params/Param[5]$</AlertParameter3>

      <AlertParameter4>$Data/Context/Params/Param[2]$</AlertParameter4>

      <AlertParameter5>$Data/Context/Params/Param[1]$</AlertParameter5>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="FirstEventRaised" MonitorTypeStateID="FirstEventRaised" HealthState="Warning"/>

    <OperationalState ID="SecondEventRaised" MonitorTypeStateID="SecondEventRaised" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <FirstComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstComputerName>

    <FirstLogName>DFS Replication</FirstLogName>

    <FirstExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">2208</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">DFSR</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[1]</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">$Target/Property[Type="Microsoft.Windows.FileServer.DFSR.Volume"]/VolumeGUID$</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </FirstExpression>

    <SecondComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondComputerName>

    <SecondLogName>DFS Replication</SecondLogName>

    <SecondExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">DFSR</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">1004</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">1104</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <And>

                <Expression>

                  <SimpleExpression>

                    <ValueExpression>

                      <XPathQuery Type="String">Params/Param[1]</XPathQuery>

                    </ValueExpression>

                    <Operator>Equal</Operator>

                    <ValueExpression>

                      <Value Type="String">$Target/Property[Type="Microsoft.Windows.FileServer.DFSR.Volume"]/VolumeGUID$</Value>

                    </ValueExpression>

                  </SimpleExpression>

                </Expression>

                <Expression>

                  <Or>

                    <Expression>

                      <SimpleExpression>

                        <ValueExpression>

                          <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                        </ValueExpression>

                        <Operator>Equal</Operator>

                        <ValueExpression>

                          <Value Type="UnsignedInteger">2206</Value>

                        </ValueExpression>

                      </SimpleExpression>

                    </Expression>

                    <Expression>

                      <SimpleExpression>

                        <ValueExpression>

                          <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                        </ValueExpression>

                        <Operator>Equal</Operator>

                        <ValueExpression>

                          <Value Type="UnsignedInteger">2002</Value>

                        </ValueExpression>

                      </SimpleExpression>

                    </Expression>

                    <Expression>

                      <SimpleExpression>

                        <ValueExpression>

                          <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                        </ValueExpression>

                        <Operator>Equal</Operator>

                        <ValueExpression>

                          <Value Type="UnsignedInteger">2008</Value>

                        </ValueExpression>

                      </SimpleExpression>

                    </Expression>

                    <Expression>

                      <SimpleExpression>

                        <ValueExpression>

                          <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                        </ValueExpression>

                        <Operator>Equal</Operator>

                        <ValueExpression>

                          <Value Type="UnsignedInteger">2010</Value>

                        </ValueExpression>

                      </SimpleExpression>

                    </Expression>

                  </Or>

                </Expression>

              </And>

            </Expression>

            <Expression>

              <And>

                <Expression>

                  <SimpleExpression>

                    <ValueExpression>

                      <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                    </ValueExpression>

                    <Operator>Equal</Operator>

                    <ValueExpression>

                      <Value Type="UnsignedInteger">9111</Value>

                    </ValueExpression>

                  </SimpleExpression>

                </Expression>

                <Expression>

                  <RegExExpression>

                    <ValueExpression>

                      <XPathQuery Type="String">Params/Param[2]</XPathQuery>

                    </ValueExpression>

                    <Operator>ContainsSubstring</Operator>

                    <Pattern>$Target/Property[Type="System!System.Entity"]/DisplayName$</Pattern>

                  </RegExExpression>

                </Expression>

              </And>

            </Expression>

          </Or>

        </Expression>

      </And>

    </SecondExpression>

  </Configuration>

</UnitMonitor>