DFS-R: NTFS Change Journal Creation Monitor

  • ID:  Microsoft.Windows.FileServer.DFSR.UsnJournalCreationFailureMonitor
  • Description:  This object monitors the creation of NTFS change journals for volumes hosting replicated folders for which a change journal doesn’t already exist, and creates a Warning alert if creating the journal fails.
  • Target:  Replication Volume
  • Enabled:  Yes

Operational States

Name State Description
FirstEventRaised Warning  
SecondEventRaised Success  

Alert Details

Monitor State Message Priority Severity Auto Resolution
FirstEventRaised (Warning) DFS-R: Failed to Create an NTFS Change Journal Medium Warning Yes

Run As Profiles

Name
Default

Monitor Knowledgebase

Summary

This object monitors the creation of NTFS change journals for volumes hosting replicated folders for which a change journal doesn’t already exist, and creates a Warning alert if creating the journal fails. It does so by looking for the presence of DFS Replication Event 2210.

Causes

An unhealthy state of this monitor indicates that DFS Replication failed to create an NTFS change journal on a volume hosting one or more replicated folders. Replication is disabled for all replicated folders on the affected volume.

This can occur if there isn’t at least 512 MB of free space available on the volume.

Resolutions

Increase available disk space

If the volume hosting the staging folder or debug log files is low on disk space, increase the available disk space on the volume, increase the size of the volume, or change the path of the staging folder to a volume with more available disk space.

To manually check the amount of available disk space, open a command prompt window and type the following command, where <servername> is the name of the server hosting the affected folder and <domain\user> is your user name:

WMIC /node: "<servername>" /user: <domain\user> volume list status.

If the change journal has an internal error and 512 MB of space cannot be recovered by moving or deleting files, run Chkdsk on the volume to recover the space used by the corrupt journal.

After freeing up space, restart the DFS Replication service.

To restart the service remotely by using the sc command, open a command prompt window and then do the following:

1.To stop the service, type the following command, where <servername> is the Universal Naming Convention (UNC) path to the remote server:

sc <servername> stop dfsr

2.To confirm that the service is in the STOPPED state, type the following command:

sc <servername> query dfsr

3.To restart the service, type the following command:

sc <servername> start dfsr

Note: To restart a service, you must be a member of the local Administrators group on the affected server. You can also restart services using the Services snap-in, the Windows PowerShell Start-Service and Stop-Service cmdlets, or command-line tools such as net stop and net start.

Relocate the replicated folder

If there isn’t enough free space available on the volume hosting the replicated folder, consider relocating the replicated folder to another volume with more free space. To do so, remove the server’s membership in the replication group and recreate it. Doing so requires membership in the Domain Admins group or delegated permissions.

Verification

This monitor automatically resets to a healthy state after the issue is resolved.

External References
This monitor does not contain any external references.

See Also for Windows Server File & iSCSI Services Management Pack


Downloads for Windows Server File & iSCSI Services Management Pack

AZURE OPTIMIZATION ASSESSMENT GET STARTED
MIGRATION TO AZURE GET STARTED
SYSTEM CENTER MIGRATION TO AZURE GET STARTED
MIGRATION TO AZURE FOR SQL AND WINDOWS 2008 GET STARTED