Frequent change journal wrap monitor Monitor

  • ID:  Microsoft.Windows.DfsReplication.FrequentChangeJournalWrapsMonitor
  • Description:  This monitor checks whether the DFS Replication service on the monitored computer encountered frequent NTFS change journal wraps.
  • Target:  Replication Volume
  • Enabled:  Yes

Operational States

Name State Description
RepeatedEventRaised Warning  
EventRaised Success  

Alert Details

Monitor State Message Priority Severity Auto Resolution
RepeatedEventRaised (Warning) Frequent NTFS Change Journal Wraps Medium Warning Yes

Run As Profiles

Name
Default

Monitor Knowledgebase

Summary

This monitor may be triggered if the NTFS change journal has wrapped two or more times per day for the specified volume. Consider increasing the size configured for the NTFS change journal on this volume.

Causes

The NTFS change journal is required by the DFS Replication service so that it can keep track of changes occurring to the contents of the replicated folder. This helps it replicate changed files to the replication partners in that replication group.

The service may register this event if it detects that the NTFS change journal has wrapped on the specified volume. A journal wrap may occur for any of the following reasons:

  • The change journal on the specified volume has been truncated. Chkdsk may truncate the change journal if it finds corrupt entries at the end of the journal. The chkdsk operation may have been triggered if the volume was not cleanly dismounted or if the computer shut down abruptly in the recent past.

  • The DFS Replication service was not running on this computer for an extended period of time.

  • The DFS Replication service could not keep up with the rate of file changes on the volume.

Resolutions

No user action is required.

The DFS Replication service will automatically initiate a journal wrap recovery process.

If you see this event being registered frequently, perform the following actions:

  • Ensure that the DFS Replication service is not stopped for extended periods on replication group members.

  • If the rate of change to replicated files is very high on the affected volume, you may need to increase the size configured for the change journal. Increasing the USN journal size, and thus the number of changes that it can hold before the journal "wraps", decreases the possibility that USN journal wraps will occur.

To modify the USN change journal size

  • The USN journal size can be changed by setting the registry key: HKLM\System\CCS\Services\NTFRS\Parameters\"Ntfs Journal size in MB" (REG_DWORD)

  • Valid settings range from 8 to 128 megabytes (MB) with a default of 32 MB. This setting applies to all volumes that are hosting a DFSR replicated folder.

  • After changing the registry setting, stop and then restart the DFS Replication service. To do so from the Operations console, click the Stop DFS Replication Service task, and then click the Start DFS Replication Service task.

  • Decreases to the USN journal size can only be made by reformatting all volumes that contain DFS replicated content.

  • As a guideline, Microsoft recommends configuring 128 MB of journal per 100,000 files replicated on that volume.

External References
This monitor does not contain any external references.

See Also for DFS Replication Monitoring Management Pack


Downloads for DFS Replication Monitoring Management Pack

AZURE OPTIMIZATION ASSESSMENT GET STARTED
MIGRATION TO AZURE GET STARTED
SYSTEM CENTER MIGRATION TO AZURE GET STARTED
MIGRATION TO AZURE FOR SQL AND WINDOWS 2008 GET STARTED