Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
The File Replication Service has detected an enabled disk write cache on the drive containing the directory c:\winnt\ntfrs\jet on the computer CORPFTP01. The File Replication Service might not recover when power to the drive is interrupted and critical updates are lost.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is FTP?
What is the role of File Replication Service?
This problem may occur if a disk's write caching functionality has been turned off. See ME321543 and MSW2KDB for more details.
Self-explanatory. Typically, the Active Directory will disable the disk cache on the drivers where the database resides in order to avoid corruption in case of a failure. If such cache is discovered as being active, this warning message is generated.
As per Microsoft: "This event is logged for informational purposes. When this event is logged, the system administrator is aware that the FRS database may be damaged if power to the drive is lost. If you enable the Write Caching feature and if there are provisions for a power loss (such as an uninterruptible power supply [UPS] attached to the computer, hard disks, or drive controller), the FRS database may not be damaged because FRS does not turn off Write Caching.
Note that you cannot disable this error from being logged." See ME316504.
|Private comment: Subscribers only. See example of private comment|
|Links: ME316504, ME321543, MSW2KDB|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated