Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 13512 Source: NtFrs

The File Replication Service has detected an enabled disk write cache on the drive containing the directory c:\winnt\ntfrs\jet on the computer CORPFTP01. The File Replication Service might not recover when power to the drive is interrupted and critical updates are lost.
This problem may occur if a disk's write caching functionality has been turned off. See ME321543 and MSW2KDB for more details.
Self-explanatory. Typically, the Active Directory will disable the disk cache on the drivers where the database resides in order to avoid corruption in case of a failure. If such cache is discovered as being active, this warning message is generated.
As per Microsoft: "This event is logged for informational purposes. When this event is logged, the system administrator is aware that the FRS database may be damaged if power to the drive is lost. If you enable the Write Caching feature and if there are provisions for a power loss (such as an uninterruptible power supply [UPS] attached to the computer, hard disks, or drive controller), the FRS database may not be damaged because FRS does not turn off Write Caching.
Note that you cannot disable this error from being logged." See ME316504.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.