Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 13560 Source: NtFrs

The File Replication Service is deleting this computer from the replica set "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" as an attempt to recover from the error state, Error status = FrsErrorSuccess At the next poll, which will occur in 5 minutes, this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set.
I received this event on a Windows 2000 server after following ME887440 and rebooting. The server was migrated to ESX using the VMware migration tool so Iím sure that the volume serial number is at fault here. After waiting 5 minutes like the event said to do, I received two informational events: 13553 and 13516. Everything seems to be fine now.
I got this error as a result of replacing the system disk of a domain controller via a disk image (PowerQuest Drive Image). The new disk had a different volume serial number that caused NtFrs issues (error code FrsErrorMismatchedVolumeSerialNumber). Following the instructions in the message will cure the problem for you.
If you encountered event id 13568 and you created the registry key "Enable Journal Wrap Automatic Restore" this event will show up.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.