Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
The File Replication Service has detected that the replica set "DOMAIN
SYSTEM VOLUME (SYSVOL SHARE)" is in JRNL_WRAP_ERROR.
Replica set name is : "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"
Replica root path is : "c:\winnt\sysvol\domain"
Replica root volume is : "\\.\C:"
A Replica set hits JRNL_WRAP_ERROR when the record that it is trying to
read from the NTFS USN journal is not found. This can occur because of one
of the following reasons.
 Volume "\\.\C:" has been formatted.
 The NTFS USN journal on volume "\\.\C:" has been deleted.
 The NTFS USN journal on volume "\\.\C:" has been truncated. Chkdsk can
truncate the journal if it finds corrupt entries at the end of the journal.
 File Replication Service was not running on this computer for a long
 File Replication Service could not keep up with the rate of Disk IO
activity on "\\.\C:".
Following recovery steps will be taken to automatically recover from this
 At the first poll which will occur in 5 minutes this computer will be
deleted from the replica set.
 At the poll following the deletion this computer will be re-added to
the replica set. The re-addition will trigger a full tree sync for the
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is the role of File Replication Service?
What is a replica set?
This event can occur if you are running the Legato NetWorker program to back up volumes and the Legato NetWorker program uses the Update Sequence Number (USN) journal to log all changes that are made to the files in these volumes. See ME912026 for information on fixing this problem.
Some clues to what is going on can be found in ME292438.
From a newsgroup post: "In my case there was something wrong with SYSVOL on DC1. All I needed to do was instruct FRS to initiate an authoritative restore of SYSVOL, and everything worked out nicely. To do that, all I needed to do was to follow the instructions in article ME316790".
|Private comment: Subscribers only. See example of private comment|
|Links: ME292438, ME316790, ME912026|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated