Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 5012 Source: DFSR

The DFS Replication service failed to communicate with partner <computer> for replication group <dfs path to folder>. The partner did not recognize the connection or the replication group configuration.

Partner DNS Address: <dns path to computer>

Optional data if available:
Partner WINS Address: <computer>
Partner IP Address: <ip address>

The service will retry the connection periodically.

Additional Information:
Error: <error code> (<error message>)
Connection ID: <guid>
Replication Group ID: <guid2>.
Error: 9036 (Paused for backup or restore) - This was and expected event, as the DC was processing a scheduled backup at the time.
This event would occur on our source and target file servers using DFS Replication when a backup would take place. Event 5012, 5014 and 5002 would all generate in the DFS Replication Log as well.

Opened up a case with Symantec regarding Event 5012. It was resolved by installing the latest Hotfix's for Symantec Backup Exec 2010.

Also opened up with Microsoft who stated that the events can be safely ignored and that they are generated by design.

"This pair of events (5014/5002) is a normal phenomenon in the case of backup using Backup Exec 2010 or another other backup tools. It is completely due to the working mechanism of Backup Exec tool. When a backup job is performed, the Backup Exec proactively stops any DFSR replication and then uses the DFSR VSS writer to backup data.

Therefore, this is by-design behavior of Backup Exec software. The Error code 9036 in the event ID 5002 also explains this is just a temporary and active termination due to Backup.

To sum up, these two warnings are generated as expected by Backup Exec tool. Backup Exec tool needs to terminate the replication temporarily to avoid the conflict and complete the backup task. Please rest assured that these two warnings will NOT cause any real replication issue. The replication will be resumed automatically without intervention after the backup. If you don't want to see these warnings, as a workaround, you can stop the DFSR service prior to backup.
- Error: 9026 (The connection is invalid) - Check network connectivity.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.