Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
The File Replication Service moved the preexisting files in %1 to %2.
The File Replication Service may delete the files in %2 at any time. Files can be saved from deletion by copying them out of %2. Copying the files into %1 may lead to name conflicts if the files already exist on some other replicating partner.
In some cases, the File Replication Service may copy a file from %2 into %1 instead of replicating the file from some other replicating partner.
Space can be recovered at any time by deleting the files in %2.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is the role of File Replication Service?
At a remote site, a volume had it's drive letter reassigned, breaking DFS Replication. Clearing the local JET folder, updating registry keys under HKLM\CurrentControlSet and the other backup areas, then restarting the NTFRS service did not resolve the incorrect location. As we implemented a Domain Based root we discovered the AD Computer Object held information on the replication location and it was here that the information was being read.
There may be a command I am not aware of yet the solution for us was to edit the object using ADSIEdit. Navigate to:
CN=<ComputerObject>, CN=NTFRS Subscriptions, CN=DFS Volumes, CN=<DFS Tree GUID>, CN=<DFS Tree Name>, CN=<DFS Replication Target>
Under Properties edit the fRSRootPath and fRSStagingPath attributes to use the correct paths. Allow AD Replication of the object to the affeected computers site. Restart the services:
Net Stop NTFRS
Delete the %SystemRoot%\NTFRS\JET folder. Until this was performed it held onto the old information. Remember this will cause a resync of DFS content essentially wiping current data and replicating it back in.
Net Start NTFRS
You will see some warnings (Event id 13520) that the preexisting files in every DFS target will be moved to NtFrs_PreExisting... followed by 13553 and 13554 to say that the Target has been added to the Replication set.
See EventID 13559 from source NtFrs for information on this problem. You should delete the folder "NtFrs_PreExisting___See_EventLog" as soon as possible in order to avoid any filename problems, if this issue reappears.
This event is generated when File Replication is configured for a share but that share already contains files. In order to accommodate the mirroring that will be done by replication, the existing files are moved to a hidden directory called NtFrs_PreExisting___ so they can be recovered later.
|Private comment: Subscribers only. See example of private comment|
|Links: EventID 13559 from source NtFrs|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated