Reading the FRS log files and renaming of folders

[Wayne]

We currently have FRS set up between two servers. Every so often one of the
folders will get renamed to "dirName_NTFRS_xxxxxxxx". According to the "How
FRS Works" (link below) on Microsoft's site this occurs when two directories
of the same name is created on both servers. However, the directories that
get renamed exist on the server for weeks before the rename happens.

So my questions are:

1) anyone have a suggestion why the renaming of the directory is occurring?
2) Is there a utility available on the web for reading the FRS log files?

Currently I can't provide information from the log as I'm not really sure
what it contains I'm not comfortable with posting the information publicly.
--
Thanks
Wayne Sepega
Jacksonville, Fl


"When a man sits with a pretty girl for an hour, it seems like a minute. But
let him sit on a hot stove for a minute and it's longer than any hour.
That's relativity." - Albert Einstein


"How FRS Works" -
http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/techref/en-us/Default.asp?url=/resources/documentation/windowsServ/2003/all/techre
f/en-us/w2k3tr_frs_how.asp

[Richard Chinn [MSFT]]

The first thing to do is be sure you're patched to the latest FRS QFE.
If you're running W2K, you need SP4 or Q815473. If you're running
WS2K3, you need Q823230; call MS support and only ask for the patches
(if you only ask for the patches, you won't be charged). All machines
that are part of the replica set must be patched.

You mentioned that these folders have been around for several weeks.
Were they present in the file system while replication was running,
and they suddenly started getting name morphs, or have the name morphs
been happening ever since you started replication? Do you have an
idea of the frequency at which the morphed folders are generated?

Is it possible you have an application that is deleting / renaming /
moving the folder and then creating a new folder with the same name?
This could cause morphing problems.

You might be able to turn on auditing to see what / who is touching
the folder.

As for tools to parse the logs, the closest thing available is
FRSDiag. You can get it from http://www.microsoft.com/frs. Follow
the link for FRS Troubleshooting and Monitoring.

--Richard

Please post FRS related questions to
microsoft.public.windows.server.dfs_frs and prefix the subject line
with "FRS:" to make it easier to spot. Note that FRS is used to
replicate SYSVOL on domain controllers and DFS root and link targets.

For additional FRS resources, please visit
http://www.microsoft.com/frs.

This posting is provided "AS IS" with no warranties, and confers no
rights.

Post by Wayne
We currently have FRS set up between two servers. Every so often one of the
folders will get renamed to "dirName_NTFRS_xxxxxxxx". According to the "How
FRS Works" (link below) on Microsoft's site this occurs when two directories
of the same name is created on both servers. However, the directories that
get renamed exist on the server for weeks before the rename happens.
1) anyone have a suggestion why the renaming of the directory is occurring?
2) Is there a utility available on the web for reading the FRS log files?
Currently I can't provide information from the log as I'm not really sure
what it contains I'm not comfortable with posting the information publicly.

[Wayne]

I'll pass the info on about the patches. As far as your question, the folder
should be one of the many original folders when the replication was set up.
We've had two morph folders show up so far, Sunday Jan 30th and Friday Feb
4th. We have an application that does our directory creation and looking at
the log the it shows:

for Jan 30th directory
an attempt to delete the first directory, but failed two days before the
morph showed up

for Feb 4th
successful delete of the dir, and re-creation.

There are other attempts/successful deletes of the directories in question
before the ones listed above, the ones above are the last entry in the log.

The application runs as an impersonated user and as such I don't know that
auditing would help in this situation. The application is suppose to be only
run on the primary server. The application and log file is also in the
replication directory.

Is it possible that the changes could have been backed up to a point at
which the delete/recreate would have caused this? if so is it possible to
check that?

Post by Richard Chinn [MSFT]
The first thing to do is be sure you're patched to the latest FRS QFE.
If you're running W2K, you need SP4 or Q815473. If you're running
WS2K3, you need Q823230; call MS support and only ask for the patches
(if you only ask for the patches, you won't be charged). All machines
that are part of the replica set must be patched.
You mentioned that these folders have been around for several weeks.
Were they present in the file system while replication was running,
and they suddenly started getting name morphs, or have the name morphs
been happening ever since you started replication? Do you have an
idea of the frequency at which the morphed folders are generated?
Is it possible you have an application that is deleting / renaming /
moving the folder and then creating a new folder with the same name?
This could cause morphing problems.
You might be able to turn on auditing to see what / who is touching
the folder.
As for tools to parse the logs, the closest thing available is
FRSDiag. You can get it from http://www.microsoft.com/frs. Follow
the link for FRS Troubleshooting and Monitoring.
--Richard
Please post FRS related questions to
microsoft.public.windows.server.dfs_frs and prefix the subject line
with "FRS:" to make it easier to spot. Note that FRS is used to
replicate SYSVOL on domain controllers and DFS root and link targets.
For additional FRS resources, please visit
http://www.microsoft.com/frs.
This posting is provided "AS IS" with no warranties, and confers no
rights.

Post by Wayne
We currently have FRS set up between two servers. Every so often one of the
folders will get renamed to "dirName_NTFRS_xxxxxxxx". According to the "How
FRS Works" (link below) on Microsoft's site this occurs when two directories
of the same name is created on both servers. However, the directories that
get renamed exist on the server for weeks before the rename happens.
1) anyone have a suggestion why the renaming of the directory is occurring?
2) Is there a utility available on the web for reading the FRS log files?
Currently I can't provide information from the log as I'm not really sure
what it contains I'm not comfortable with posting the information publicly.