JSI Tip 3476. Windows 2000 SP2 will bring welcome changes to the FRS logging process.

Windows 2000 SP2 will implement the following logging changes, to ease any trouble-shooting tasks in FRS:

• The default logging severity for FRS is reduced to 2 which means that less volume is logged.



• Some of the event log messages are improved, such as, event log messages 13508 and 13514. The 13058 event log message now details a background on the error as well as suggestions for the possible causes of the problems.



• There are a number of new event IDs. Their event messages are detailed in the following list:



• 13559 - Replica root path has changed.



• 13560 - Removing member from replica set to recover from error, will be added back later. Full Replica will be initiated.



• 13561 - FRS has detected JOURNAL_WRAP_ERROR. Removing member from replica set to recover.



• 13562 - Reporting DS access errors:



• Error searching DS with filter ...
• Could not bind to a Domain Controller. Will try again at next polling cycle.
• Could not find computer object for this computer. Will try again at next polling cycle.
• This computer is not part of any valid replica set.
• The object XXX has a invalid value for the attribute...
• The nTFRSSubscriber object XXX is conflicting...
• The nTDSConnection object XXX is conflicting with...
• The NTFRS log files in nt\debug now also log information on change logs. These entries are marked with ":T:".
  
  The tracking log entry summarizes the Change Order (CO) that has finished or is in the process of updating a given file or directory. Each tracking log record contains a date and time stamp and an identifying string ":T:" so that they can be filtered from the rest of the FRS log contents. The individual fields that make up a tracking log entry are:
  
  

  CoG	Change Order GUID - Uniquely identifies a create or delete or rename or modify action for a file.
  CxtG	Connection GUID - Identifies the connection object in the topology connecting an upstream computer to this computer that delivered this Change Order.
  \[Change Order Type\]	RemCo - Remote Change Order
  	RemCo, Abort - Remote Change Order that has been aborted.
  	LclCo - Local Change Order
  	LclCo, Abort - Local Change Order that has been aborted.
  Name	File name
  EventTime	Time (UTC) at which the file change had been performed.
  Ver	Version number of the file (decimal). Incremented each time a local Change Order is created.
  FileG	File GUID - Uniquely identifies the file or directory and is used as the NTFS object ID on the file or directory. The corresponding file or directory on each replica member have the same File GUID.
  FID	File ID - The NTFS volume-specific file ID (also known as File Reference Number). This is member specific.
  ParentG	Parent GUID - The GUID of the parent directory that contains this file or directory.
  Size	The approximate size of the file or directory (hex).
  OrigG	Originator GUID - The GUID associated with a given member of the replica set that originated this update.
  Attr	File Attributes - The attribute flags for the file or directory.
  LocnCmd	Location Command - One of Create, Delete, NoCmd, MoveDir; indicating that the file is being created, deleted, updated, or is changing parent directories.
  ReplicaName	The name of the replica set containing this file or directory.

  
  UsnReason: Flags set in the NTFS change log describing modifications to the file.
  

  Close	Change log close record
  Create	File or directory has been created
  Delete	File or directory has been deleted
  RenNew	File or directory has been renamed
  DatOvrWrt	Main file data stream has been overwritten
  DatExt	Main file data stream has been extended
  DatTrunc	Main file data stream has been truncated
  Info	Basic information change (for example, attribute, last write time)
  Oid	Object ID change
  StreamNam	Alternate data stream name change
  StrmOvrWrt	Alternate data stream has been overwritten
  StrmExt	Alternate data stream has been extended
  StrmTrunc	Alternate data stream has been truncated
  EAChg	Extended file attribute has been changed
  Security	File access permissions changes
  IndexableChg	File change requires reindexing
  HLink	Hardlink change
  CompressChg	File compression attribute changed
  EncryptChg	File encryption changed
  Reparse	Reparse point changed

  
  
  The following tracking record describes a remote Change Order that creates a new file called test_foo4 in Replica-A. The version number is zero.
  

  7/31-08:40:08 :T: CoG: d42cda60  CxtG: 000001b7    \[RemCo         \]  Name: test_foo4
  7/31-08:40:08 :T: EventTime: Mon Jul 31, 2000 08:40:04                Ver:  0
  7/31-08:40:08 :T: FileG:     ceff96a6-5c9f-433a-989c841454a1593b      FID:  61a70000 0000036c
  7/31-08:40:08 :T: ParentG:   1a89f4e1-a0c0-43e4-aedbe869f767f372      Size: 00000000 00000008
  7/31-08:40:08 :T: OrigG:     2eea81b4-f92d-4941-9f269d4bbdd7ea05      Attr: 00000020
  7/31-08:40:08 :T: LocnCmd:   Create   State: IBCO_COMMIT_STARTED      ReplicaName: Replica-A (1)
  7/31-08:40:08 :T: CoFlags:   0000040c   \[Content Locn NewFile \]
  7/31-08:40:08 :T: UsnReason: 00000002   \[DatExt \] 

  
  The following tracking record describes a remote Change Order that is updating the test_foo4 file. The version number is now one.

  7/31-08:43:03 :T: CoG: e1304b2d  CxtG: 000001b7    \[RemCo         \]  Name: test_foo4
  7/31-08:43:03 :T: EventTime: Mon Jul 31, 2000 08:43:00                Ver:  1
  7/31-08:43:03 :T: FileG:     ceff96a6-5c9f-433a-989c841454a1593b      FID:  61a70000 0000036c
  7/31-08:43:03 :T: ParentG:   1a89f4e1-a0c0-43e4-aedbe869f767f372      Size: 00000000 00000010
  7/31-08:43:03 :T: OrigG:     2eea81b4-f92d-4941-9f269d4bbdd7ea05      Attr: 00000020
  7/31-08:43:03 :T: LocnCmd:   NoCmd    State: IBCO_COMMIT_STARTED      ReplicaName: Replica-A (1)
  7/31-08:43:03 :T: CoFlags:   00000004   \[Content \]
  7/31-08:43:03 :T: UsnReason: 00000002   \[DatExt \] 

  
  The following tracking record describes a local Change Order (that is, it originated on the computer that produced this log) that updates the test_foo4 file. The version number is now two. The originator GUID is different from the preceding two tracking records and the File GUID and parent GUIDs are the same for all three Change Orders because the same file is involved and it has not changed parent directories.

  7/31-08:56:55 :T: CoG: cd55ad6f  CxtG: 37b12c93    \[LclCo         \]  Name: test_foo4
  7/31-08:56:55 :T: EventTime: Mon Jul 31, 2000 08:56:52                Ver:  2
  7/31-08:56:55 :T: FileG:     ceff96a6-5c9f-433a-989c841454a1593b      FID:  61a70000 0000036c
  7/31-08:56:55 :T: ParentG:   1a89f4e1-a0c0-43e4-aedbe869f767f372      Size: 00000000 00000200
  7/31-08:56:55 :T: OrigG:     8f759ded-e611-43c4-be05c10138dfdea4      Attr: 00000020
  7/31-08:56:55 :T: LocnCmd:   NoCmd    State: IBCO_COMMIT_STARTED      ReplicaName: Replica-A (1)
  7/31-08:56:55 :T: CoFlags:   00000024   \[Content LclCo \]
  7/31-08:56:55 :T: UsnReason: 00000002   \[DatExt \]