Troubleshooting journal_wrap errors on Sysvol and DFS replica sets

The File Replication service (FRS) is a multi-threaded, multi-master replication engine that replaces the LMREPL (LanMan Replication) service in the 3.x/4.0 versions of Microsoft Windows NT. Windows 2000 domain controllers and servers use FRS to replicate system policy and logon scripts for Windows 2000 and earlier clients that are located in the System Volume (Sysvol).

FRS can also replicate content between Windows 2000 servers hosting the same fault-tolerant Distributed File System (DFS) roots or child node replicas.

This article describes how FRS uses and relies on the NTFS file system USN change journal.

The USN journal is a log of fixed size that records all changes that take place on NTFS 5.0-formatted partitions. NTFRS monitors the NTFS USN journal file for closed files in FRS replicated directories as long as FRS is running.

Journal wrap errors occur if a sufficient number of changes take place while FRS is turned off such that the last USN change that FRS recorded during shutdown no longer exists in the USN journal during startup. The risk is that changes to files and folders for FRS replicated trees may have taken place while the service was turned off, and no record of the change exists in the USN journal. To guard against data inconsistency, FRS asserts into a journal wrap state.

To perform maintenance on FRS replica set members administrators may stop the FRS service for long periods of time, not realizing the potential impact. In addition, error conditions may cause the FRS service to shut down, resulting in a journal wrap error. In extremely large replica sets, replica members may encounter the "journal_wrap_error" during an authoritative restore (BURFLAGS=D4).

To recover, the affected replica member will need to be reinitialized with a non-authoritative restore (BURFLAGS=D2) where it will synchronize files from an existing inbound partner. This re-initialization can be time consuming for large replica sets.

On computers that run either the Windows 2000 (2195 binary), Windows 2000 Service Pack 1 (SP1), or SP1 Hotfix (WINSE build 5298) versions of the Ntfrs.exe file, the non-authoritative restore process must be invoked manually by setting BURFLAGS=D2 in the Windows NT registry.

For Windows 2000 computers using Windows 2000 Service Pack 2 (SP2), or the Windows 2000 SP2 hotfix (WINSE 11773), versions of the Ntfrs.exe file, the service performs a programmatic non-authoritative restore when the journal_wrap_error is detected.

By default, Windows 2000 Service Pack 3 (SP3) and Windows 2000 SP3 hotfix versions of the Ntfrs.exe file do not perform an automatic non-authoritative restore (for example, SP3 leaves content in place as 2195 and SP1 did) when journal wrap errors are detected. SP3 versions of NTFRS may be configured to function like SP2 when the Enable journal wrap automatic restore registry key is set to 1 in the following registry key: Important Microsoft does not recommend that you use this registry setting, and it should not be used post-Windows 2000 SP3. Appropriate options to reduce journal wrap errors include:

• Place the FRS-replicated content on less busy volumes.
• Keep the FRS service running.
• Avoid making changes to FRS-replicated content while the service is turned off.
• Increase the USN journal size.

FRS is a service that needs to be running at all times on Windows domain controllers and members of FRS-replicated DFS sets.

Increasing the USN journal size, and thus the number of changes that it can hold before the journal "wraps", decreases the possibility that the USN journal wrap will occur. The USN journal size can be changed by setting the following registry key: Valid settings range from 8 to 128 megabytes (MB) with a default of 32 MB. This setting applies to all volumes that are hosting an FRS replica tree. You have to stop and then restart the NTFRS service for the increases to the USN journal size take affect. Decreases to the USN journal size can only be made by reformatting all volumes that contain FRS-replicated content.

The number of changes that a given USN journal file can hold can be estimated with the following formula: The number "2" in this formula stems from two journal entries for each file change: 1 for open and 1 for close. Divide the journal size by the size per change to determine the approximate number of changes that can occur before the journal wrap error is encountered. Assuming 8.3 filenames, this maps to approximately 200,000 files and/or directories for a 32 MB journal file. The number of changes would be less if long file names were used.

In Windows 2000 Service Pack 2, valid settings range from 8 to 128 MB with a default of 32 MB. In Windows 2000 Service Pack 3, valid settings range from 4 to 10,000 MB with a default of 512 MB. These settings apply to all volumes hosting an FRS replica tree.

As a guideline, Microsoft suggests you configure 128 MB of journal per 100,000 files managed by replication on that volume.

REFERENCES