The NT File Replication Service (NTFRS) service creates text-based log files in the %Systemroot%\Debug folder for troubleshooting NTFRS replication problems.
This article describes how the Ntfrs_000n.log files are built and describes the registry entries that control log size and information detail.
The NTFRS service builds two types of text-based log files in the %Systemroot%\Debug folder.
The Ntfrsapi.log file contains events that take place during promotion and demotion, namely creating the NTFRS registry keys.
.log file stores transaction and event details in the Ntfrs_0001.log through Ntfrs_0005.log files. The most recent NTFRS transactions and events are written to the log with the highest version number in existence at that time.
NTFRS debug logging registry summaryNote
By default, some registry entries may not exist. If a registry entry does not exist and you want to specify a different value, you can add the entry if you use the specified data type.
Registry entries that control NTFRS logging reside in the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters registry key.
|Entry||Min ||Max||Default (Pre-SP2)||Default (SP2 and higher)|
|Debug Log Severity (REG_DWORD)||0||5||4||2|
|Debug Log Files (REG_DWORD)||0||300||5||5|
|Debug Maximum Log Messages (REG_DWORD)||~||~||10000||10000|
|Debug Log File (REG_EXPAND_SZ)||~||~||%systemroot%\debug||%systemroot%\debug|
Log detail is controlled by the Debug Log Severity entry. When it is set to 0, minimal logging occurs. Level 5 is the most verbose setting.
The Debug Maximum Log Messages entry (REG_DWORD) controls the number of log entries in a single log file. The default value of 10000 results in a 1.7 megabyte (MB) to 2.4MB log file.
Debug Log File (not the same as Debug Log Files) defines the location where FRS debugging logs are created. Modify this folder if you want to locate FRS debug logs on a separate folder from the default %systemroot%\debug folder.
The number of Ntfrs_000n
.log files residing in the Debug folder is determined by the Debug Log File entry. Once the log entries are written (determined by the Debug Maximum Log Messages registry entry), a new log file, Ntfrs_000TFRS_000n-1
.log is created. Once the correct number of logs are created (determined by the Debug Log File registry entry), the lowest-version log file is deleted and the remaining log filenames are decremented by 1 to make room for a new log file.
The total amount of disk space used for 5 Ntfrs_000n
.log files ranges from 8.5MB to 12MB (Debug Log File X (Debug Maximum Log Messages X ~240)).
This fifth log is created, then the fourth, then the third, second, and first until the maximum number of logs has been created. When the last log hits this message maximum (10 KB by default) it becomes number 4, number 3 becomes number 2, number 2 becomes number 1, and the original number 1 scrolls off to make room for a new fifth log.
The recovery setting for the NTFRS service in Service Control Manager (SCM) can be critical to locating and keeping important log events on the computer. If the service is asserting but SCM is configured to autostart the NTFRS service upon error, enough log traffic may be generated to cause events in the Ntfrs_0005.log file to decrement and be scavenged from the drive. Stop the service on both the inbound and outbound replicas as close to the time an error occurs as you can, then copy the log files to a safe place.