Event Id 13508 due to large large change in DFS content

Discussion in 'File Systems' started by eric hela, Jan 30, 2006.

  1. eric hela

    eric hela Guest

    Dear kind helpers,
    Please help me with this problem.

    Some times back I deleted a whole heap of folders in the DFS share on the
    master file server I also deleted the same folders on the 2nd server where
    the master server replicates the files to. The replication is one way.
    Since then, I started receiving the warning event id: 13508 and at one point
    the whole dfs share on the replica server was sent into a morphed folder.

    What steps should I take to rectify? I have seen the MS that refers to
    checking DNS, AD replication, connectivity and all that staff but they are
    all fine s far as I am concerned.

    thank you good guys

    Eric Hela
    eric hela, Jan 30, 2006
    1. Advertisements

  2. Hi Eric,

    13508 errors can be difficult to troubleshoot. I've pasted an excerpt from
    our Ultrasound (FRS Monitoring Tool) Help file below. You can download the
    Ultrasound Help file and Ultrasound from

    Event 13508 in the FRS log is a warning that the FRS service has been unable
    to complete the RPC connection to a specific replication partner. It
    indicates that FRS is having trouble enabling replication with that partner
    and will keep trying to establish the connection.

    A single event ID 13508 does not mean anything is broken or not working;
    simply look for event ID 13509 to make sure that the problem was resolved.
    Based on the time between event IDs 13508 and 13509, you can determine if
    there is a real problem that needs to be addressed.

    Note: If FRS is stopped after a 13508 interval, and then later started at a
    time when the communication issue has been resolved, no 13509 is entered in
    the FRS event log. Therefore, an event indicating that FRS has started,
    without a 13508 message, indicates replication connections are being made

    Because FRS servers gather their replication topology information from their
    closest Active Directory domain controller (itself on a domain controller
    that is also an FRS member), there is also an expected case where a replica
    partner in another site will not be aware of the replica set until the
    topology information has been replicated to domain controllers in that site.
    When the topology information finally reaches that distant domain
    controller, the FRS partner in that site will be able to participate in the
    replica set and lead to FRS event ID 13509. Note that intra-site Active
    Directory replication partners replicate every 5 minutes. Intersite
    replication only replicates when the schedule is open (shortest delay is 15
    minutes). In addition, FRS polls the topology in the active directory at
    defined intervals - 5 minutes on domain controllers, and 1 hour on other
    member servers of a replica set. These delays and schedules (and especially
    in topologies with multiple hops) can delay propagation of the FRS
    replication topology


    1. Examine the 13508 event in the File Replication Service event log
    to determine which computer that FRS has been unable to communicate with.

    2. Determine whether the remote computer is working properly, and
    verify that FRS is running on it. A good method to do this to execute the
    following command: NTFRSUTL VERSION <FQDN_of_remote_DC_name> from the
    computer logging the 13508 event.

    3. If this fails, check network connectivity by pinging the
    <FQDN_of_remote_DC_name> from the computer logging the 13508 event. If this
    fails, then troubleshoot the problem as a DNS or TCP/IP issue. If it
    succeeds, confirm the FRS service is started on the remote domain

    4. Determine whether FRS has ever been able to communicate with the
    remote computer by looking for 13509 in the event log and reviewing recent
    change management to networking, firewalls, DNS configuration, and Active
    Directory infrastructure to see if there is a correlation.

    5. Determine whether there is anything between the two computers that
    is capable of blocking RPC traffic, such as a firewall or router.

    6. Confirm that Active Directory replication is working.

    This posting is provided "AS IS" with no warranties, and confers no rights.

    Want to learn more about Windows Server file and storage technologies? Visit
    our team blog at http://blogs.technet.com/filecab/default.aspx.
    Jill Zoeller [MSFT], Feb 1, 2006
    1. Advertisements

  3. eric hela

    eric hela Guest

    Thank you guys. I finally managed to install this tool on my PC.

    eric hela, Feb 22, 2006
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.