Journal Wrap Error

I have a windows 2000 SP4, PDC that has been running on a new Dell 2850 for
over six months now. In the last month I have received a Journal Wrap Error
on the PDC after which the server becomes unaccessible. The only new software
that has been installed on the PDC is SQL server 2005, which was intalled a
month or so before the first occurance of the error.

1. Is there any relation?
2. Fixes ?

 

The two should have had no impact with one another that I can think of. SQL
is totally seperate from AD. The wrapping error occurs when there are so
many changes to the USN Journal (The location of log changes to AD) that the
log that holds the changes and the changes wrap around and destroy records
that haven't been updated as of yet.

My guess is your frs service on your dc is stopped. Open up your service
and check to see if FRS is running.

For more info on USN see:
http://support.microsoft.com/kb/292438

--


Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA

This posting is provided "AS IS" with no warranties, and confers no rights.

 

I checked Frs and it is running, I have even folowed a couple of knowledge
base articles which instructed me to stop the service, change a setting in
the registery to D2 and restar the service. As of yet I do not know if that
helped or not. You say that this error occurs because so many changes occur
that have not been replicated. That worries me because our domain and user
base is stable and I cannot think of many changes that should occur at all.
Also the only other machine that these changes may replicate to is the
exchange 2003 server. That is the only other server in our domain.

 

Run diagnostics against your Active Directory domain.

If you don't have the tools installed, install them from your server install
disk.
d:\support\tools\setup.exe

Here see what happens from a diagnostic check.

Run dcdiag and netdiag in verbose mode.

If you download a gui script I wrote it should be simple to set and run. It
also has the option to run individual tests without having to learn all the
switch options.

The script is at http://pbbergs.dynu.com/windows/windows.htm, download it
and save it to c:\program files\support tools\

Just select both dcdiag and netdiag make sure verbose is set. (Leave the
default settings for dcdiag as set when selected)

When complete search for fail, error and warning messages.

 

"dcdiag /v" shows that all tests pass except that there is not printer set
for the office image writer (not used in our org).

"netdiag /v" shows no problems either

 

I'm assuming this is 2003 so from the link below validate that you aren't
missing anything from the wrap error via the USN rollback detection. I'm
not 100% positive if this will detect your errors but it is worth a shot.
If this comes back clean and you aren't getting any errors it would appear
all is ok.

http://support.microsoft.com/?id=875495

 

The PDC is windows 2000 and the Exchange server is Windows 2003 and Exchange
2003. When the 2003 server was installed the AD was extended via the
appropriate MS utilities to accomadate the server. FYI this install is not
new either.

 

Perhaps a little more information on the problem...

LOG Time Msg
FRS 07:57:75 JRNL_WRAP_ERROR
SYS 07:59:73 The server service was unable to map error code 1453
APP 08:00:39 Windows cannot determine the user or computer name.
Return value (14).
DNS 08:02:02 The DNS server has encountered a critical error
from the
Active Directory. Check

After the Journal error the event logs start showing errors as listed above,
and the machine no lnoger responds and has to be restarted. The sys log error
repeats about every 5 minutes as does the APP log error. This continues until
the syste, is restarted. Other errors such as not being able to find files
and make AD connections also occur throught the log

 

I'm not sure what is going on?

Download Ultrasound and run it against all of your dc's.

http://www.microsoft.com/downloads/...b9-c354-4f98-a823-24cc0da73b50&displaylang=en

 

In

Paul, maybe if he reset the Journal so it will reinitialize. I've seen this
problem a couple of times. Both times DNS was misconfigured that caused it.
The other one was caused by a mixed 2000 and 2003 infrastructure where the
journal sizes are larger in 2003. I reset the DCs to point only to the
internal DNS, then reset the Journal in the reg on the offending DC and it
took care of it.

Check this out to see how to reset journal wrapping (and I am assuming it's
generating 13568 errors):
http://www.eventid.net/display.asp?eventid=13568&source=

If that doesn't work, then the problem is deeper and need to reset FRS with
altering the Burflag entries:
Troubleshooting journal_wrap errors on Sysvol and DFS replica sets:
http://support.microsoft.com/default.aspx?scid=kb;en-us;292438


Here's more info for the original poster to review (from my notes and
private blogs):

To reset FRS:

Expand HKEY_LOCAL_MACHINE.
Click down the key path:
"System\CurrentControlSet\Services\NtFrs\Parameters"
Double click on the value name
"Enable Journal Wrap Automatic Restore"
and update the value.

If the value name is not present you may add it with the New->DWORD Value
function under the Edit Menu item.
Type the value name exactly as shown above.

See here for more info:
http://www.eventid.net/display.asp?eventid=13568&source=

Also for resetting FRS:
Troubleshooting journal_wrap errors on Sysvol and DFS replica sets:
http://support.microsoft.com/default.aspx?scid=kb;en-us;292438

290762 Using the BurFlags registry key to reinitialize File Replication
service replica sets:
http://support.microsoft.com/kb/290762/

Using the BurFlags registry key to reinitialize File Replication Service
replica sets:
http://support.microsoft.com/kb/290762/

Download details File Replication Service Diagnostics Tool (FRSDiag.exe):
http://www.microsoft.com/downloads/...familyid=43CB658E-8553-4DE7-811A-562563EB5EBF

221111 Description of FRS entries in the registry:
http://support.microsoft.com/kb/221111/

Download details Ultrasound - Monitoring and Troubleshooting Tool for File
Replication Service (FRS):
http://www.microsoft.com/downloads/...b9-c354-4f98-a823-24cc0da73b50&DisplayLang=en

Prepare a domain controller for nonauthoritative SYSVOL restart Active
Directory (Resetting FRS and Sysvol replication with the Burflag entry):
http://www.microsoft.com/technet/pr...ons/58e20fae-0a9a-4563-bed8-5a8e570432d7.mspx
===============================

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

If you are having difficulty in reading or finding responses to your post,
instead of the website you are using, if I may suggest to use OEx (Outlook
Express or any other newsreader of your choosing), and configure a newsgroup
account, pointing to news.microsoft.com. This is a direct link into the
Microsoft Public Newsgroups, and it is FREE and DOES NOT require a Usenet
account with your ISP. With OEx, you can easily find your post, track
threads, cross-post, and sort by date, poster's name, watched threads or
subject.

Not sure how? It's easy:
How to Configure OEx for Internet News
http://support.microsoft.com/?id=171164

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft MVP - Windows Server Directory Services
Microsoft Certified Trainer
Assimilation Imminent. Resistance is Futile.
Infinite Diversities in Infinite Combinations.
=================================

 

I should have asked about error numbers, my oversight. From reading his
info he has tried to rebuild the sysvol via the burflag and was
unsuccessfull. I was totally unaware of the reset. This is a nice find to
provide him with. Maybe it will resolve his issue.

--


Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA

This posting is provided "AS IS" with no warranties, and confers no rights.


"Ace Fekay [MVP]"

 

In

Ok, I had to go and re-read the thread just to double check I didn't miss
anything, and yes, I did! Sorry, I didn't catch this part:

That's a step I would have done after trying the "Enable Journal Wrap
Automatic Restore". If it still doesn't work, and resetting the FRS burflag
didn't work, and assuming DNS is operational, this isn't a single label name
and all machines are only using the internal DNS, I might suggest just to
yank the box with a force demote. If it's been more than 60 days (but he
would have received lingering objects errors), it may be better to just yank
it. What do you think?

Ace

 

Yeah, I wouldn't mess with things. To unsure of what has happened and how
things sit. He did say the USN testng appeared to be ok but how long will
it take to demote, cleanup and repromote. Probably less time than it would
be to try and figure out the problem. If he has apps on this machine it
might make this not as easy of a choice though.

--

Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA

This posting is provided "AS IS" with no warranties, and confers no rights.

"Ace Fekay [MVP]"

 

In

Good point, especially if Exchange is on it!

Ace

 

HeyAce,
If you have time, I uploaded a script I wrote to list out last logon along
with some other user attributes. If you could download and run it, I would
love feedback from you.

http://pbbergs.dynu.com/windows/windows.htm

This download will provide ALL user ids from your domain in a csv file
(CurrentDate_accts.csv) stored at c:\temp, which is modifiable via the
const def'n FileLocation. The script will determine all parameters about
your AD, modifications to add or remove parameters should be realtively easy

Attributes include:
User Name
Last Logon Date
Creation Date
Home Folder
Script
Display Name
Password Not Needed
Password Does Not Expire
Expired Password
Account Is Disabled


--


Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA

This posting is provided "AS IS" with no warranties, and confers no rights.


"Ace Fekay [MVP]"

 

In

You got it! I forwarded this to myself to remind me tomorrow to run it at
one of my clients.

I'll let you know!

Ace

 

Thanks

--


Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA

This posting is provided "AS IS" with no warranties, and confers no rights.


"Ace Fekay [MVP]"

 

In

Paul - replied privately.