File Replication Service (AD_AD_FRS)
Active Directory uses file replication service (FRS) to synchronize policy between all domain controllers in the forest.
FRS replicates files and folders in the system volume (SYSVOL) shared folder on domain controllers and in Distributed File System (DFS) shared folders.
The File Replication Service monitor type in BMC ProactiveNet Performance Management is referred as the AD_AD_FRS application class in BMC PATROL.
To access the AD_AD_FRS application class, double-click the Active Directory Server icon.
Application class or Monitor type details
Did you know?
Monitor types in the TrueSight console and Central Monitoring Administration are known as application classes in the PATROL consoles.
Attributes in Central Monitoring Administration are known as parameters in the PATROL consoles.
Parameter Reference Database (PRD)
The attribute information is also available in downloadable format in the
The PRD contains reports of the parameters available from the KMs and solutions in the extensive Knowledge Module (KM) library.
You can access these reports in CSV, PDF, or HTML format.
The following attributes are available for this monitor type:
|Name||Description||Unit||Default Performance Key Indicator (KPI)|
FRS Database Space Availability (AdFrsDbSpaceAvailability)
Reports on the availability of space for the database layer. All data that is stored by an Active Directory application mode instance is held in the directory database.
This parameter monitors the error Event ID 13511 in the file replication service event log. The event source is NTFRS. This parameter issues an alarm when the File Replication Service (FRS) database is out of disk space.
|Duplicate Connection (AdFrsDuplicateConnection)|
Monitors the File Replication service (FRS) for occurrences of duplicate connections, which are not allowed. Replication will not occur between these two computers until the duplicate connection objects are removed. This parameter issues an alarm if a duplicate FRS connection is detected.
This parameter monitors the error Event ID 13557 in the file replication service event log. The event source is NTFRS.Recommendations
To resolve this problem, delete duplicate connection objects between the direct replication partners that are noted in the event text.
|Excessive Replication (AdFrsExcessiveReplGenerator)|
Reports the occurrence of excessive file replication. This parameter monitors the warning Event ID 13567 in the file replication service (FRS) event log. The event source is NTFRS.
This parameter indicates that FRS has suppressed file updates that did not actually change the file. FRS logs the Event ID 13567 if this count exceeds 15 times per hour over a three-hour interval. It is a good indicator that you need to investigate applications causing this behavior.
|Journal Wrap Error (AdFrsNtfsJournalWrap)|
Detects a journal wrap. This parameter issues an alert if the NT File System (NTFS) change journal exceeds its maximum size limit and wraps to restore its maximum size by deleting the oldest records.
This parameter monitors the error Event ID 13568 in the file replication service (FRS) event log. The event source is NTFRS.
RPC Connection Error (AdFrsRpcConnectivity)
Detects when the FRS service has been unable to complete the RPC connection to a specific replication partner. This parameter monitors the Event IDs 13508 and 13509 in the file replication service (FRS) event log. The event source is NTFRS.
The error Event 13508 is logged for each unresolved connection. If the problem is fixed, the Event ID, 13509 is logged, which indicates that the RPC connection has been established and replication enabled.
The parameter goes to alarm after event 13508 occurs if:
The FRS Event ID 13508 may indicate that:
|SID Resolution (AdFrsSidResolution)|
Monitors the resolution of user security IDs (SIDs) for File Replication System (FRS) and issues an alarm if the SID cannot be determined from the distinguished name. The file replication service cannot replicate if it unable to verify the SID.
This parameter monitors the error Event ID 13526 in the file replication service event log. The event source is NTFRS.
FRS polls Active Directory at regular intervals to read FRS configuration information. During the polling, an operation is performed to resolve the SID of a FRS replication partner. The binding handle might become invalid if the bound domain controller becomes unreachable over the network or restarts in a single polling interval (the default is five minutes).Recommendations
To resolve this issue, stop and start FRS on the computer that logged the error message.
|Staging Area (AdFrsStagingAreaFull)|
Monitors the available space in the staging area and issues an alert if this area becomes full.
This parameter monitors the warning Event ID 13522 in the file replication service event log. The event source is NTFRS.
The staging area is a folder that acts as a queue for changed files to be replicated.
|SYSVOL Inbound and Outbound Connections Exist (AdFrsSysvolInOutConnection)||Verifies that the domain controller has an enabled inbound connection from a SYSVOL replication partner and that an enabled outbound connection from the domain controller resides on a SYSVOL replication partner.||No|