Discussion:
JRNL_WRAP_ERROR on SBS2003 R2 Standard
(too old to reply)
Januar
2008-05-29 11:10:00 UTC
Permalink
Hi,
Recently I got issue with SBS 2003 R2 Standard server. I noticed this after
there was a power failure. When the server is back there are some errors on
the event logs. After one day the server will start to be very slow and it
looks like hang. I got to restart the server to make it operational again.

DNS logs report issue such as:

Event Type: Error
Event Source: DNS
Event Category: None
Event ID: 4015
Date: 5/25/2008
Time: 1:12:35 AM
User: N/A
Computer: SERVER
Description:
The DNS server has encountered a critical error from the Active Directory.
Check that the Active Directory is functioning properly. The extended error
debug information (which may be empty) is "".


Event Type: Error
Event Source: DNS
Event Category: None
Event ID: 4000
Date: 5/25/2008
Time: 3:38:36 PM
User: N/A
Computer: SERVER
Description:
The DNS server was unable to open Active Directory. This DNS server is
configured to obtain and use information from the directory for this zone and
is unable to load the zone without it. Check that the Active Directory is
functioning properly and reload the zone.



Other log from FRS:
Event Type: Error
Event Source: NtFrs
Event Category: None
Event ID: 13568
Date: 5/25/2008
Time: 12:00:04 AM
User: N/A
Computer: SERVER
Description:
The File Replication Service has detected that the replica set "DOMAIN
SYSTEM VOLUME (SYSVOL SHARE)" is in JRNL_WRAP_ERROR. Replica set name is :
"DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"
Replica root path is : "c:\windows\sysvol\domain"
Replica root volume is : "\\.\C:"
A Replica set hits JRNL_WRAP_ERROR when the record that it is trying to
read from the NTFS USN journal is not found. This can occur because of one
of the following reasons.

[1] Volume "\\.\C:" has been formatted.
[2] The NTFS USN journal on volume "\\.\C:" has been deleted.
[3] The NTFS USN journal on volume "\\.\C:" has been truncated. Chkdsk can
truncate the journal if it finds corrupt entries at the end of the journal.
[4] File Replication Service was not running on this computer for a long
time.
[5] File Replication Service could not keep up with the rate of Disk IO
activity on "\\.\C:".
Setting the "Enable Journal Wrap Automatic Restore" registry parameter to 1
will cause the following recovery steps to be taken to automatically recover
from this error state.
[1] At the first poll, which will occur in 5 minutes, this computer will be
deleted from the replica set. If you do not want to wait 5 minutes, then run
"net stop ntfrs" followed by "net start ntfrs" to restart the File
Replication Service.
[2] At the poll following the deletion this computer will be re-added to
the replica set. The re-addition will trigger a full tree sync for the
replica set.

WARNING: During the recovery process data in the replica tree may be
unavailable. You should reset the registry parameter described above to 0 to
prevent automatic recovery from making the data unexpectedly unavailable if
this error condition occurs again.

To change this registry parameter, run regedit.

Click on Start, Run and type regedit.

Expand HKEY_LOCAL_MACHINE.
Click down the key path:
"System\CurrentControlSet\Services\NtFrs\Parameters"
Double click on the value name
"Enable Journal Wrap Automatic Restore"
and update the value.

If the value name is not present you may add it with the New->DWORD Value
function under the Edit Menu item. Type the value name exactly as shown above.



There is only 1 single server in the domain. Any help is appreciated.

Regards,
Cliff Galiher
2008-05-30 04:23:06 UTC
Permalink
Your AD database files have become corrupt and they are trying to sync with
some non-existent data. If you have a second windows server in your domain
and it is also a DC then you can force replication...but since you are
posting here, I will assume that your SBS server is your only server. In
that case I strongly recommend performing a backup of your server (in case
my next step kills you) and then restoring the system-state from a previous
backup.

Then go buy a UPS for your server.

I wish I had better news for ya,

-Cliff
Post by Januar
Hi,
Recently I got issue with SBS 2003 R2 Standard server. I noticed this after
there was a power failure. When the server is back there are some errors on
the event logs. After one day the server will start to be very slow and it
looks like hang. I got to restart the server to make it operational again.
Event Type: Error
Event Source: DNS
Event Category: None
Event ID: 4015
Date: 5/25/2008
Time: 1:12:35 AM
User: N/A
Computer: SERVER
The DNS server has encountered a critical error from the Active Directory.
Check that the Active Directory is functioning properly. The extended error
debug information (which may be empty) is "".
Event Type: Error
Event Source: DNS
Event Category: None
Event ID: 4000
Date: 5/25/2008
Time: 3:38:36 PM
User: N/A
Computer: SERVER
The DNS server was unable to open Active Directory. This DNS server is
configured to obtain and use information from the directory for this zone and
is unable to load the zone without it. Check that the Active Directory is
functioning properly and reload the zone.
Event Type: Error
Event Source: NtFrs
Event Category: None
Event ID: 13568
Date: 5/25/2008
Time: 12:00:04 AM
User: N/A
Computer: SERVER
The File Replication Service has detected that the replica set "DOMAIN
SYSTEM VOLUME (SYSVOL SHARE)" is in JRNL_WRAP_ERROR. Replica set name is
"DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"
Replica root path is : "c:\windows\sysvol\domain"
Replica root volume is : "\\.\C:"
A Replica set hits JRNL_WRAP_ERROR when the record that it is trying to
read from the NTFS USN journal is not found. This can occur because of one
of the following reasons.
[1] Volume "\\.\C:" has been formatted.
[2] The NTFS USN journal on volume "\\.\C:" has been deleted.
[3] The NTFS USN journal on volume "\\.\C:" has been truncated. Chkdsk can
truncate the journal if it finds corrupt entries at the end of the journal.
[4] File Replication Service was not running on this computer for a long
time.
[5] File Replication Service could not keep up with the rate of Disk IO
activity on "\\.\C:".
Setting the "Enable Journal Wrap Automatic Restore" registry parameter to 1
will cause the following recovery steps to be taken to automatically recover
from this error state.
[1] At the first poll, which will occur in 5 minutes, this computer will be
deleted from the replica set. If you do not want to wait 5 minutes, then run
"net stop ntfrs" followed by "net start ntfrs" to restart the File
Replication Service.
[2] At the poll following the deletion this computer will be re-added to
the replica set. The re-addition will trigger a full tree sync for the
replica set.
WARNING: During the recovery process data in the replica tree may be
unavailable. You should reset the registry parameter described above to 0 to
prevent automatic recovery from making the data unexpectedly unavailable if
this error condition occurs again.
To change this registry parameter, run regedit.
Click on Start, Run and type regedit.
Expand HKEY_LOCAL_MACHINE.
"System\CurrentControlSet\Services\NtFrs\Parameters"
Double click on the value name
"Enable Journal Wrap Automatic Restore"
and update the value.
If the value name is not present you may add it with the New->DWORD Value
function under the Edit Menu item. Type the value name exactly as shown above.
There is only 1 single server in the domain. Any help is appreciated.
Regards,
Larry Struckmeyer [SBS-MVP]
2008-05-30 11:00:29 UTC
Permalink
What Cliff said, and also note that your AV should not be scanning the
sysvol folder set, as it will also produce a jrnl_wrap_error. Please check
that, and purchase a good UPS as Cliff suggests.

--
Larry
Post by Cliff Galiher
Your AD database files have become corrupt and they are trying to sync
with some non-existent data. If you have a second windows server in your
domain and it is also a DC then you can force replication...but since you
are posting here, I will assume that your SBS server is your only server.
In that case I strongly recommend performing a backup of your server (in
case my next step kills you) and then restoring the system-state from a
previous backup.
Then go buy a UPS for your server.
I wish I had better news for ya,
-Cliff
Post by Januar
Hi,
Recently I got issue with SBS 2003 R2 Standard server. I noticed this after
there was a power failure. When the server is back there are some errors on
the event logs. After one day the server will start to be very slow and it
looks like hang. I got to restart the server to make it operational again.
Event Type: Error
Event Source: DNS
Event Category: None
Event ID: 4015
Date: 5/25/2008
Time: 1:12:35 AM
User: N/A
Computer: SERVER
The DNS server has encountered a critical error from the Active Directory.
Check that the Active Directory is functioning properly. The extended error
debug information (which may be empty) is "".
Event Type: Error
Event Source: DNS
Event Category: None
Event ID: 4000
Date: 5/25/2008
Time: 3:38:36 PM
User: N/A
Computer: SERVER
The DNS server was unable to open Active Directory. This DNS server is
configured to obtain and use information from the directory for this zone and
is unable to load the zone without it. Check that the Active Directory is
functioning properly and reload the zone.
Event Type: Error
Event Source: NtFrs
Event Category: None
Event ID: 13568
Date: 5/25/2008
Time: 12:00:04 AM
User: N/A
Computer: SERVER
The File Replication Service has detected that the replica set "DOMAIN
SYSTEM VOLUME (SYSVOL SHARE)" is in JRNL_WRAP_ERROR. Replica set name is
"DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"
Replica root path is : "c:\windows\sysvol\domain"
Replica root volume is : "\\.\C:"
A Replica set hits JRNL_WRAP_ERROR when the record that it is trying to
read from the NTFS USN journal is not found. This can occur because of one
of the following reasons.
[1] Volume "\\.\C:" has been formatted.
[2] The NTFS USN journal on volume "\\.\C:" has been deleted.
[3] The NTFS USN journal on volume "\\.\C:" has been truncated. Chkdsk can
truncate the journal if it finds corrupt entries at the end of the journal.
[4] File Replication Service was not running on this computer for a long
time.
[5] File Replication Service could not keep up with the rate of Disk IO
activity on "\\.\C:".
Setting the "Enable Journal Wrap Automatic Restore" registry parameter to 1
will cause the following recovery steps to be taken to automatically recover
from this error state.
[1] At the first poll, which will occur in 5 minutes, this computer will be
deleted from the replica set. If you do not want to wait 5 minutes, then run
"net stop ntfrs" followed by "net start ntfrs" to restart the File
Replication Service.
[2] At the poll following the deletion this computer will be re-added to
the replica set. The re-addition will trigger a full tree sync for the
replica set.
WARNING: During the recovery process data in the replica tree may be
unavailable. You should reset the registry parameter described above to 0 to
prevent automatic recovery from making the data unexpectedly unavailable if
this error condition occurs again.
To change this registry parameter, run regedit.
Click on Start, Run and type regedit.
Expand HKEY_LOCAL_MACHINE.
"System\CurrentControlSet\Services\NtFrs\Parameters"
Double click on the value name
"Enable Journal Wrap Automatic Restore"
and update the value.
If the value name is not present you may add it with the New->DWORD Value
function under the Edit Menu item. Type the value name exactly as shown above.
There is only 1 single server in the domain. Any help is appreciated.
Regards,
Guozhen Wang[MSFT]
2008-05-30 11:14:23 UTC
Permalink
This post might be inappropriate. Click to display it.
Januar
2008-06-05 05:01:00 UTC
Permalink
Hi,
Thank you for response. I found that the HP PMP cause the CPU resources jump
to almost 100%. This may lead to those issues I mentioned. I have disabled
this service and will monitor the issue.

Best regards,
Januar
Post by Guozhen Wang[MSFT]
Hello,
Thank you for your post and thanks for Cliff's great help.
My name is Gary Wang, and it is my pleasure to work with you on this issue!
Please allow me to confirm that my understandings are correct. As I
Your SBS server's performance decreased dramatically after power failure,
and you find there are errors with Event ID 4000/4015 and 13568.
If I have misunderstood your concerns please feel free to let me know.
==============
The power failure may corrupted system, if we unable to resolve this issue
at the end, we may need to reinstall or restore the SBS
And it appears that you are dealing with multiple issues that will require
individual attention to ensure that we are not counter-productive in our
support efforts. A suggestion in this case would be to post these issues
separately so that contributors within this newsgroup who specialize in
certain feature will be able to provide the 'value add' to resolving these
issues.
It is important to us that we provide you with the best support possible
and by breaking down these issues separately we will be able to address
them appropriately and in a timely manner.
Let's focus on the DNS event at first. Those errors occurs when the DNS
server has encountered a critical error from the Active Directory. I would
The following tools or content are available to expedite troubleshooting of
Note: This solution contains a list of troubleshooting steps that may
assist in resolving many symptom-specific issues. Please also continue to
leverage your local resources for additional assistance.
1. DNS Manager may show a Red X over the DNS server with no zones loaded
and restarting DNS Server service does not correct the issue. Please try to
install Windows Server 2003 Service Pack 2 or the hotfix in KB 909249.
The DNS service does not load all its zones on a DNS server that is running
Windows Server 2003
http://support.microsoft.com//kb/909249
Windows Server 2003 Service Pack 2 (32-bit x86)
http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=95ac
1610-c232-4644-b828-c55eec605d55
2. Verify the CrashOnAuditFail registry value is not set to 2 with a value
of REG_NONE in the registry. In this situation only Administrators will be
able to logon to the server. If this value is set to 2 perform the
a) Click Start, select RUN, type Regedit.exe and click OK to open the
registry editor.
b) Locate the CrashOnAuditFail value under
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
c) If the registry Data Type for CrashOnAuditFail is set to REG_NONE and
the Data Value is set to 2, delete the REG_NONE value.
d) Create a REG_DWORD Value called CrashOnAuditFail under
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
e) Set the Data Value to 0 and close the registry editor.
f) Click Start, select RUN, type eventvwr and click OK to open Event Viewer.
g) Right-click the Security log and select Save Log File As and save the
file.
h) Right-click the Security log and select Clear All Events, when prompted
to save the log file select yes.
i) Once the log is saved the Security log will be cleared.
j) Reboot the server for the changes to take effect.
Active Directory-integrated domain name is not displayed in DNS snap-in
with Event ID 4000 and 4013 messages
http://support.microsoft.com//kb/316685
3. Disable antivirus/firewall software on the server as a test.
Note: Please perform a full scan before doing this to ensure that the
server is clean.
4. If possible, increase the server's memory
5. The settings in the properties of the DNS server should be configured as
The DNS server should be set to listen on "only the following IP addresses"
using the IP address in the range of your internal network to service DNS
requests. In cases where the DNS server is multihomed or acts as a RRAS
server there will be additional interfaces that will register in DNS and
create conflicts when the default option to listen on "all IP addresses" is
chosen.
Windows 2003 DNS servers should also have a _msdcs.<forest root zone>
folder. The <forest root zone> should contain a delegation to the
_msdcs.<forest root zone>.All zones should be configured to accept dynamic
updates and preferably secure updates.
DNS servers need to have the "." zone removed from the DNS server's forward
lookup zones before forwarding can be enabled. This setting designates the
Windows Server 2003 DNS server to be a root hint server and is usually
deleted. If you do not delete this setting, you may not be able to perform
external name resolution to the root hint servers on the Internet.
Verify that server can resolve queries for its DNS domain zone, primary DNS
suffix zone (if different) and the _msdcs.<forest root> zone. If not
directly authoritative for those zones, all primary and alternate DNS
Server addresses should [transitively] forward or delegate to other DNS
servers that host these zones.
6. From a command line, type: net share and verify that Sysvol and Netlogon
are both shared. If either folder is not shared examine the errors in the
File Replication Service event log and correct this error.
7. This issue may occur if the DNS server address specified in the TCP/IP
protocol settings of the DNS server logging the error are not correct. This
is typically caused by two or more network adapters being configured on the
server. Only one network adapter can be defined for the DNS Server service.
Look for ghosted network adapters and remove them using the steps outlined
in KB 269155.
http://support.microsoft.com//kb/269155
=========================
Troubleshooting DNS
http://technet2.microsoft.com/WindowsServer/en/library/de2aa69d-1155-4dc9-a6
51-e8362f6a81c81033.mspx?mfr=true
DNS Best Practices
http://technet2.microsoft.com/WindowsServer/en/library/59d7a747-48dc-42cc-89
86-c73db47398a21033.mspx?mfr=true
DNS How To
http://technet2.microsoft.com/WindowsServer/en/library/38dc9461-3e15-4bc6-80
9a-3bda36384ca21033.mspx?mfr=true
825036 Best practices for DNS client settings in Windows 2000 Server and in
Windows Server 2003
http://support.microsoft.com/default.aspx?scid=kb;EN-US;825036
909249 The DNS service does not load all its zones on a DNS server that is
running Windows Server 2003
http://support.microsoft.com/default.aspx?scid=kb;EN-US;909249
269155 Error message when you try to set an IP address on a network adapter
http://support.microsoft.com/default.aspx?scid=kb;EN-US;269155
If we cannot resolve the issue after we perform the above steps, please
Information Need
==============
1. Please help to capture the exact symptom when the error occurs, save it
to *.jpg files and send to me.
a. Download MPSrepot_network from
http://download.microsoft.com/download/b/b/1/bb139fcb-4aac-4fe5-a579-30b0bd9
15706/MPSRPT_NETWORK.EXE
b. Run MPSRPT_NETWORK.exe.
c. The tool will automatically collect the information. This procedure will
take 10~15 minutes.
%SystemRoot%\MPSReports\Network\Reports\Cab\
e. Send the .cab file directly to me.
3. Install windows support tools at
http://www.microsoft.com/downloads/details.aspx?FamilyId=6EC50B78-8BE1-4E81-
B3BE-4E7AC4F0912D&displaylang=en
Use DCDIAG to validate DNS health. Run the following commands on the
dcdiag /test:dns > c:\dcdiagdns.txt
dcdiag /v >c:\dcdiag.txt
Please send the c:\dcdiagdns.tx and c:\dcdiag.txt to me.
I look forward to your reply. Also, if you have any questions or concerns,
please do not hesitate to let me know. I am happy to help. :-)
Thank you for your time and cooperation!
Best regards,
Gary Wang(MSFT)
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.
Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.
For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.
Any input or comments in this thread are highly appreciated.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
| Subject: Re: JRNL_WRAP_ERROR on SBS2003 R2 Standard
| Date: Thu, 29 May 2008 22:23:06 -0600
| Lines: 131
| MIME-Version: 1.0
| Content-Type: text/plain;
| format=flowed;
| charset="utf-8";
| reply-type=original
| Content-Transfer-Encoding: 7bit
| X-Priority: 3
| X-MSMail-Priority: Normal
| X-Newsreader: Microsoft Windows Mail 6.0.6001.18000
| X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6001.18000
| X-MS-CommunityGroup-PostID: {933D34B9-3314-43AB-90A9-39008C987E01}
| X-MS-CommunityGroup-ThreadID: 7A81A026-DDFE-48B6-8B98-ABD1A4AB2D14
| X-MS-CommunityGroup-ParentID: 7A81A026-DDFE-48B6-8B98-ABD1A4AB2D14
| Newsgroups: microsoft.public.windows.server.sbs
| Path: TK2MSFTNGHUB02.phx.gbl
| Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:110046
| NNTP-Posting-Host: TK2MSFTNGHUB02.phx.gbl 127.0.0.1
| X-Tomcat-NG: microsoft.public.windows.server.sbs
|
| Your AD database files have become corrupt and they are trying to sync
with
| some non-existent data. If you have a second windows server in your
domain
| and it is also a DC then you can force replication...but since you are
| posting here, I will assume that your SBS server is your only server. In
| that case I strongly recommend performing a backup of your server (in
case
| my next step kills you) and then restoring the system-state from a
previous
| backup.
|
| Then go buy a UPS for your server.
|
| I wish I had better news for ya,
|
| -Cliff
|
| > Hi,
| > Recently I got issue with SBS 2003 R2 Standard server. I noticed this
| > after
| > there was a power failure. When the server is back there are some
errors
| > on
| > the event logs. After one day the server will start to be very slow and
it
| > looks like hang. I got to restart the server to make it operational
again.
| >
| >
| > Event Type: Error
| > Event Source: DNS
| > Event Category: None
| > Event ID: 4015
| > Date: 5/25/2008
| > Time: 1:12:35 AM
| > User: N/A
| > Computer: SERVER
| > The DNS server has encountered a critical error from the Active
Directory.
| > Check that the Active Directory is functioning properly. The extended
| > error
| > debug information (which may be empty) is "".
| >
| >
| > Event Type: Error
| > Event Source: DNS
| > Event Category: None
Guozhen Wang[MSFT]
2008-06-05 07:41:14 UTC
Permalink
This post might be inappropriate. Click to display it.
Loading...