Understanding DFSR debug logging (Part 2: Nested Fields, Module ID's)
Published Apr 04 2019 01:58 PM 1,004 Views
Microsoft

First published on TechNet on Mar 24, 2009
Ned here. Part two today covers the nested debug field format and what module ID's mean. If Part 2 makes no sense, you probably haven't read Part 1.

Nested Field Format


When examining the nested (+) entries it is important to understand all of the fields that can be displayed in the debug logs. These fields give detailed information about file and folder replication, especially regarding database entries, USN changes, and RDC data. These are implemented through LogNewLine.

Below is a table describing all of these nested fields and their data output that you will see in the debug logs. All entries marked with an asterisk (*) are Windows Server 2008 only. Otherwise they apply to both Windows Server 2003 R2 as well as 2008. There is also an example of the log entry for each table.

 

File information

(defined in DFSR source code and GetFileAttributes ) (Severity 4)

Field

Description

Data

fid

File ID Record stored in the DFSR database

Unique hex value

usn

The USN ID record in the journal and DFSR database

Unique hex value

uidVisible

Has the UID file record been replicated?

0 or 1

filtered

Is the file filtered by an administrator to prevent replication?

0 or 1

journalWrapped

Is the file in USN journal wrap recovery?

0 or 1

slowRecoverCheck

Is the file being checked after a journal wrap recovery completed?

0 or 1

pendingTombstone

Is the file in the process of being tombstoned in the database?

0 or 1

recUpdateTime

Displays time/date of local changes to file (only on the originating server – on downstream will show garbage)

YYYYMMDD HH:MM:SS.MS GMT

present

Is the file live or tombstoned (deleted)?

0 or 1

nameConflict

Was there a conflict on the file (modified on upstream and downstream servers before replication

0 or 1

attributes

Attributes on the file

Hex value

gvsn

Global Version Sequence Number of the file, used to track changes and server origination

GUID of originating server +Version #

uid

Unique ID of the file, used to identify original file

GUID of modifying server + Version #

parent

Folder containing the file

GUID of originating server + Version #

fence

Authoritative data flag (not used)

N/A

clock

Time of the last change to the file on this server

YYYYMMDD HH:MM:SS.MS

createTime

Time the file was created on the server

YYYYMMDD HH:MM:SS.MS GMT

csId

Replicated Folder

GUID

hash

SHA-1 checksum of the marshaled file,
to include its data stream, alternate data stream, and security

Hex value

similarity

SHA1 checksum information about the RDC similarity data

Hex value

Name

Name of the file

Text string

ghostedHeader*

<reserved for future use>

 

Data*

<reserved for future use>

 

clockDecrementedInDirtyShutdown*

<reserved for future use>

 

 

+    fid 0x100000000094A
+    usn 0x0
+    uidVisible 1
+    filtered 0
+    journalWrapped 0
+    slowRecoverCheck 0
+    pendingTombstone 0
+    internalUpdate 0
+    dirtyShutdownMismatch 0
+    meetInstallUpdate 0
+    meetReanimated 0
+    recUpdateTime 20080318 20:58:37.190 GMT
+    present 1
+    nameConflict 0
+    attributes 0x20
+    ghostedHeader 0
+    data 0
+    gvsn {AF8C06FD-E1B8-4044-8FE1-51A9E30F18AD}-v2353
+    uid {AF8C06FD-E1B8-4044-8FE1-51A9E30F18AD}-v2353
+    parent {5D5D914C-F585-4117-8477-7F8B37B27B01}-v1
+    fence 16010101 00:00:00.000 P
+    clockDecrementedInDirtyShutdown 0
+    clock 20080318 19:28:17.026 GMT (0x1c8892e375afac0)
+    createTime 20080318 17:36:47.960 GMT
+    csId {5D5D914C-F585-4117-8477-7F8B37B27B01}
+    hash 02F98A2C-31F58E81-E8598E22-DA9F8F95
+    similarity 00000000-00000000-00000000-00000000
+    name 0c0df164-715a-4674-bfb2-0a926eed1791

 

USN update Information

(defined in USN_RECORD structure and GetFileAttributes ) (Severity 4)

Field

Description

Data

RecordLength

Size of file record in the USN journal in bytes

Numeric value

MajorVersion

USN journal underlying major version

Always 0x2

MinorVersion

USN journal underlying major version

Always 0x0

FileRefNumber

USN journal internal file reference

Unique Hex value

ParentFileRefNumber

USN journal internal folder parent reference

Hex value

TimeStamp

USN journal timestamp of last change to file

YYYYMMDD HH:MM:SS.MS TZ

Reason

Information about an actual change

 

 

Next up – log scenario format and a sample replicated file.

 

Understanding DFSR debug logging (Part 1: Logging Levels, Log Format, GUID’s)
Understanding DFSR debug logging (Part 2: Nested Fields, Module ID's)
Understanding DFSR debug logging (Part 3: The Log Scenario Format, File Added to Replicated Folder ....
Understanding DFSR debug logging (Part 4: A Very Small File Added to Replicated Folder on Windows S....
Understanding DFSR debug logging (Part 5: File Modified on Windows Server 2003 R2)
Understanding DFSR debug logging (Part 6: Microsoft Office Word 97-2003 File Modified on Windows Se....
Understanding DFSR debug logging (Part 7: Microsoft Office Word 2007 File Modified on Windows Serve....
Understanding DFSR debug logging (Part 8: File Deleted from Windows Server 2003 R2)
Understanding DFSR debug logging (Part 9: File is Renamed on Windows Server 2003 R2)
Understanding DFSR debug logging (Part 10: File Conflicted between two Windows Server 2008)
Understanding DFSR debug logging (Part 11: Directory created on Windows Server 2003 R2)
Understanding DFSR debug logging (Part 12: Domain Controller Bind and Config Polling on Windows Ser....
Understanding DFSR debug logging (part 13: A New Replication Group and Replicated Folder between tw....
Understanding DFSR debug logging (Part 14: A sharing violation due to a file locked upstream betwee....
Understanding DFSR debug logging (Part 15: Pre-Seeded Data Usage during Initial Sync)
Understanding DFSR debug logging (Part 16: File modification with RDC in very granular detail (uses....
Understanding DFSR debug logging (Part 17: Replication failing because of blocked RPC ports (uses d....
Understanding DFSR debug logging (Part 18: LDAP queries failing due to network (uses debug severity....
Understanding DFSR debug logging (Part 19: File Blocked Inbound by a File Screen Filter Driver (use....
Understanding DFSR debug logging (Part 20: Skipped temporary and filtered files (uses debug severit....
Understanding DFSR debug logging (Part 21: File replication performance from throttling (uses debug....

 

- Ned 'Cure for Insomnia' Pyle

 

 

Co-Authors
Version history
Last update:
‎Jun 08 2023 10:20 AM
Updated by: