Understanding DFSR debug logging (Part 2: Nested Fields, Module ID's)
Ned here. Part two today covers the nested debug field format and what module ID's mean. If Part 2 makes no sense, you probably haven't read Part 1.
Nested Field Format
When examining the nested (+) entries it is important to understand all of the fields that can be displayed in the debug logs. These fields give detailed information about file and folder replication, especially regarding database entries, USN changes, and RDC data. These are implemented through LogNewLine.
Below is a table describing all of these nested fields and their data output that you will see in the debug logs. All entries marked with an asterisk (*) are Windows Server 2008 only. Otherwise they apply to both Windows Server 2003 R2 as well as 2008. There is also an example of the log entry for each table.
File information(defined in DFSR source code and GetFileAttributes) (Severity 4) | ||
| Field | Description | Data |
| fid | File ID Record stored in the DFSR database | Unique hex value |
| usn | The USN ID record in the journal and DFSR database | Unique hex value |
| uidVisible | Has the UID file record been replicated? | 0 or 1 |
| filtered | Is the file filtered by an administrator to prevent replication? | 0 or 1 |
| journalWrapped | Is the file in USN journal wrap recovery? | 0 or 1 |
| slowRecoverCheck | Is the file being checked after a journal wrap recovery completed? | 0 or 1 |
| pendingTombstone | Is the file in the process of being tombstoned in the database? | 0 or 1 |
| recUpdateTime | Displays time/date of local changes to file (only on the originating server – on downstream will show garbage) | YYYYMMDD HH:MM:SS.MS GMT |
| present | Is the file live or tombstoned (deleted)? | 0 or 1 |
| nameConflict | Was there a conflict on the file (modified on upstream and downstream servers before replication | 0 or 1 |
| attributes | Attributes on the file | Hex value |
| gvsn | Global Version Sequence Number of the file, used to track changes and server origination | GUID of originating server +Version # |
| uid | Unique ID of the file, used to identify original file | GUID of modifying server + Version # |
| parent | Folder containing the file | GUID of originating server + Version # |
| fence | Authoritative data flag (not used) | N/A |
| clock | Time of the last change to the file on this server | YYYYMMDD HH:MM:SS.MS |
| createTime | Time the file was created on the server | YYYYMMDD HH:MM:SS.MS GMT |
| csId | Replicated Folder | GUID |
| hash | SHA-1 checksum of the marshaled file,to include its data stream, alternate data stream, and security | Hex value |
| similarity | SHA1 checksum information about the RDC similarity data | Hex value |
| Name | Name of the file | Text string |
| ghostedHeader* | <reserved for future use> | |
| Data* | <reserved for future use> | |
| clockDecrementedInDirtyShutdown* | <reserved for future use> | |
+ fid 0x100000000094A
+ usn 0x0
+ uidVisible 1
+ filtered 0
+ journalWrapped 0
+ slowRecoverCheck 0
+ pendingTombstone 0
+ internalUpdate 0
+ dirtyShutdownMismatch 0
+ meetInstallUpdate 0
+ meetReanimated 0
+ recUpdateTime 20080318 20:58:37.190 GMT
+ present 1
+ nameConflict 0
+ attributes 0x20
+ ghostedHeader 0
+ data 0
+ gvsn {AF8C06FD-E1B8-4044-8FE1-51A9E30F18AD}-v2353
+ uid {AF8C06FD-E1B8-4044-8FE1-51A9E30F18AD}-v2353
+ parent {5D5D914C-F585-4117-8477-7F8B37B27B01}-v1
+ fence 16010101 00:00:00.000 P
+ clockDecrementedInDirtyShutdown 0
+ clock 20080318 19:28:17.026 GMT (0x1c8892e375afac0)
+ createTime 20080318 17:36:47.960 GMT
+ csId {5D5D914C-F585-4117-8477-7F8B37B27B01}
+ hash 02F98A2C-31F58E81-E8598E22-DA9F8F95
+ similarity 00000000-00000000-00000000-00000000
+ name 0c0df164-715a-4674-bfb2-0a926eed1791
USN update Information(defined in USN_RECORD structure and GetFileAttributes) (Severity 4) | ||
| Field | Description | Data |
| RecordLength | Size of file record in the USN journal in bytes | Numeric value |
| MajorVersion | USN journal underlying major version | Always 0x2 |
| MinorVersion | USN journal underlying major version | Always 0x0 |
| FileRefNumber | USN journal internal file reference | Unique Hex value |
| ParentFileRefNumber | USN journal internal folder parent reference | Hex value |
| TimeStamp | USN journal timestamp of last change to file | YYYYMMDD HH:MM:SS.MS TZ |
| Reason | Information about an actual change | |