Microsoft KB Archive/247611

= Groveler service generates event ID 8194 - USN Log Overrun =

Article ID: 247611

Article Last Modified on 4/17/2007

-

APPLIES TO


 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Datacenter Server

-



This article was previously published under Q247611



SYMPTOMS
When using Remote Installation Service (RIS), Windows 2000 images must be stored on an NTFS volume. The Single Instance Storage (SIS) service along with the Groveler service reduce the overhead associated with keeping multiple images on the RIS volume by locating duplicate files and only keeping a single copy of the files on the NTFS volume.

When you start the Groveler service, you may receive the following system event log message:

Event Type:    Warning Event Source:  Groveler Event Category: None Event ID:      8194 Date:          12/15/1999 Time:          7:20:52 PM User:           N/A Computer:       Description:   USN log overrun on partition D:\.



CAUSE
This message usually appears twice the first time the Groveler service is started on a new volume being managed by SIS. This can also occur if the groveler has been running, but is stopped for a period of time, during which the USN journal is filled, and journal events are lost. This causes the USN journal to appear overrun to the Groveler service the next time it is started. Note that in extreme cases this may appear due to the USN journal overrunning while the Groveler service is also running. This would only occur in cases where there is an extreme amount of disk activity, and the USN journal grows at a rate faster than the Groveler can maintain.



RESOLUTION
To work around this issue, the event-ID 8194 message can be ignored when it is related to the Groveler service. In situations where the Groveler service posts this message to the event log, it recreates the Groveler service database, and rescans the volume for duplicate files. This is done "on the fly" with little or no impact to the user.



MORE INFORMATION
The following event message has also been seen immediately after the 8194 event message and may be caused by other SIS volume related problems:

Event Type:    Error Event Source:  Groveler Event Category: None Event ID:      12292 Date:          12/15/1999 Time:          7:20:52 PM User:           N/A Computer:       Description:   The groveler on partition d:\has failed due to a database error.

In this case, you can use the Grovctrl.exe utility to rescan the affected volume by issuing the grovctrl.exe v drive_letter: command.

NOTE: The Grovctrl.exe utility is included on the Windows 2000 Server CD-ROM in the i386 folder and is compressed, but it is not installed during Setup. Use the expand d:\i386\grovctrl.ex_ c:\winnt\system32\grovctrl.exe command to expand it before attempting to use it.

Additional query words: RIS SIS grovel USN JRNL

Keywords: kberrmsg kbprb KB247611

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.