Groveler Service Generates Event-ID 8194 - USN Log Overrun

ID: Q247611

The information in this article applies to:

Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Server

SYMPTOMS

When using Remote Installation Service (RIS), Windows 2000 images must be stored on an NTFS volume. The Single Instance Storage (SIS) service along with the Groveler service reduce the overhead associated with keeping multiple images on the RIS volume by locating duplicate files and only keeping a single copy of the files on the NTFS volume.

When you start the Groveler service, you may receive the following system event log message:


Event Type:     Warning
Event Source:   Groveler
Event Category: None
Event ID:       8194
Date:           12/15/1999
Time:           7:20:52 PM
User:           N/A
Computer:       <RIS_MACHINE_NAME>
Description:    USN log overrun on partition D:\.

CAUSE

This message usually appears twice the first time the Groveler service is started on a new volume being managed by SIS. This can also occur if the groveler has been running, but is stopped for a period of time, during which the USN journal is filled, and journal events are lost. This causes the USN journal to appear overrun to the Groveler service the next time it is started. Note that in extreme cases this may appear due to the USN journal overrunning while the Groveler service is also running. This would only occur in cases where there is an extreme amount of disk activity, and the USN journal grows at a rate faster than the Groveler can maintain.

RESOLUTION

To work around this issue, the event-ID 8194 message can be ignored when it is related to the Groveler service. In situations where the Groveler service posts this message to the event log, it recreates the Groveler service database, and rescans the volume for duplicate files. This is done "on the fly" with little or no impact to the user.

MORE INFORMATION

The following event message has also been seen immediately after the 8194 event message and may be caused by other SIS volume related problems:


Event Type:     Error
Event Source:   Groveler
Event Category: None
Event ID:       12292
Date:           12/15/1999
Time:           7:20:52 PM
User:           N/A
Computer:       <RIS_MACHINE_NAME>
Description:    The groveler on partition d:\has failed due to a database error.

In this case, you can use the Grovctrl.exe utility to rescan the affected volume by issuing the grovctrl.exe v drive_letter: command.

NOTE: The Grovctrl.exe utility is included on the Windows 2000 Server CD-ROM in the i386 folder and is compressed, but it is not installed during Setup. Use the expand d:\i386\grovctrl.ex_ c:\winnt\system32\grovctrl.exe command to expand it before attempting to use it.

Additional query words: RIS SIS grovel USN JRNL

Keywords : kberrmsg kbtool
Version : WINDOWS:2000
Platform : WINDOWS
Issue type : kbprb