| Event Id | 13567 |
| Source | NtFrs |
| Description | "File Replication Service has detected and suppressed an average of %1 or more file updates every hour for the last %2 hours because the updates did not change the contents of the file. The tracking records in FRS debug logs will have a filename and event time for the suppressed updates. The tracking records have the date and time followed by :T: as their prefix. Updates that do not change the content of the file are suppressed to prevent unnecessary replication traffic. Following are common examples of updates that do not change the contents of the file. [1] Overwriting a file with a copy of the same file. [2] Setting the same ACLs on a file multiple times. [3] Restoring an identical copy of the file over an existing one. Suppression of updates can be disabled by running regedit. Click on Start, Run and type regedit. Expand HKEY_LOCAL_MACHINE, SYSTEM, CurrentControlSet, Services, NtFrs, Parameters, and create or update the value ""Suppress Identical Updates to Files"" to 0 (Default is 1) to force identical updates to replicate." |
| Event Information | "According to Microsoft: CAUSE: FRS was updated in SP3 to detect and suppress duplicate updates. This conserves network bandwidth. Event 13567 is logged to inform the administrator that this suppression has occurred. This event is logged when FRS detects that 15 identical updates were made to FRS replicated files within a one-hour period and this condition has occurred over 3 consecutive hours. The duplicate changes might have occurred on a single file 15 times, or 15 unique files one time each, or any combination between those two. Identical updates are changes to existing files where the MD5 checksum for the last change is identical to the previous change to that same file. Duplicate changes are common when administrators or programs make repetitive changes to FRS replicated files, which may result in excessive replication or backlogs that delay data consistency between replication partners. The above thresholds apply only to event logging. FRS suppression works continuously. FRS suppression does not apply to folders. Therefore, frequent changes to folders may affect FRS replication and staging even when suppression is turned on. RESOLUTION: You can prevent the suppression by modifying the registry. To prevent suppressing duplicate updates: 1. Start Registry Editor (Regedt32.exe). 2. Locate and click the following key in the registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters 3. On the Edit menu, click Add Value, and then add the following registry value: Value name: Suppress Identical Updates to Files Data type: REG_DWORD Radix: Hexadecimal Value data: 0 Note that there are two valid data values for the Suppress Identical Updates to Files registry value: • 1 = Suppression activated (this is the default). Files that have not changed in content or security attributes will not be replicated. • 0 = Suppression deactivated. Files are replicated if they are updated, whether or not t |
| Reference Links | FRS Event 13567 Is Recorded in the File Replication Service Event Log After You Install Service Pack 3 |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.