Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. debug
  4. Dfsr*.log
LogRisk: Caution
  • Windows Server

Dfsr*.log C:\Windows\debug\Dfsr*.log

Dfsr*.log: numbered debug logs of the DFS Replication (DFSR) service, hence of SYSVOL replication; older ones are compressed to .gz.

Updated on By AltF4 Formation

What it’s for

The DFS Replication service writes its debug log to %windir%\debug, far more detailed than the “DFS Replication” event log. Read it to understand a replication delay, a conflict or a pending volume, especially on SYSVOL since DFSR replicates it from the 2008 domain functional level. The * in the path is a pattern: files are named Dfsr00001.log, Dfsr00002.log, and so on, the number rising with each new file.

What it contains

The current file is DFSRxxxxx.log; earlier ones are archived as DFSRxxxxx.log.gz. By default DFSR keeps up to 1000 files of at most 200,000 messages, with severity level 4, in %windir%\debug. These are the settings of the DfsrMachineConfig WMI class (maxdebuglogfiles, maxdebuglogmessages, debuglogseverity, debuglogfilepath). Lines carry the time, process ID, emitting component and message, with error or warning markers.

Risks and best practices

  • The default 1000 files take roughly 75 to 100 MB. If you move the folder with debuglogfilepath, it must already exist, otherwise DFSR falls back to %windir%\debug.
  • Setting changes apply without restarting the service.
  • .gz files open with any WinZip-compatible tool; decompress a copy, not the original.
  • When DFSR reports an unexpected shutdown (event 2213) or a controller offline too long (event 4012), keep the logs for that period before they are recycled.

Useful commands

Fenêtre de terminal
# Log files by date
Get-ChildItem "$env:windir\debug\Dfsr*.log*" | Sort-Object LastWriteTime -Descending | Select-Object -First 5 Name, Length, LastWriteTime


# Error lines of the newest file
$f = Get-ChildItem "$env:windir\debug\Dfsr*.log" | Sort-Object LastWriteTime -Descending | Select-Object -First 1
Select-String -Path $f.FullName -Pattern 'ERROR' | Select-Object -Last 30


# Current logging configuration
Get-CimInstance -Namespace root\microsoftdfs -ClassName DfsrMachineConfig | Select-Object DebugLogSeverity, MaxDebugLogFiles, MaxDebugLogMessages, DebugLogFilePath
Fenêtre de terminal
:: As administrator: raise the severity (wmic may be missing on recent versions)
wmic /namespace:\\root\microsoftdfs path dfsrmachineconfig set debuglogseverity=5


:: Show a member's configuration
dfsrdiag DumpMachineCfg /Mem:DC01

Format

Text files DFSRxxxxx.log, archived as .log.gz (WinZip-compatible compression) once full.

Rotation and archiving

Automatic rotation by message count (200,000 per file by default) and file count (1000 by default), the oldest being deleted. To keep a given period, copy the relevant files before they are replaced.

How to read it

Identify the file for the period with LastWriteTime, then look for error lines and go back up to the context: replication member, replicated folder, connection. Cross-check with the “DFS Replication” event log (2213, 4012, and 4604 for the end of an initial SYSVOL sync) and with dfsrdiag backlog.

Report a mistake