JSI Tip 2803. The Groveler service issues Event-ID 8194 - USN Log Overrun?

RIS images are stored on an NTFS volume.

To reduce the overhead of storing multiple duplicate instances, the SIS (Single Instance Storage) service, in conjunction with the Groveler service, removes duplicate images.

Starting the Groveler service may produce:

Event Type:     WarningEvent Source:   GrovelerEvent Category: NoneEvent ID:       8194Date:           12/15/1999Time:           7:20:52 PMUser:           N/AComputer:       Description:    USN log overrun on partition .

This message usually is issued twice, the first time that the Groveler service is started on a new volume being managed by SIS. The message can also be issued if the Groveler service has been stopped while the USN jounal is filled, causing loss of journal events. In rare instances, the message can also be caused by filling the USN jounal while the Groveler service is running, if disk activity is extremely high.

When the Groveler service posts event-ID 8194, it recreates its' database and rescans the volume for duplicate files, with little impact on the users.

You can generally ignore the 8194 event, when issued by the Groveler service, except when followed by a Groveler error, such as:

Event Type:     ErrorEvent Source:   GrovelerEvent Category: NoneEvent ID:       12292Date:           12/15/1999Time:           7:20:52 PMUser:           N/AComputer:       Description:    The groveler on partition has failed due to a database error.

This generally indicates that the 8194 event was cause by some other SIS related problem.

There is an uninstalled tool, on the Windows 2000 Server CD-ROM, which you should use to rescan the volume.
To install it, type i386grovctrl.ex_ c:winntsystem32grovctrl.exe

To rescan the affected volume, type grovctrl.exe v