AD Replication report

Ankit_TSS

How to get Error Message and Event ID for AD Replication report

jeremymayfield

The AD Replication report you're referring to in SolarWinds (likely in Server & Application Monitor (SAM) under Reports > All Reports, or a custom report based on the Active Directory Replication template / AppInsight for Active Directory) typically shows high-level replication status (e.g., successes/failures per naming context, partner DC, last sync time, etc.) pulled from tools like repadmin /showrepl or NTDS performance counters. By default, it does not include detailed Error Message text or Event ID columns — those come from Windows Event Logs (Directory Service log), which are monitored separately via component monitors or AppInsight.

This exact question was posted on THWACK (Dec 2025 thread: "AD Replication report" asking "How to get Error Message and Event ID for AD Replication report"), suggesting it's a common pain point with no built-in one-click solution in standard reports.

Why Error Messages / Event IDs Aren't Directly in the AD Replication Report

• The core AD Replication monitor (e.g., via SAM template or AppInsight) focuses on replication metrics (success/fail counts, latency, partner details).
• Failed Replication Events (from Directory Service log) are counted in AppInsight for Active Directory components like:
  • "Failed Replication Event" (counts events indicating replication failed, with reason in message text).
  • Other related: "Replication Duplicate Object found event", "Replication Link GUID mismatch event", etc.
• But the report view aggregates these as numbers/stats, not drilling into raw Event ID + full message text.

How to Get Error Message and Event ID

Use these approaches (pick based on your needs):

1. Best: Use AppInsight for Active Directory + Event Log Drill-Down (No Custom Report Needed)
   • Assign AppInsight for Active Directory template to your Domain Controllers (Settings > SAM Settings > Manage Templates > search "AppInsight for Active Directory" > Assign to nodes).
   • Go to a DC node details page > Scroll to AppInsight > Replication section (or NTDS / Directory Service components).
   • Look for components like "Failed Replication Event" or "Replication Details".
   • Click the component > View Details or Recent Events (if available) → this often shows Event ID, timestamp, and full error message from the log.
   • Alternative: Use Real-Time Event Viewer (under Node Details > Management > Real-Time Event Viewer) > Filter to Directory Service log > Search for recent errors (common AD rep IDs: 1311, 1388, 1925, 2042, 4013, etc. — see Microsoft docs for meanings).
2. Create a Custom Report with Event Log Data
   • Reports > Manage Reports > Duplicate an existing AD-related report (e.g., "Active Directory Replication Summary") or Create New Report.
   • Add widgets:
     • Custom Table or Custom Query widget using SWQL to pull from event logs.
   • SELECT e.EventID AS Event_ID, e.Message AS Error_Message, e.DateTime AS Event_Time, n.Caption AS Domain_Controller, e.Source AS Event_Source, e.LogType AS LogFROM Orion.Events eJOIN Orion.Nodes n ON n.NodeID = e.NodeIDWHERE e.LogType = 'Directory Service' AND e.EventType = 1 -- Errors only (1=Error, 2=Warning) AND (e.Message LIKE '%replication%' OR e.EventID IN (1311,1388,1925,1988,2042,4013,8453)) AND e.DateTime > ADDHOUR(-24, GETDATE()) -- Last 24 hours; adjust as neededORDER BY e.DateTime DESC
     • This pulls Event ID, full Message (error details), time, DC name.
     • Customize filters (e.g., specific Event IDs from Microsoft AD troubleshooting list).
   • Add this as a table resource in your report → format columns (e.g., make Message wider for full text).
   • Save and schedule if needed.
3. Windows Event Log Monitor Components (For Proactive Alerting + Details)
   • Edit/create a SAM template with Windows Event Log Monitor components.
   • Configure for Directory Service log:
     • Event Sources: Directory Service
     • Event Types: Error
     • Match Specific Event IDs (comma-separated, e.g., 1311,1388,1925,2042)
     • Or use "Find all IDs" + keyword search in message for "replication failed".
   • Statistic/Message outputs can capture details; use in alerts/reports.
   • Then report on those component stats (e.g., count of errors >0 triggers details view).
4. Other Options
   • Alerts: Set up an alert on AppInsight "Failed Replication Event" component > Statistic > 0 (Critical if >0) → alert action emails include Event details or link to node events.
   • repadmin Manual Check: For quick troubleshooting, RDP to DC > run repadmin /showrepl /csv or repadmin /replsummary → parse errors manually (Event IDs often logged alongside).
   • If using AppInsight, check the "Replication Duplicate Object found event" or similar counters — drill-down may show messages.

This gets you the Event ID + full Error Message reliably. The standard AD Replication report stays high-level, so combining with event log queries/drill-down is the way most admins handle detailed diagnostics.