Cluster service suffered an unexpected fatal error

Microsoft.Windows.10.0.Cluster.Management.Monitoring.Cluster.service.suffered.an.unexpected.fatal.error (Rule)

Knowledge Base article:

Summary

Cluster service suffered an unexpected fatal error

Resolutions

There are various software or hardware related causes that can prevent the Cluster service from starting on a node. Sometimes the Cluster service can restart successfully after it has been interrupted by one of those causes.

Review the event logs for indications of the problem. A recommended order for troubleshooting is as follows:

Although a problem might appear to be related to an application, most often, the problem is related to items 1, 2, 3, or 4 in the preceding list. A useful step is to review the system event log and the cluster diagnostic log file for events that happened around the time of the failure.

If you do not currently have Event Viewer open, see 'Opening Event Viewer and viewing events related to failover clustering.' If the event contains an error code that you have not yet looked up, see 'Finding more information about error codes that some event messages contain.'

To perform the following procedures, you must be a member of the local Administrators group on each clustered server, and the account you use must be a domain account, or you must have been delegated the equivalent authority.

To open Event Viewer and view events related to failover clustering:

To find more information about the error codes that some event messages contain:

Element properties:

TargetMicrosoft.Windows.10.0.Cluster.Monitoring.Service
CategoryAlert
EnabledTrue
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
RemotableTrue
Alert Message
Cluster service suffered an unexpected fatal error
{0}

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.10.0.Cluster.EventProvider Default
WA WriteAction Microsoft.Windows.Cluster.GenerateAlertAction.SuppressedByDescription Default

Source Code:

<Rule ID="Microsoft.Windows.10.0.Cluster.Management.Monitoring.Cluster.service.suffered.an.unexpected.fatal.error" Enabled="true" Target="Clus8Library!Microsoft.Windows.10.0.Cluster.Monitoring.Service" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>Alert</Category>
<DataSources>
<DataSource ID="DS" TypeID="Microsoft.Windows.10.0.Cluster.EventProvider">
<Criteria>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>1000</Value>
</ValueExpression>
</SimpleExpression>
</Criteria>
<LogName>System</LogName>
<PublisherName>Microsoft-Windows-FailoverClustering</PublisherName>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WA" TypeID="ClusLibrary!Microsoft.Windows.Cluster.GenerateAlertAction.SuppressedByDescription">
<Priority>1</Priority>
<Severity>2</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.10.0.Cluster.Management.Monitoring.Cluster.service.suffered.an.unexpected.fatal.error.AlertMessage"]$</AlertMessageId>
</WriteAction>
</WriteActions>
</Rule>