Cluster node has been evicted from the failover cluster

Microsoft.Windows.2008.Cluster.Management.Monitoring.Cluster.node.has.been.evicted.from.the.failover.cluster (Rule)

Knowledge Base article:

Summary

Cluster node has been evicted from the failover cluster

Resolutions

A node was evicted from the cluster. If you are not sure why, review the sequence of logged events before the eviction. If you do not currently have Event Viewer open, see 'Opening Event Viewer and viewing events related to failover clustering.' In Event Viewer, look for the following information:

After correcting a problem on a node, if necessary, restart the Cluster service on the node. For more information, see 'Restarting the Cluster service after correcting a problem on a node,' later in this topic.

To perform the following procedures, you must be a member of the local Administrators group on each clustered server, and the account you use must be a domain account, or you must have been delegated the equivalent authority.

Restarting the Cluster service after correcting a problem on a node

To restart the Cluster service after correcting a problem on a node:

Enabling auditing of a cluster after auditing has been configured in your organization

To enable auditing of a cluster after auditing has been configured in your organization:

Opening Event Viewer and viewing events related to failover clustering

To open Event Viewer and view events related to failover clustering:

Element properties:

TargetMicrosoft.Windows.2008.Cluster.Monitoring.Service
CategoryAlert
EnabledTrue
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityNormal
RemotableTrue
Alert Message
Cluster node has been evicted from the failover cluster
{0}

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.2008.Cluster.EventProvider Default
WA WriteAction Microsoft.Windows.Cluster.GenerateAlertAction.SuppressedByDescription Default

Source Code:

<Rule ID="Microsoft.Windows.2008.Cluster.Management.Monitoring.Cluster.node.has.been.evicted.from.the.failover.cluster" Enabled="true" Target="Clus2008Library!Microsoft.Windows.2008.Cluster.Monitoring.Service" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>Alert</Category>
<DataSources>
<DataSource ID="DS" TypeID="Microsoft.Windows.2008.Cluster.EventProvider">
<Criteria>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>1011</Value>
</ValueExpression>
</SimpleExpression>
</Criteria>
<LogName>System</LogName>
<PublisherName>Microsoft-Windows-FailoverClustering</PublisherName>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WA" TypeID="ClusLibrary!Microsoft.Windows.Cluster.GenerateAlertAction.SuppressedByDescription">
<Priority>1</Priority>
<Severity>1</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.2008.Cluster.Management.Monitoring.Cluster.node.has.been.evicted.from.the.failover.cluster.AlertMessage"]$</AlertMessageId>
</WriteAction>
</WriteActions>
</Rule>