The Cluster service either failed to start the cluster log trace session, or failed to change the trace log size. If you do not currently have Event Viewer open, to view the event message, see "Opening Event Viewer and viewing events related to failover clustering." If the event contains an error code that you have not yet looked up, see "Finding more information about error codes that some event messages contain."
To capture detailed logs of events on a node in a failover cluster, see "Using Reliability and Performance Monitor to ensure that Event Trace Sessions are started on a node in a failover cluster." To check the current setting for the cluster log size, see "Using a command to check the setting for the cluster log size."
To perform the following procedures, you must be a member of the local Administrators group on the node in the failover cluster, or you must have been delegated the equivalent authority.
To open Event Viewer and view events related to failover clustering:
To find more information about the error codes that some event messages contain:
NET HELPMSG errorcode
To use Reliability and Performance Monitor to ensure that Event Trace Sessions are started on a node in a failover cluster:
To use a command to check the setting for the cluster log size:
CLUSTER /PROP:CLUSTERLOGSIZE
Target | Microsoft.Windows.2008.Cluster.Monitoring.Service | ||
Category | Alert | ||
Enabled | True | ||
Alert Generate | True | ||
Alert Severity | Warning | ||
Alert Priority | Normal | ||
Remotable | True | ||
Alert Message |
|
ID | Module Type | TypeId | RunAs |
---|---|---|---|
DS | DataSource | Microsoft.Windows.2008.Cluster.EventProvider | Default |
WA | WriteAction | Microsoft.Windows.Cluster.GenerateAlertAction.SuppressedByDescription | Default |
<Rule ID="Microsoft.Windows.2008.Cluster.Management.Monitoring.Cluster.service.failed.to.change.the.trace.log.size" Enabled="onEssentialMonitoring" Target="Clus2008Library!Microsoft.Windows.2008.Cluster.Monitoring.Service" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>Alert</Category>
<DataSources>
<DataSource ID="DS" TypeID="Microsoft.Windows.2008.Cluster.EventProvider">
<Criteria>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>1567</Value>
</ValueExpression>
</SimpleExpression>
</Criteria>
<LogName>Microsoft-Windows-FailoverClustering/Operational</LogName>
<PublisherName>Microsoft-Windows-FailoverClustering</PublisherName>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WA" TypeID="ClusLibrary!Microsoft.Windows.Cluster.GenerateAlertAction.SuppressedByDescription">
<Priority>1</Priority>
<Severity>1</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.2008.Cluster.Management.Monitoring.Cluster.service.failed.to.change.the.trace.log.size.AlertMessage"]$</AlertMessageId>
</WriteAction>
</WriteActions>
</Rule>