Ownership of cluster disk has been unexpectedly lost

Microsoft.Windows.2008.Cluster.Management.Monitoring.Ownership.of.cluster.disk.has.been.unexpectedly.lost (Rule)

Knowledge Base article:

Check the condition of the storage. For more information, see "Gathering information about the condition and configuration of a disk in clustered storage." If you do not currently have Event Viewer open, see "Opening Event Viewer and viewing events related to failover clustering."

To perform the following procedures, you must be a member of the local Administrators group on each clustered server, and the account you use must be a domain account, or you must have been delegated the equivalent authority.

Gathering information about the condition and configuration of a disk in clustered storage

To gather information about the condition and configuration of a disk in clustered storage:

  1. Scan appropriate event logs for errors that are related to the disk.
  2. Review information available in the interface for the storage and if needed, contact the vendor for information about the storage.
  3. To open the failover cluster snap-in, click Start, click Administrative Tools, and then click Failover Cluster Management. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
  4. In the Failover Cluster Management snap-in, in the console tree, make sure Failover Cluster Management is selected and then, under Management, click Validate a Configuration.
  5. Follow the instructions in the wizard to specify the cluster you want to test.
  6. On the Testing Options page, select Run only tests I select.
  7. On the Test Selection page, clear the check boxes for Network and System Configuration. This leaves only the tests for Storage and Inventory. You can run all these tests, or you can select only the specific tests that appear relevant to your situation.

    Important   If a clustered service or application is using a disk when you start the wizard, the wizard will prompt you about whether to take that clustered service or application offline for the purposes of testing. If you choose to take a clustered service or application offline, it will remain offline until the tests finish.

  8. Follow the instructions in the wizard to run the tests.
  9. On the Summary page, click View Report.

Opening Event Viewer and viewing events related to failover clustering

To open Event Viewer and view events related to failover clustering:

  1. If Server Manager is not already open, click Start, click Administrative Tools, and then click Server Manager. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
  2. In the console tree, expand Diagnostics, expand Event Viewer, expand Windows Logs, and then click System.
  3. To filter the events so that only events with a Source of FailoverClustering are shown, in the Actions pane, click Filter Current Log. On the Filter tab, in the Event sources box, select FailoverClustering. Select other options as appropriate, and then click OK.
  4. To sort the displayed events by date and time, in the center pane, click the Date and Time column heading.

Element properties:

TargetMicrosoft.Windows.2008.Cluster.Monitoring.Service
CategoryAlert
EnabledTrue
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityNormal
RemotableTrue
Alert Message
Ownership of cluster disk has been unexpectedly lost
{0}

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.2008.Cluster.EventProvider Default
WA WriteAction Microsoft.Windows.Cluster.GenerateAlertAction.SuppressedByDescription Default

Source Code:

<Rule ID="Microsoft.Windows.2008.Cluster.Management.Monitoring.Ownership.of.cluster.disk.has.been.unexpectedly.lost" Enabled="onEssentialMonitoring" Target="Clus2008Library!Microsoft.Windows.2008.Cluster.Monitoring.Service" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>Alert</Category>
<DataSources>
<DataSource ID="DS" TypeID="Microsoft.Windows.2008.Cluster.EventProvider">
<Criteria>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>1038</Value>
</ValueExpression>
</SimpleExpression>
</Criteria>
<LogName>System</LogName>
<PublisherName>Microsoft-Windows-FailoverClustering</PublisherName>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WA" TypeID="ClusLibrary!Microsoft.Windows.Cluster.GenerateAlertAction.SuppressedByDescription">
<Priority>1</Priority>
<Severity>1</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.2008.Cluster.Management.Monitoring.Ownership.of.cluster.disk.has.been.unexpectedly.lost.AlertMessage"]$</AlertMessageId>
</WriteAction>
</WriteActions>
</Rule>