Filter driver(s) are preventing direct I/O on Cluster Shared Volume

Microsoft.Windows.2008.R2.Cluster.Filter.drivers.are.preventing.direct.IO.on.Cluster.Shared.Volume (Rule)

Knowledge Base article:

Souhrn

In a failover cluster, virtual machines can use Cluster Shared Volumes that are on the same LUN (disk), while still being able to fail over (or move from node to node) independently of one another. Virtual machines can use a Cluster Shared Volume only when communication between the cluster nodes and the volume is functioning correctly, including network connectivity, access, drivers, and other factors.

Event Details

ID události:

5125

Zdroj:

Microsoft-Windows-FailoverClustering

Symbolic Name:

DCM_UNSAFE_FILTERS_FOUND

Message: Cluster Shared Volume '%1' ('%3') has identified one or more active filter drivers on this device stack that could interfere with CSV operations. I/O access will be redirected to the storage device over the network through another Cluster node. This may result in degraded performance. Please contact the filter driver vendor to verify interoperability with Cluster Shared Volumes. %n%nActive filter drivers found:%n%2

Řešení

CSV - Confirm filter driver

If you do not currently have Event Viewer open, to view the event message, see "To open Event Viewer and view events related to failover clustering." View the event message to see if the name of a filter driver is displayed. Review any software or drivers that relate to managing or working with your storage devices. Contact the vendors of the software or drivers to confirm that they are tested and compatible with Cluster Shared Volumes.

To perform the following procedure, you must be a member of the local Administrators group on the node in the failover cluster, or you must have been delegated the equivalent authority.

To open Event Viewer and view events related to failover clustering:

Verify

Confirm that the Cluster Shared Volume can come online. If there have been recent problems with writing to the volume, it can be appropriate to monitor event logs and monitor the function of the corresponding clustered virtual machine, to confirm that the problems have been resolved.

To perform the following procedures, you must be a member of the local Administrators group on each clustered server, and the account you use must be a domain account, or you must have been delegated the equivalent authority.

Confirming that a Cluster Shared Volume can come online

To confirm that a Cluster Shared Volume can come online:

Using a Windows PowerShell command to check the status of a resource in a failover cluster

To use a Windows PowerShell command to check the status of a resource in a failover cluster:

Get-ClusterSharedVolume

If you run the preceding command without specifying a resource name, status is displayed for all Cluster Shared Volumes in the cluster.

Element properties:

TargetMicrosoft.Windows.2008.R2.Cluster.Monitoring.Service
CategoryAlert
EnabledTrue
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityNormal
RemotableTrue
Alert Message
Filter driver(s) are preventing direct I/O on Cluster Shared Volume
{0}

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.2008.Cluster.EventProvider Default
WA WriteAction Microsoft.Windows.Cluster.GenerateAlertAction.SuppressedByDescription Default

Source Code:

<Rule ID="Microsoft.Windows.2008.R2.Cluster.Filter.drivers.are.preventing.direct.IO.on.Cluster.Shared.Volume" Enabled="onEssentialMonitoring" Target="Clus2008Library!Microsoft.Windows.2008.R2.Cluster.Monitoring.Service" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>Alert</Category>
<DataSources>
<DataSource ID="DS" TypeID="Microsoft.Windows.2008.Cluster.EventProvider">
<Criteria>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>5125</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>5126</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Criteria>
<LogName>System</LogName>
<PublisherName>Microsoft-Windows-FailoverClustering</PublisherName>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WA" TypeID="ClusLibrary!Microsoft.Windows.Cluster.GenerateAlertAction.SuppressedByDescription">
<Priority>1</Priority>
<Severity>1</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.2008.R2.Cluster.Filter.drivers.are.preventing.direct.IO.on.Cluster.Shared.Volume.AlertMessage"]$</AlertMessageId>
</WriteAction>
</WriteActions>
</Rule>