Cluster service failed to change the trace log size

Microsoft.Windows.2008.R2.Cluster.Management.Monitoring.Cluster.service.failed.to.change.the.trace.log.size (Rule)

Knowledge Base article:

Özet

You can turn on verbose cluster logging to provide additional detail in logs for troubleshooting. However, a failover cluster can function regardless of whether verbose cluster logging is turned on.

Event Details

Olay Kimliği:

1567

Kaynak:

Microsoft-Windows-FailoverClustering

Symbolic Name:

SERVICE_FAILED_TO_CHANGE_LOG_SIZE

Message: Cluster service failed to change the trace log size. Please verify the ClusterLogSize setting with the 'Get-Cluster | Format-List *' PowerShell cmdlet. Also, use the Performance Monitor snapin to verify the event trace session settings for FailoverClustering.

Çözümlemeler

Check cluster log size settings

The Cluster service either failed to start the cluster log trace session, or failed to change the trace log size. If you do not currently have Event Viewer open, to view the event message, see "Opening Event Viewer and viewing events related to failover clustering." If the event contains an error code that you have not yet looked up, see "Finding more information about error codes that some event messages contain."

To capture detailed logs of events on a node in a failover cluster, see "Using Reliability and Performance Monitor to ensure that Event Trace Sessions are started on a node in a failover cluster." To check the current setting for the cluster log size, see "Using a command to check the setting for the cluster log size."

To perform the following procedures, you must be a member of the local Administrators group on the node in the failover cluster, or you must have been delegated the equivalent authority.

Opening Event Viewer and viewing events related to failover clustering

To open Event Viewer and view events related to failover clustering:

Finding more information about the error codes that some event messages contain

To find more information about the error codes that some event messages contain:

NET HELPMSG errorcode

Using Reliability and Performance Monitor to ensure that Event Trace Sessions are started on a node in a failover cluster

To use Reliability and Performance Monitor to ensure that Event Trace Sessions are started on a node in a failover cluster:

Using a command to check the setting for the cluster log size

To use a command to check the setting for the cluster log size:

CLUSTER /PROP:CLUSTERLOGSIZE

Verify

To perform the following procedure, you must be a member of the local Administrators group on each clustered server, and the account you use must be a domain account, or you must have been delegated the equivalent authority.

To start the Cluster service on a node and confirm that it runs without a cluster log size error:

Element properties:

TargetMicrosoft.Windows.2008.R2.Cluster.Monitoring.Service
CategoryAlert
EnabledTrue
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityNormal
RemotableTrue
Alert Message
Cluster service failed to change the trace log size
{0}

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.2008.Cluster.EventProvider Default
WA WriteAction Microsoft.Windows.Cluster.GenerateAlertAction.SuppressedByDescription Default

Source Code:

<Rule ID="Microsoft.Windows.2008.R2.Cluster.Management.Monitoring.Cluster.service.failed.to.change.the.trace.log.size" Enabled="onEssentialMonitoring" Target="Clus2008Library!Microsoft.Windows.2008.R2.Cluster.Monitoring.Service" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>Alert</Category>
<DataSources>
<DataSource ID="DS" TypeID="Microsoft.Windows.2008.Cluster.EventProvider">
<Criteria>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>1567</Value>
</ValueExpression>
</SimpleExpression>
</Criteria>
<LogName>System</LogName>
<PublisherName>Microsoft-Windows-FailoverClustering</PublisherName>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WA" TypeID="ClusLibrary!Microsoft.Windows.Cluster.GenerateAlertAction.SuppressedByDescription">
<Priority>1</Priority>
<Severity>1</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.2008.R2.Cluster.Management.Monitoring.Cluster.service.failed.to.change.the.trace.log.size.AlertMessage"]$</AlertMessageId>
</WriteAction>
</WriteActions>
</Rule>