Home
  •  

Volume flush-and-hold IOCTL was detected on clustered shared volume

Microsoft.Windows.2008.R2.Cluster.Volume.flush.and.hold.IOCTL.was.detected.on.clustered.shared.volume (Rule)

Knowledge Base article:

Summary

Because of the design of Cluster Shared Volumes, backup applications for these volumes must meet specific requirements for compatibility. The Cluster Shared Volumes feature allows volumes in cluster storage to be accessed by all nodes of a failover cluster. This makes it possible for virtual machines to use volumes on the same LUN (disk) while still being able to fail over (or move from node to node) independently of one another.

Event Details

Event ID:

1584

Source:

Microsoft-Windows-FailoverClustering

Symbolic Name:

SHARED_VOLUME_NOT_READY_FOR_SNAPSHOT

Message: A backup application initiated a VSS snapshot on Cluster Shared Volume '%1' ('%3') without properly preparing the volume for snapshot. This snapshot may be invalid and the backup may not be usable for restore operations. Please contact your backup application vendor to verify compatibility with Cluster Shared Volumes.

Resolutions

Confirm Backup Compatibility with CSV

There appears to be a problem with the way that a backup application is performing a backup on Cluster Shared Volumes (CSV). Review the following:

Verify

Confirm that the backup application can back up and restore Cluster Shared Volumes correctly. After backing up and restoring, check the System and Application event logs, and any specific event logs for the backup application, confirming that there are no errors related to backing up and restoring Cluster Shared Volumes.

Element properties:

TargetMicrosoft.Windows.2008.R2.Cluster.Monitoring.Service
CategoryAlert
EnabledTrue
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
RemotableTrue
Alert Message
Volume flush-and-hold IOCTL was detected on clustered shared volume
{0}

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.2008.Cluster.EventProvider Default
WA WriteAction Microsoft.Windows.Cluster.GenerateAlertAction.SuppressedByDescription Default

Source Code:

<Rule ID="Microsoft.Windows.2008.R2.Cluster.Volume.flush.and.hold.IOCTL.was.detected.on.clustered.shared.volume" Enabled="true" Target="Clus2008Library!Microsoft.Windows.2008.R2.Cluster.Monitoring.Service" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>Alert</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Microsoft.Windows.2008.Cluster.EventProvider">

      <Criteria>

        <SimpleExpression>

          <ValueExpression>

            <XPathQuery>EventDisplayNumber</XPathQuery>

          </ValueExpression>

          <Operator>Equal</Operator>

          <ValueExpression>

            <Value>1584</Value>

          </ValueExpression>

        </SimpleExpression>

      </Criteria>

      <LogName>System</LogName>

      <PublisherName>Microsoft-Windows-FailoverClustering</PublisherName>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WA" TypeID="ClusLibrary!Microsoft.Windows.Cluster.GenerateAlertAction.SuppressedByDescription">

      <Priority>1</Priority>

      <Severity>2</Severity>

      <AlertMessageId>$MPElement[Name="Microsoft.Windows.2008.R2.Cluster.Volume.flush.and.hold.IOCTL.was.detected.on.clustered.shared.volume.AlertMessage"]$</AlertMessageId>

    </WriteAction>

  </WriteActions>

</Rule>