Cluster Service failed to move cluster hive

Microsoft.Windows.6.2.Cluster.Cluster.Service.failed.tomove.cluster.hive (Rule)

Knowledge Base article:

Summary

The cluster configuration database contains essential information for the function of a failover cluster. A copy of the cluster configuration database is maintained on each node. If the quorum configuration for the cluster includes a witness disk, a copy of the cluster configuration database is also maintained on the witness disk. The Cluster service replicates the latest version of the cluster configuration database to all locations where it is stored.

Event Details

Event ID:

1581

Source:

Microsoft-Windows-FailoverClustering

Symbolic Name:

CLUSSVC_UNABLE_TO_MOVE_HIVE_TO_SAFE_FILE

Message: The restore request for the cluster configuration data failed to make a copy of the existing cluster configuration data file (ClusDB). While attempting to preserve the existing configuration, the restore operation was unable to create a copy at location '%1'. This might be expected if the existing configuration data file was corrupt. The restore operation has continued but attempts to revert to the existing cluster configuration may not be possible.Search System Error Codes ( http://go.microsoft.com/fwlink/?LinkId=83027).

Causes

The existing configuration data file was corrupt.

Resolutions

Check for additional events related to file copying

If the Cluster service finds a corrupt instance of the cluster configuration database (ClusDB) on a node, it attempts to save a copy of that database, then restores (rebuilds) the cluster configuration database by using data stored in the cluster. Sometimes the attempt to save the copy of the database does not succeed. However, the restore operation continues.

Check for other failover cluster events that are related to this event. Also check the System or other logs for additional disk or file system events that might indicate a problem with copying files. If you do not currently have Event Viewer open, see "Opening Event Viewer and viewing events related to failover clustering."

To perform the following procedure, you must be a member of the local Administrators group on each clustered server, and the account you use must be a domain account, or you must have been delegated the equivalent authority.

Opening Event Viewer and viewing events related to failover clustering

To open Event Viewer and view events related to failover clustering:

Verify

To perform the following procedure, you must be a member of the local Administrators group on each clustered server, and the account you use must be a domain account, or you must have been delegated the equivalent authority.

To start the Cluster service on a node and confirm that it runs successfully:

Element properties:

TargetMicrosoft.Windows.6.2.Cluster.Monitoring.Service
CategoryAlert
EnabledTrue
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityNormal
RemotableTrue
Alert Message
Cluster Service failed to move cluster hive
{0}

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.6.2.Cluster.EventProvider Default
WA WriteAction Microsoft.Windows.Cluster.GenerateAlertAction.SuppressedByDescription Default

Source Code:

<Rule ID="Microsoft.Windows.6.2.Cluster.Cluster.Service.failed.tomove.cluster.hive" Enabled="true" Target="Clus8Library!Microsoft.Windows.6.2.Cluster.Monitoring.Service" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>Alert</Category>
<DataSources>
<DataSource ID="DS" TypeID="Microsoft.Windows.6.2.Cluster.EventProvider">
<Criteria>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>1581</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>1582</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Criteria>
<LogName>System</LogName>
<PublisherName>Microsoft-Windows-FailoverClustering</PublisherName>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WA" TypeID="ClusLibrary!Microsoft.Windows.Cluster.GenerateAlertAction.SuppressedByDescription">
<Priority>1</Priority>
<Severity>1</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.6.2.Cluster.Cluster.Service.failed.tomove.cluster.hive.AlertMessage"]$</AlertMessageId>
</WriteAction>
</WriteActions>
</Rule>