Cluster Service moved previously existing files in newly-created shared volume directory to new location

Microsoft.Windows.6.2.Cluster.Cluster.Service.moved.previously.existing.files.in.newly.created.shared.volume.directory.to.new.location (Rule)

Knowledge Base article:

Summary

In a failover cluster, virtual machines can use Cluster Shared Volumes that are on the same LUN (disk), while still being able to fail over (or move from node to node) independently of one another. Virtual machines can use a Cluster Shared Volume only when communication between the cluster nodes and the volume is functioning correctly, including network connectivity, access, drivers, and other factors.

Event Details

Event ID:

5124

Source:

Microsoft-Windows-FailoverClustering

Symbolic Name:

DCM_EVENT_ROOT_RENAME_SUCCESS

Message: Cluster Shared Volumes root directory '%1' already exists. The directory '%1' was renamed to '%2'. Please verify that applications accessing data in this location have been updated as necessary.Search System Error Codes ( http://go.microsoft.com/fwlink/?LinkId=83027).

Causes

This might be expected if the existing configuration data file was corrupt.

Resolutions

CSV - Check path for CSV folder

When Cluster Shared Volumes is enabled, a folder is created on each failover cluster node, using the following name:

[systemdrive]\[ClusterStorage]

Where [systemdrive] is the drive letter of the boot disk on a local node. An example of the folder path would be C:\ClusterStorage.

If a folder with the drive letter and name exists on any node, that folder will be renamed so that [systemdrive]\ClusterStorage can be created for Cluster Shared Volumes.

If an existing folder was renamed, applications might need to be reconfigured to the appropriate path, and data might need to be copied to the appropriate folder. Also, users might need to be notified of the change.

If you do not currently have Event Viewer open, see "To open Event Viewer and view events related to failover clustering."

To perform the following procedure, you must be a member of the local Administrators group on each clustered server, and the account you use must be a domain account, or you must have been delegated the equivalent authority.

To open Event Viewer and view events related to failover clustering:

Verify

Confirm that the Cluster Shared Volume can come online. If there have been recent problems with writing to the volume, it can be appropriate to monitor event logs and monitor the function of the corresponding clustered virtual machine, to confirm that the problems have been resolved.

To perform the following procedures, you must be a member of the local Administrators group on each clustered server, and the account you use must be a domain account, or you must have been delegated the equivalent authority.

Confirming that a Cluster Shared Volume can come online

To confirm that a Cluster Shared Volume can come online:

Using a Windows PowerShell command to check the status of a resource in a failover cluster

To use a Windows PowerShell command to check the status of a resource in a failover cluster:

Get-ClusterSharedVolume

If you run the preceding command without specifying a resource name, status is displayed for all Cluster Shared Volumes in the cluster.

To find more information about the error codes that some event messages contain:

Search System Error Codes ( http://go.microsoft.com/fwlink/?LinkId=83027).

Element properties:

TargetMicrosoft.Windows.6.2.Cluster.Monitoring.Service
CategoryAlert
EnabledTrue
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityNormal
RemotableTrue
Alert Message
Cluster Service moved previously existing files in newly-created shared volume directory to new location
{0}

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.6.2.Cluster.EventProvider Default
WA WriteAction Microsoft.Windows.Cluster.GenerateAlertAction.SuppressedByDescription Default

Source Code:

<Rule ID="Microsoft.Windows.6.2.Cluster.Cluster.Service.moved.previously.existing.files.in.newly.created.shared.volume.directory.to.new.location" Enabled="onEssentialMonitoring" Target="Clus8Library!Microsoft.Windows.6.2.Cluster.Monitoring.Service" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>Alert</Category>
<DataSources>
<DataSource ID="DS" TypeID="Microsoft.Windows.6.2.Cluster.EventProvider">
<Criteria>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>5124</Value>
</ValueExpression>
</SimpleExpression>
</Criteria>
<LogName>System</LogName>
<PublisherName>Microsoft-Windows-FailoverClustering</PublisherName>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WA" TypeID="ClusLibrary!Microsoft.Windows.Cluster.GenerateAlertAction.SuppressedByDescription">
<Priority>1</Priority>
<Severity>1</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.6.2.Cluster.Cluster.Service.moved.previously.existing.files.in.newly.created.shared.volume.directory.to.new.location.AlertMessage"]$</AlertMessageId>
</WriteAction>
</WriteActions>
</Rule>