Cluster service could not write to a file

Microsoft.Windows.6.2.Cluster.Management.Monitoring.Cluster.service.could.not.write.to.a.file (Rule)

Knowledge Base article:

Summary

Cluster service could not write to a file

Resolutions

Ensure that the disk has enough free space. If the disk is full, then create more free space or undo the process that is consuming too much disk space. If the disk has enough free space, the file system may be corrupted. If this appears to be the case, run Chkdsk /f on the disk.

If you do not currently have Event Viewer open, see 'Opening Event Viewer and viewing events related to failover clustering.'

To perform the following procedures, you must be a member of the local Administrators group on each clustered server, and the account you use must be a domain account, or you must have been delegated the equivalent authority.

To open Event Viewer and view events related to failover clustering:

Element properties:

TargetMicrosoft.Windows.6.2.Cluster.Monitoring.Service
CategoryAlert
EnabledTrue
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityNormal
RemotableTrue
Alert Message
Cluster service could not write to a file
{0}

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.6.2.Cluster.EventProvider Default
WA WriteAction Microsoft.Windows.Cluster.GenerateAlertAction.SuppressedByCustom Default

Source Code:

<Rule ID="Microsoft.Windows.6.2.Cluster.Management.Monitoring.Cluster.service.could.not.write.to.a.file" Enabled="onEssentialMonitoring" Target="Clus8Library!Microsoft.Windows.6.2.Cluster.Monitoring.Service" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>Alert</Category>
<DataSources>
<DataSource ID="DS" TypeID="Microsoft.Windows.6.2.Cluster.EventProvider">
<Criteria>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>1080</Value>
</ValueExpression>
</SimpleExpression>
</Criteria>
<LogName>System</LogName>
<PublisherName>Microsoft-Windows-FailoverClustering</PublisherName>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WA" TypeID="ClusLibrary!Microsoft.Windows.Cluster.GenerateAlertAction.SuppressedByCustom">
<Priority>1</Priority>
<Severity>1</Severity>
<SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.6.2.Cluster.Management.Monitoring.Cluster.service.could.not.write.to.a.file.AlertMessage"]$</AlertMessageId>
</WriteAction>
</WriteActions>
</Rule>