The cluster service encountered an unexpected problem and will be shut down

Microsoft.Windows.6.2.Cluster.Management.Monitoring.The.cluster.service.encountered.an.unexpected.problem.and.will.be.shut.down (Rule)

Knowledge Base article:

Summary

The cluster service encountered an unexpected problem and will be shut down

Resolutions

There are various software or hardware related causes that can interfere with the running of the Cluster service on a node. Sometimes the Cluster service can restart successfully after it has been interrupted by one of those causes.

Review the event logs for indications of the problem. If you need assistance with your failover cluster, you can contact Microsoft Customer Service and Support. For more information, see http://go.microsoft.com/fwlink/?LinkID=102491

A recommended order for troubleshooting is as follows:

Although a problem might appear to be related to an application, most often, the problem is related to items 1, 2, 3, or 4 in the preceding list. A useful step is to review the system event log and the cluster diagnostic log file for events that happened around the time of the failure.

If you do not currently have Event Viewer open, see 'Opening Event Viewer and viewing events related to failover clustering.' If the event contains an error code that you have not yet looked up, see 'Finding more information about error codes that some event messages contain.'

To perform the following procedures, you must be a member of the local Administrators group on each clustered server, and the account you use must be a domain account, or you must have been delegated the equivalent authority.

To open Event Viewer and view events related to failover clustering:

To find more information about the error codes that some event messages contain:

Element properties:

TargetMicrosoft.Windows.6.2.Cluster.Monitoring.Service
CategoryAlert
EnabledTrue
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
RemotableTrue
Alert Message
The cluster service encountered an unexpected problem and will be shut down
{0}

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.6.2.Cluster.EventProvider Default
WA WriteAction Microsoft.Windows.Cluster.GenerateAlertAction.SuppressedByDescription Default

Source Code:

<Rule ID="Microsoft.Windows.6.2.Cluster.Management.Monitoring.The.cluster.service.encountered.an.unexpected.problem.and.will.be.shut.down" Enabled="true" Target="Clus8Library!Microsoft.Windows.6.2.Cluster.Monitoring.Service" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>Alert</Category>
<DataSources>
<DataSource ID="DS" TypeID="Microsoft.Windows.6.2.Cluster.EventProvider">
<Criteria>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>1556</Value>
</ValueExpression>
</SimpleExpression>
</Criteria>
<LogName>System</LogName>
<PublisherName>Microsoft-Windows-FailoverClustering</PublisherName>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WA" TypeID="ClusLibrary!Microsoft.Windows.Cluster.GenerateAlertAction.SuppressedByDescription">
<Priority>1</Priority>
<Severity>2</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.6.2.Cluster.Management.Monitoring.The.cluster.service.encountered.an.unexpected.problem.and.will.be.shut.down.AlertMessage"]$</AlertMessageId>
</WriteAction>
</WriteActions>
</Rule>