Home
  •  

SMB Resume Key Filter Double Failover

Microsoft.Windows.FileServices.Service.SMB.10.0.ResumeKeyFilterDoubleFailover (UnitMonitor)

Monitors the status of Resume Key Filter database load

Knowledge Base article:

Summary

Resume Key detected multiple failovers.

Causes

If multiple failover occurs for a clustered file server in a failover cluster in a relatively short period of time, Resume Key cannot resume the open handles.

Resolutions

: Applications with continuously available handles opened on file shares that has failed over multiple times in a short period of time will have their handles closed. The administrator should investigate why multiple failovers happened. Once the issue has been resolved, the application owner will need to take recovery action to reestablish those handles. This could include restarting virtual machines, reattaching databases or restarting the application

Element properties:

TargetMicrosoft.Windows.FileServices.Service.SMB.10.0.Clustered
Parent MonitorMicrosoft.Windows.FileServices.Service.SMB.10.0.ContinuousAvailability
CategoryAvailabilityHealth
EnabledTrue
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
Alert Auto ResolveTrue
Monitor TypeMicrosoft.Windows.2SingleEventLog2StateMonitorType
RemotableTrue
AccessibilityPublic
Alert Message
Resume Key failed to recover
Resume Key detected multiple failovers and cannot recover.
RunAsDefault

Source Code:

<UnitMonitor ID="Microsoft.Windows.FileServices.Service.SMB.10.0.ResumeKeyFilterDoubleFailover" TypeID="Windows!Microsoft.Windows.2SingleEventLog2StateMonitorType" Accessibility="Public" Target="Microsoft.Windows.FileServices.Service.SMB.10.0.Clustered" ParentMonitorID="Microsoft.Windows.FileServices.Service.SMB.10.0.ContinuousAvailability" Remotable="true">

  <Category>AvailabilityHealth</Category>

  <AlertSettings AlertMessage="Microsoft.Windows.FileServices.Service.SMB.10.0.ResumeKeyFilterDoubleFailover.AlertMessage">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>Error</AlertSeverity>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="ResumeKeyFilterDoubleFailoverFailed" MonitorTypeStateID="FirstEventRaised" HealthState="Error"/>

    <OperationalState ID="ResumeKeyFilterDoubleFailoverOK" MonitorTypeStateID="SecondEventRaised" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <FirstComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstComputerName>

    <FirstLogName>Microsoft-Windows-ResumeKeyFilter/Operational</FirstLogName>

    <FirstExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Microsoft-Windows-ResumeKeyFilter</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">1007</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </FirstExpression>

    <SecondComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondComputerName>

    <SecondLogName>Microsoft-Windows-ResumeKeyFilter/Operational</SecondLogName>

    <SecondExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Microsoft-Windows-ResumeKeyFilter</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">1002</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </SecondExpression>

  </Configuration>

</UnitMonitor>