Home
  •  

The remote procedure call (RPC) to the cluster service to bring the resource online failed.

The_remote_procedure_call__RPC__to_the_cluster_service_to_bring_the_resource_online_failed (Rule)

Knowledge Base article:

Summary

The remote procedure call has failed. The event description text should have the following:

Cluster service failed the remote procedure call to start the resource.

This event does not refer to a specific Exchange resource, or Exchange service. The event most commonly refers to the Exchange System Attendant, Information Store, or Microsoft Exchange Routing Engine.

Causes

This event is usually associated with other related events when the System Attendant fails to come online. It might also be a part of other, associated events that appear when other Exchange services fail to come online. There are many reasons for an Exchange resource not to come online. One common reason for the System Attendant resource not to come online is that the System Attendant fails to contact a global catalog server.

Resolutions

The first step is to check all related events in the Application and System logs to determine any associated events which may explain why the resource failed to come online.

In some cases, correcting the root cause of the System Attendant failure to come online has resolved the issue. In other cases, it was undetermined why the System Attendant did not come online. Then, removing and recreating the resource has resolved the issue.

External

For more information about MSExchangeCluster event 1011, see:

Element properties:

TargetMicrosoft.Exchange.ServerRole.2003
CategoryEventCollection
EnabledTrue
Event_ID1011
Event SourceMSExchangeCluster
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityNormal
RemotableTrue
Alert Message
The remote procedure call (RPC) to the cluster service to bring the resource online failed.
{0}
Event LogApplication

Member Modules:

ID Module Type TypeId RunAs 
EventDS DataSource Microsoft.Windows.EventProvider Default
GenerateAlert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="The_remote_procedure_call__RPC__to_the_cluster_service_to_bring_the_resource_online_failed" Enabled="onEssentialMonitoring" Target="Exch2003Core!Microsoft.Exchange.ServerRole.2003" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="EventDS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>.</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>Channel</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Application</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>MSExchangeCluster</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>1011</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertOwner>$Data/PublisherName$</AlertOwner>

      <AlertMessageId>$MPElement[Name="The_remote_procedure_call__RPC__to_the_cluster_service_to_bring_the_resource_online_failed.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue/>

      </Suppression>

    </WriteAction>

  </WriteActions>

</Rule>