1. Event Id 1146 Failover Clustering Windows 2008 R2 Iso
2. Event Id 1146 Failover Clustering Windows 2008 R2 Sp1
3. Event Id 1146 Failover Clustering Windows 2008 R2 End Of Support
4. Windows Server Failover Clustering

This is a quick tutorial on how to a Windows Server 2008 R2 cluster diagnostic debug logging which captures detailed information about the cluster operations. Recently I came across a cluster resource failure but unfortunately the event logs did not have any useful information that could have aided my investigation. I decided to search through the cluster log file but to my surprise there wasn’t any :(. Apparently, with Windows Server 2008 R2 the cluster.log file is not auto-generated. While reading up on the cluster log settings, I came across the Failover Cluster Event Tracing for windows and decided to post some of the things I learned in the process.

Failover Cluster Event Tracing for Windows

The Failover Clustering feature in Windows Server 2008 R2 comes with a diagnostic debug logging which captures detailed information about the cluster operations. The configuration settings for this can be found in the following location Server ManagerDiagnosticsPerformanceData Collector SetsEvent Trace SessionsEventlog-Microsoft-Windows-FailoverClustering-Diagnostic. The cluster event tracing is enabled by default when you enable the cluster feature and start the cluster service

Event ID 1146 — Cluster Service Startup. The Cluster service is the essential software component that controls all aspects of failover cluster operation and manages the cluster configuration database. If the Cluster service fails to start on a failover cluster node, the node cannot function as part of the cluster. Microsoft Windows Server 2008 R2 SP1 - Failover Clusters: Virtual Machine Resource Deadlocked, Event Id 1230. Windows 2008 R2 SP1 Failover Clusters with Hyper-V Virtual Machine resources may unexpected terminate due to a deadlock condition with RPC. The problem occurs when a cluster virtual machine resource does not respond to the. Cluster health detection will attempt to automatically recover by terminating the Resource Hosting Subsystem (RHS) process running this resource. Event ID 1146 The cluster Resource Hosting Subsystem (RHS) stopped unexpectedly. An attempt will be made to restart it. This is usually associated with recovery of a crashed or deadlocked resource.

The Failover clustering diagnostic log files are stored in %WinDir%System32winevtlogs and are in an *.etl extension. There are three *.etl log files, each time a node is rebooted a new ETL file is generated and logging is conducted on the new log file until the server is rebooted again

Below are some useful settings that might come in handy when troubleshooting cluster failures:

– Generate a Windows Server Cluster Log
– Cluster Log default size
– Cluster Log default logging level

Before we begin, I would suggest you run the command “cluster /prop“, this will list the properties of the cluster attributes and their current values

1. Generate a Windows Server Cluster Log

– Log onto one of the cluster nodes -> Open the command prompt As Administrator -> Enter the following command: “cluster log /g“. A cluster.log file will be generated and stored in %windir%ClusterReports directory on all cluster nodes

– Another way to generate the cluster log is by using Powershell only on a Windows Server 2008 R2. Click on StartAdministrative ToolsWindows Powershell Modules

– Wait for the system to load all the Powershell commands

– Command1: “Get-ClusterLog“:- This command creates the cluster log file on each cluster nodes in the cluster reports folder

– Command2: “Get-ClusterLog -Destination“:- This command creates the cluster log files for each cluster nodes and copies all logs to a central location or destination specified in the command. This is useful when you want to view all cluster logs from different nodes from a single place

2. Cluster Log default size

The default failover cluster event tracing log size is 100 MB and the logs are handled in a circular logging scheme. In the event that the cluster.log file does not have the needed information due to the older entries been overwritten, you would need to increase the size of the cluster log (*.etl) to retain more data.

– From windows command prompt: cluster log /Size:X

– From PowerShell: Set-Cluster -Size X

3. Cluster default logging level

The default cluster logging level is 3. Anything higher than 3 will give more information but may have significant impact on the cluster. The table below gives complete overview of the different logging levels and what information can be derived from it. Note:Setting the level to 0 (zero) would disable logging.

[table id=13 /]

– From windows command prompt: Cluster Log /Level:X

– From PowerShell: Set-ClusterLog -Level X

Please enable JavaScript to view the comments powered by Disqus.comments powered by Disqus

Event Severity Level	Event Detail Location
Critical	• Logged to System channel
Error	• Logged to System channel
Warning	• Logged to System channel
Informational	• Logged to Operational channel ■ Found in: Applications and Services LogsMicrosoft WindowsFailoverClustering

Key Points

Event Id 1146 Failover Clustering Windows 2008 R2 Iso

When problems arise in the cluster, use the Event Viewer to view events with a Critical, Error, or Warning severity level.

Additionally, informational level events are logged to the Failover Clustering Operations log, which can be found in the Event Viewer in the Applications and Services LogsMicrosoftWindows folder. Informational-level events are usually common cluster operations, such as cluster nodes leaving and joining the cluster, or resources going offline or coming online.

For more information, see 'Failover Clustering Help: View Events and Logs for a Failover Cluster'

Viewing Events for the Entire Cluster

Key Points

Event Id 1146 Failover Clustering Windows 2008 R2 Sp1

In previous Windows Server versions, event logs were replicated to each node in the cluster. This simplified cluster troubleshooting, because you could review all event logs on a single cluster node. Windows Server 2008 does not replicate the event logs between nodes; however, the Failover Cluster Management snap-in has a Cluster Events option that enables you to view and filter events across all cluster nodes. This feature is helpful in correlating events across cluster nodes.

The Failover Cluster Management snap-in also provides a Recent Cluster Events option that will query all of the Error and Warning events from all of the cluster nodes in the last 24 hours.

You can access additional logs, such as the Debug and Analytic logs, from the Event Viewer. To display these logs, modify the view in the top menu by selecting Show Analytic and Debug Logs.

Event Id 1146 Failover Clustering Windows 2008 R2 End Of Support

For more information, see 'Failover Clustering Help: View Events and Logs for a Failover Cluster'

Windows Server Failover Clustering

Was this article helpful?