Event ID list for Clusters

I am looking for a list of event id's from the ClusSvc as we are streamlining
our monitoring for clusters and I would like to ensure that we capture all
the necessary events.

Can anyone help?

Thanks in advance.

You can start here -
http://www.microsoft.com/technet/arc....mspx?mfr=true

Chuck Timon, Jr.
Microsoft Corporation
Longhorn Readiness Team
This posting is provided "AS IS" with no warranties, and confers no rights.

"Mark Bradley" <Mark Bradley@discussions.microsoft.com> wrote in message
news:A6561BB9-6BA4-40AB-9381-A6C6DEACD50C@microsoft.com...
>I am looking for a list of event id's from the ClusSvc as we are
>streamlining
> our monitoring for clusters and I would like to ensure that we capture all
> the necessary events.
>
> Can anyone help?
>
> Thanks in advance.

Thanks Chuck,

That will be a great help.

"Chuck Timon [Microsoft]" wrote:

> You can start here -
> http://www.microsoft.com/technet/arc....mspx?mfr=true
>
> Chuck Timon, Jr.
> Microsoft Corporation
> Longhorn Readiness Team
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
> "Mark Bradley" <Mark Bradley@discussions.microsoft.com> wrote in message
> news:A6561BB9-6BA4-40AB-9381-A6C6DEACD50C@microsoft.com...
> >I am looking for a list of event id's from the ClusSvc as we are
> >streamlining
> > our monitoring for clusters and I would like to ensure that we capture all
> > the necessary events.
> >
> > Can anyone help?
> >
> > Thanks in advance.
>
>

Mark,

go here http://www.evtcatalog.com

then fill in the source (ClusSvc) and search... it will give you a list of
eventID's for cluster
This list not fully complete though, but it might get you started, see below
for an extract.

rgds,
Edwin.



Event Id: 1000 Source: ClusSvc
Microsoft Clustering Service suffered an unexpected fatal error at line
<line> of source module <source path>. The error code was <error code>.



Event Id: 1002 Source: ClusSvc
Microsoft Cluster Server handled an unexpected error at line 528 of source
module G:\Nt\Private\Cluster\Resmon\Rmapi.c. The error code was 5007.



Event Id: 1006 Source: ClusSvc
Microsoft Cluster Server was halted because of a cluster membership or
communications error. The error code was 4.



Event Id: 1007 Source: ClusSvc
A new node, "ComputerName", has been added to the cluster.



Event Id: 1009 Source: ClusSvc
Microsoft Cluster Server could not join an existing cluster and could not
form a new cluster. Microsoft Cluster Server has terminated.



Event Id: 1010 Source: ClusSvc
Microsoft Cluster Server is shutting down because the current node is not a
member of any cluster. Microsoft Cluster Server must be reinstalled to make
this node a member of a cluster.



Event Id: 1011 Source: ClusSvc
Cluster Node "ComputerName" has been evicted from the cluster.



Event Id: 1012 Source: ClusSvc
Microsoft Cluster Server did not start because the current version of
Windows NT is not correct. Microsoft Cluster Server runs only on Windows NT
Server, Enterprise Edition.



Event Id: 1015 Source: ClusSvc
No checkpoint record was found in the logfile W:\Mscs\Quolog.log; the
checkpoint file is invalid or was deleted.



Event Id: 1016 Source: ClusSvc
Microsoft Cluster Server failed to obtain a checkpoint from the cluster
database for log file W:\Mscs\Quolog.log.


Event Id: 1019 Source: ClusSvc
The log file D:\MSCS\Quolog.log was found to be corrupt. An attempt will be
made to reset it, or you should use the Cluster Administrator utility to
adjust the maximum size.



Event Id: 1021 Source: ClusSvc
There is insufficient disk space remaining on the quorum device. Please free
up some space on the quorum device. If there is no space on the disk for the
quorum log files then changes to the cluster registry will be prevented.



Event Id: 1022 Source: ClusSvc
There is insufficient space left on the quorum device. The Microsoft Cluster
Server cannot start.



Event Id: 1023 Source: ClusSvc
The quorum resource was not found. The Microsoft Cluster Server has
terminated.



Event Id: 1024 Source: ClusSvc
The registry checkpoint for cluster resource Microsoft Exchange Directory
could not be restored to registry key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeDS. The
resource may not function correctly. Make sure that no other processes have
open handles to registry keys in this registry subtree.



Event Id: 1034 Source: ClusSvc
The disk associated with cluster disk resource resource name could not be
found. The expected signature of the disk was signature. If the disk was
removed from the cluster, the resource should be deleted. If the disk was
replaced, the resource must be deleted and created again to bring the disk
online. If the disk has not been removed or replaced, it may be inaccessible
at this time because it is reserved by another cluster node.



Event Id: 1035 Source: ClusSvc
Cluster disk resource %1 could not be mounted.



Event Id: 1036 Source: ClusSvc
Cluster disk resource ''Disk [Q]:'' did not respond to a SCSI inquiry
command.



Event Id: 1037 Source: ClusSvc
Cluster disk resource %1 has failed a filesystem check. Please check your
disk configuration.



Event Id: 1038 Source: ClusSvc
Reservation of cluster disk Disk [Q]: has been lost. Please check your
system and disk configuration.


Event Id: 1040 Source: ClusSvc
Cluster generic service "ServiceName" could not be found.



Event Id: 1041 Source: ClusSvc
Cluster generic service "ServiceName" could not be started.



Event Id: 1042 Source: ClusSvc
Cluster generic service "resourcename" failed.



Event Id: 1043 Source: ClusSvc
The NetBIOS interface for "IP Address" resource has failed.



Event Id: 1044 Source: ClusSvc
Cluster IP Address resource %1 could not create the required NetBios
interface.



Event Id: 1045 Source: ClusSvc
Cluster IP address "IP address" could not create the required TCP/IP
Interface..



Event Id: 1046 Source: ClusSvc
Cluster IP Address resource %1 cannot be brought online because the subnet
mask parameter is invalid. Please check your network configuration.



Event Id: 1047 Source: ClusSvc
Cluster IP Address resource %1 cannot be brought online because the IP
address parameter is invalid. Please check your network configuration.



Event Id: 1048 Source: ClusSvc
Cluster IP address, "IP address," cannot be brought online because the
specified adapter name is invalid.



Event Id: 1049 Source: ClusSvc
Cluster IP address "IP address" cannot be brought online because the address
IP address is already present on the network. Please check your network
configuration.


Event Id: 1050 Source: ClusSvc
Cluster Network Name resource %1 cannot be brought online because the name
%2 is already present on the network. Please check your network
configuration.



Event Id: 1051 Source: ClusSvc
Cluster Network Name resource "resourcename" cannot be brought online
because it does not depend on an IP address resource. Please add an IP
address dependency.



Event Id: 1052 Source: ClusSvc
Cluster Network Name resource "resourcename" cannot be brought online
because the name could not be added to the system.



Event Id: 1052 Source: Cluster Service Clussvc
Cluster network name resource "ResourceName" could not be brought online
because the name could not be added to the system.



Event Id: 1053 Source: ClusSvc
Cluster File Share "resourcename" cannot be brought online because the share
could not be created.



Event Id: 1054 Source: ClusSvc
Cluster File Share %1 could not be found.



Event Id: 1055 Source: ClusSvc
Cluster File Share "sharename" has failed a status check.



Event Id: 1056 Source: ClusSvc
The cluster database on the local node is in an invalid state. Please start
another node before starting this node.



Event Id: 1057 Source: ClusSvc
The cluster service CLUSDB could not be opened.



Event Id: 1058 Source: ClusSvc
The Cluster Resource Monitor could not load the DLL %1 for resource type %2.


Event Id: 1059 Source: ClusSvc
The Cluster Resource DLL %1 for resource type %2 failed to initialize.



Event Id: 1061 Source: ClusSvc
Microsoft Cluster Server successfully formed a cluster on this node.



Event Id: 1062 Source: ClusSvc
Microsoft Cluster Server successfully joined the cluster.



Event Id: 1063 Source: ClusSvc
Microsoft Cluster Server was successfully stopped.



Event Id: 1064 Source: ClusSvc
The quorum resource was changed. The old quorum resource could not be marked
as obsolete. If there is a partition in time, you may lose changes to your
database, because the node that is down will not be able to get to the new
quorum resource.



Event Id: 1065 Source: ClusSvc
Cluster resource %1 failed to come online.



Event Id: 1066 Source: ClusSvc
Cluster disk resource resourcename is corrupted. Running Chkdsk /F to repair
problems.



Event Id: 1067 Source: ClusSvc
Cluster disk resource %1 has corrupt files. Running Chkdsk /F to repair
problems.



Event Id: 1068 Source: ClusSvc
The cluster file share resource resourcename failed to start. Error 5.



Event Id: 1069 Source: Cluster Service Clussvc
Cluster resourceNetwork Name in Resource Group GroupName failed.


Event Id: 1069 Source: ClusSvc
Cluster resource Disk [Q]: failed.



Event Id: 1070 Source: ClusSvc
Description 2: Cluster node attempted to join the cluster but failed with
error 5052.

Description 2:
The node failed to begin the process of joining the server cluster. The
error code was 1726.



Event Id: 1071 Source: ClusSvc
Cluster node Numberattempted to join but was refused. The error code was
<error code>.



Event Id: 1073 Source: ClusSvc
Microsoft Cluster Server was halted to prevent an inconsistency within the
cluster. The error code was 5028.



Event Id: 1077 Source: ClusSvc
The TCP/IP interface for cluster IP address resourcename has failed.



Event Id: 1079 Source: ClusSvc
The node cannot join the cluster because it cannot communicate with node xxx
over any network configured for internal cluster communication. Check the
network configuration of the node and the cluster.



Event Id: 1080 Source: ClusSvc
The Microsoft Cluster Server could not write file W:\MSCS\Chk7f5.tmp. The
disk may be low on disk space, or some other serious condition exists.



Event Id: 1082 Source: ClusSvc
The Microsoft Clustering Service failed restore a registry key for resource
%ResourceName% when it was brought online. This error code was <NTSTATUS>.
Some changes may be lost.



Event Id: 1089 Source: Clussvc
Microsoft Clustering Service failed to query a registry value. The value
name was ProductSuite. The error code was 2.



Event Id: 1093 Source: ClusSvc
Node %1 is not a member of cluster %2. If the name of the node has changed,
Microsoft Cluster Server must be reinstalled.


Event Id: 1095 Source: ClusSvc
Microsoft Cluster Server failed to obtain information about the network.
Error 2147942405



Event Id: 1096 Source: ClusSvc
Microsoft Cluster Server cannot use network adapter %1 because it does not
have a valid IP address assigned to it.



Event Id: 1097 Source: ClusSvc
Microsoft Cluster Server did not find any network adapters with valid IP
addresses installed in the system. The node will not be able to join a
cluster.



Event Id: 1098 Source: ClusSvc
The node is no longer attached to cluster network network_id by adapter
adapter. Microsoft Cluster Server will delete network interface interface
from the cluster configuration.



Event Id: 1100 Source: ClusSvc
Microsoft Cluster Server discovered that the node is now attached to cluster
network network_id by adapter adapter. A new cluster network interface will
be added to the cluster configuration.



Event Id: 1102 Source: ClusSvc
Microsoft Cluster Server discovered that the node is attached to a new
network by adapter adapter. A new network and network interface will be
added to the cluster configuration.



Event Id: 1104 Source: ClusSvc
Microsoft Cluster Server failed to update the configuration for one of the
nodes Network interfaces. The error code was errorcode.



Event Id: 1105 Source: ClusSvc
Microsoft Cluster Server failed to initialize the RPC services. The error
code was %1.



Event Id: 1107 Source: ClusSvc
Cluster node node name failed to make a connection to the node over network
network name. The error code was 1715.



Event Id: 1109 Source: ClusSvc
The node was unable to secure its connection to cluster node %1. The error
code was %2. Check that both nodes can communicate with their domain
controllers.


Event Id: 1115 Source: ClusSvc
An unrecoverable error caused the join of node nodename to the cluster to be
aborted. The error code was errorcode.



Event Id: 1116 Source: Clussvc
The Cluster Resource Monitor died unexpectedly, an attempt will be made to
restart it.



Event Id: 1119 Source: clussvc
The registration of DNS name IP address of cluster resource for network name
resource Name of cluster resource failed for the following reason: DNS
Server failure



Event Id: 1121 Source: ClusSvc
The crypto checkpoint for cluster resource sa1 could not be restored to the
container name EXPWMGMT-44a028991371419ebf3cc0661fafe7c1. The resource may
not function correctly. Data: 0000: 05 00 00 00



Event Id: 1122 Source: ClusSvc
The node (re)established communication with cluster node machine on network
heartbeat.



Event Id: 1123 Source: ClusSvc
The node lost communication with cluster node <server name> on network
<network name>.



Event Id: 1126 Source: ClusSvc
The interface for cluster node ClusterNode on network Public Network is
unreachable by at least one other cluster node attached to the network. The
cluster was not able to determine the location of the failure. Look for
additional entries in the system event log indicating which other nodes have
lost communication with node ClusterNode. If the condition persists, check
the cable connecting the node to the network. Next, check for hardware or
software errors in the nodes network adaptor. Finally, check for failures in
any other network components to which the node is connected such as hubs,
switches, or bridges.



Event Id: 1127 Source: ClusSvc
The interface for cluster node ClusterNode on network Public Network failed.
If the condition persists, check the cable connecting the node to the
network. Next, check for hardware or software errors in nodes network
adapter. Finally, check for failures in any network components to which the
node is connected such as hubs, switches, or bridges.



Event Id: 1130 Source: ClusSvc
Cluster network Private Heartbeat Network(1)(2) is down. None of the
available nodes can communicate using this network. If the condition
persists, check for failures in any network components to which the nodes
are connected such as hubs or switches.



Event Id: 1135 Source: ClusSvc
Cluster node ClusterNode was removed from the active cluster membership. The
Clustering Service may have been stopped on the node, the node may have
failed, or the node may have lost communication with the other active
cluster nodes.


Event Id: 1137 Source: ClusSvc
Event Log replication queue OUTQ is full. xxx event(s) is (are) discarded of
(total) size xxx.



Event Id: 1145 Source: ClusSvc
Cluster resource ResourceName timed out. If the pending timeout is too short
for this resource, then you should consider increasing the pending timeout
value.



Event Id: 1146 Source: ClusSvc
The cluster resource monitor died unexpectedly, an attempt will be made to
restart it. The following entries may be generated in the Cluster.log:



Event Id: 1146 Source: Cluster Service Clussvc
The cluster resource monitor died unexpectedly, an attempt will be made to
restart it.



Event Id: 1147 Source: ClusSvc
The Microsoft Clustering Service encountered a fatal error. The vital quorum
log file Q:\MSCS\quolog.log could not be found. If you have a backup of the
quorum log file, you may try to start the cluster service by entering
clussvc -debug -noquorumlogging at a command window, copy the backed up
quorum log file to the MSCS directory in the quorum drive, stop the cluster
service, and restart the cluster service normally using the net start
clussvc command. If you do not have a backup of the quorum log file, you may
try to start the cluster service as clussvc -debug -resetquorumlog and this
will attempt to create a new quorum log file based on possibly stale
information in the cluster hive. You may then stop the cluster service and
restart it normally using the net start clussvc command.



Event Id: 1148 Source: ClusSvc
Cluster service encountered a fatal error. The vital quorum log file
Q:\MSCS\quolog.log is corrupt. If you have a backup of the quorum log file,
you may try to start Cluster service by entering
clussvc -debug -noquorumlogging at a command window, copy the backed up
quorum log file to the MSCS directory on the quorum drive, stop Cluster
service, and restart Cluster service normally using the net start clussvc
command. If you do not have a backup of the quorum log file, you may try to
start Cluster service as clussvc -debug -resetquorumlog and this will
attempt to create a new quorum log file based on possibly stale information
in the server cluster database. You may then stop Cluster service and
restart it normally using the net start clussvc command.



Event Id: 1149 Source: ClusSvc
The DNS Host (A) and Pointer (PTR) records associated with Cluster resource
TestClusterName were not removed from the resources associated DNS server.
If necessary, they can be deleted manually. Contact your DNS administrator
to assist with this effort.



Event Id: 1173 Source: ClusSvc
Cluster service is shutting down because the membership engine detected a
membership event while trying to join the server cluster. Shutting down is
the normal response to this type of event. Cluster service will restart per
the Service Managers recovery actions.



Event Id: 1194 Source: ClusSvc
Description 1.
The computer account for Cluster resource Network Name Resource in domain
microsoft.com could not be created for the following reason: Unable to set
ServicePrincipalName attribute.
Description 2.
The computer account for Cluster resource Network Name Resource in domain
microsoft.com could not be created for the following reason: Unable to
update password.
Description 3.
The computer account for Cluster resource Network Name Resource in domain
microsoft.com could not be created for the following reason: Unable to set
DnsHostName attribute.



Event Id: 1196 Source: ClusSvc
The required registration of the DNS name(s) associated with Cluster
resource NetworkName failed.


GROUP:Windows OS

Event Id: 1202 Source: ClusSvc
The time delta between node NODE01 and node NODE02 is 153275856(in 100
nanosecs).



Event Id: 1232 Source: ClusSvc
Cluster generic script resource MyScript timed out. Online script entry
point did not complete execution in a timely manner. This could be due to an
infinite loop or a hang in this entry point, or the pending timeout may be
too short for this resource. Please review the Online script entry point to
make sure theres no infinite loop or a hang in the script code, and then
consider increasing the pending timeout value if necessary. In a command
shell, run "cluster res "MyScript" /prop PersistentState=0" to disable this
resource, and then run "net stop clussvc" to stop the cluster service.
Ensure that any problem in the script code is fixed. Then run "net start
clussvc" to start the cluster service. If necessary, ensure that the pending
time out is increased before bringing the resource online again.



Event Id: 1233 Source: ClusSvc
Cluster generic script resource MyScript: Request to perform the Online
operation will not be processed. This is because of a previous failed
attempt to execute the Online entry point in a timely fashion. Please review
the script code for this entry point to make sure there is no infinite loop
or a hang in it, and then consider increasing the resource pending timeout
value if necessary. In a command shell, run "cluster res "MyScript" /pro
PersistentState=0" to disable this resource, and then run "net stop clussvc"
to stop the cluster service. Ensure that any problem in the script code is
fixed. Then run "net start clussvc" to start the cluster service. If
necessary, ensure that the pending time out is increased before bringing the
resource online again.



Event Id: 1234 Source: ClusSvc
The Cluster service account does not have the following required user
rights: Act as part of the operating system Lock pages in memory These user
rights were granted to the Cluster service account during cluster setup and
must not be removed.



Event Id: 1237 Source: ClusSvc
The description for Event ID ( 1237 ) in Source ( ClusSvc ) cannot be found.
The local computer may not have the necessary registry information or
message DLL files to display messages from a remote computer. You may be
able to use the /AUXSOURCE= flag to retrieve this description; see Help and
Support for details. The following information is part of the event: Drive
Letter.



Event Id: 1238 Source: ClusSvc
The description for Event ID ( 1238 ) in Source ( ClusSvc ) cannot be found.
The local computer may not have the necessary registry information or
message DLL files to display messages from a remote computer. You may be
able to use the /AUXSOURCE= flag to retrieve this description; see Help and
Support for details. The following information is part of the event: Drive
Letter.





"Mark Bradley" <Mark Bradley@discussions.microsoft.com> wrote in message
news:A6561BB9-6BA4-40AB-9381-A6C6DEACD50C@microsoft.com...
> I am looking for a list of event id's from the ClusSvc as we are
streamlining
> our monitoring for clusters and I would like to ensure that we capture all
> the necessary events.
>
> Can anyone help?
>
> Thanks in advance.

I would also suggest using the preset capabilities of the MOM Management
pack for MSCS:

http://www.microsoft.com/downloads/d...displaylang=en


--
Ryan Sokolowski
MVP - Windows Server - Clustering
MCSE, CCNA, CCDA, BCFP
Clustering101.com - Coming Soon!

This posting is provided "AS IS" with no warranties, and confers no rights.
"Mark Bradley" <Mark Bradley@discussions.microsoft.com> wrote in message
news:A6561BB9-6BA4-40AB-9381-A6C6DEACD50C@microsoft.com...
>I am looking for a list of event id's from the ClusSvc as we are
>streamlining
> our monitoring for clusters and I would like to ensure that we capture all
> the necessary events.
>
> Can anyone help?
>
> Thanks in advance.