Results 1 to 5 of 5

Thread: Event ID list for Clusters

  1. #1
    Mark Bradley Guest

    Event ID list for Clusters

    I am looking for a list of event id's from the ClusSvc as we are streamlining
    our monitoring for clusters and I would like to ensure that we capture all
    the necessary events.

    Can anyone help?

    Thanks in advance.

  2. #2
    Chuck Timon [Microsoft] Guest

    Re: Event ID list for Clusters

    You can start here -
    http://www.microsoft.com/technet/arc....mspx?mfr=true

    Chuck Timon, Jr.
    Microsoft Corporation
    Longhorn Readiness Team
    This posting is provided "AS IS" with no warranties, and confers no rights.

    "Mark Bradley" <Mark [email protected]> wrote in message
    news:[email protected]...
    >I am looking for a list of event id's from the ClusSvc as we are
    >streamlining
    > our monitoring for clusters and I would like to ensure that we capture all
    > the necessary events.
    >
    > Can anyone help?
    >
    > Thanks in advance.



  3. #3
    Mark Bradley Guest

    Re: Event ID list for Clusters

    Thanks Chuck,

    That will be a great help.

    "Chuck Timon [Microsoft]" wrote:

    > You can start here -
    > http://www.microsoft.com/technet/arc....mspx?mfr=true
    >
    > Chuck Timon, Jr.
    > Microsoft Corporation
    > Longhorn Readiness Team
    > This posting is provided "AS IS" with no warranties, and confers no rights.
    >
    > "Mark Bradley" <Mark [email protected]> wrote in message
    > news:[email protected]...
    > >I am looking for a list of event id's from the ClusSvc as we are
    > >streamlining
    > > our monitoring for clusters and I would like to ensure that we capture all
    > > the necessary events.
    > >
    > > Can anyone help?
    > >
    > > Thanks in advance.

    >
    >


  4. #4
    Edwin vMierlo Guest

    Re: Event ID list for Clusters

    Mark,

    go here http://www.evtcatalog.com

    then fill in the source (ClusSvc) and search... it will give you a list of
    eventID's for cluster
    This list not fully complete though, but it might get you started, see below
    for an extract.

    rgds,
    Edwin.



    Event Id: 1000 Source: ClusSvc
    Microsoft Clustering Service suffered an unexpected fatal error at line
    <line> of source module <source path>. The error code was <error code>.



    Event Id: 1002 Source: ClusSvc
    Microsoft Cluster Server handled an unexpected error at line 528 of source
    module G:\Nt\Private\Cluster\Resmon\Rmapi.c. The error code was 5007.



    Event Id: 1006 Source: ClusSvc
    Microsoft Cluster Server was halted because of a cluster membership or
    communications error. The error code was 4.



    Event Id: 1007 Source: ClusSvc
    A new node, "ComputerName", has been added to the cluster.



    Event Id: 1009 Source: ClusSvc
    Microsoft Cluster Server could not join an existing cluster and could not
    form a new cluster. Microsoft Cluster Server has terminated.



    Event Id: 1010 Source: ClusSvc
    Microsoft Cluster Server is shutting down because the current node is not a
    member of any cluster. Microsoft Cluster Server must be reinstalled to make
    this node a member of a cluster.



    Event Id: 1011 Source: ClusSvc
    Cluster Node "ComputerName" has been evicted from the cluster.



    Event Id: 1012 Source: ClusSvc
    Microsoft Cluster Server did not start because the current version of
    Windows NT is not correct. Microsoft Cluster Server runs only on Windows NT
    Server, Enterprise Edition.



    Event Id: 1015 Source: ClusSvc
    No checkpoint record was found in the logfile W:\Mscs\Quolog.log; the
    checkpoint file is invalid or was deleted.



    Event Id: 1016 Source: ClusSvc
    Microsoft Cluster Server failed to obtain a checkpoint from the cluster
    database for log file W:\Mscs\Quolog.log.


    Event Id: 1019 Source: ClusSvc
    The log file D:\MSCS\Quolog.log was found to be corrupt. An attempt will be
    made to reset it, or you should use the Cluster Administrator utility to
    adjust the maximum size.



    Event Id: 1021 Source: ClusSvc
    There is insufficient disk space remaining on the quorum device. Please free
    up some space on the quorum device. If there is no space on the disk for the
    quorum log files then changes to the cluster registry will be prevented.



    Event Id: 1022 Source: ClusSvc
    There is insufficient space left on the quorum device. The Microsoft Cluster
    Server cannot start.



    Event Id: 1023 Source: ClusSvc
    The quorum resource was not found. The Microsoft Cluster Server has
    terminated.



    Event Id: 1024 Source: ClusSvc
    The registry checkpoint for cluster resource Microsoft Exchange Directory
    could not be restored to registry key
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeDS. The
    resource may not function correctly. Make sure that no other processes have
    open handles to registry keys in this registry subtree.



    Event Id: 1034 Source: ClusSvc
    The disk associated with cluster disk resource resource name could not be
    found. The expected signature of the disk was signature. If the disk was
    removed from the cluster, the resource should be deleted. If the disk was
    replaced, the resource must be deleted and created again to bring the disk
    online. If the disk has not been removed or replaced, it may be inaccessible
    at this time because it is reserved by another cluster node.



    Event Id: 1035 Source: ClusSvc
    Cluster disk resource %1 could not be mounted.



    Event Id: 1036 Source: ClusSvc
    Cluster disk resource ''Disk [Q]:'' did not respond to a SCSI inquiry
    command.



    Event Id: 1037 Source: ClusSvc
    Cluster disk resource %1 has failed a filesystem check. Please check your
    disk configuration.



    Event Id: 1038 Source: ClusSvc
    Reservation of cluster disk Disk [Q]: has been lost. Please check your
    system and disk configuration.


    Event Id: 1040 Source: ClusSvc
    Cluster generic service "ServiceName" could not be found.



    Event Id: 1041 Source: ClusSvc
    Cluster generic service "ServiceName" could not be started.



    Event Id: 1042 Source: ClusSvc
    Cluster generic service "resourcename" failed.



    Event Id: 1043 Source: ClusSvc
    The NetBIOS interface for "IP Address" resource has failed.



    Event Id: 1044 Source: ClusSvc
    Cluster IP Address resource %1 could not create the required NetBios
    interface.



    Event Id: 1045 Source: ClusSvc
    Cluster IP address "IP address" could not create the required TCP/IP
    Interface..



    Event Id: 1046 Source: ClusSvc
    Cluster IP Address resource %1 cannot be brought online because the subnet
    mask parameter is invalid. Please check your network configuration.



    Event Id: 1047 Source: ClusSvc
    Cluster IP Address resource %1 cannot be brought online because the IP
    address parameter is invalid. Please check your network configuration.



    Event Id: 1048 Source: ClusSvc
    Cluster IP address, "IP address," cannot be brought online because the
    specified adapter name is invalid.



    Event Id: 1049 Source: ClusSvc
    Cluster IP address "IP address" cannot be brought online because the address
    IP address is already present on the network. Please check your network
    configuration.


    Event Id: 1050 Source: ClusSvc
    Cluster Network Name resource %1 cannot be brought online because the name
    %2 is already present on the network. Please check your network
    configuration.



    Event Id: 1051 Source: ClusSvc
    Cluster Network Name resource "resourcename" cannot be brought online
    because it does not depend on an IP address resource. Please add an IP
    address dependency.



    Event Id: 1052 Source: ClusSvc
    Cluster Network Name resource "resourcename" cannot be brought online
    because the name could not be added to the system.



    Event Id: 1052 Source: Cluster Service Clussvc
    Cluster network name resource "ResourceName" could not be brought online
    because the name could not be added to the system.



    Event Id: 1053 Source: ClusSvc
    Cluster File Share "resourcename" cannot be brought online because the share
    could not be created.



    Event Id: 1054 Source: ClusSvc
    Cluster File Share %1 could not be found.



    Event Id: 1055 Source: ClusSvc
    Cluster File Share "sharename" has failed a status check.



    Event Id: 1056 Source: ClusSvc
    The cluster database on the local node is in an invalid state. Please start
    another node before starting this node.



    Event Id: 1057 Source: ClusSvc
    The cluster service CLUSDB could not be opened.



    Event Id: 1058 Source: ClusSvc
    The Cluster Resource Monitor could not load the DLL %1 for resource type %2.


    Event Id: 1059 Source: ClusSvc
    The Cluster Resource DLL %1 for resource type %2 failed to initialize.



    Event Id: 1061 Source: ClusSvc
    Microsoft Cluster Server successfully formed a cluster on this node.



    Event Id: 1062 Source: ClusSvc
    Microsoft Cluster Server successfully joined the cluster.



    Event Id: 1063 Source: ClusSvc
    Microsoft Cluster Server was successfully stopped.



    Event Id: 1064 Source: ClusSvc
    The quorum resource was changed. The old quorum resource could not be marked
    as obsolete. If there is a partition in time, you may lose changes to your
    database, because the node that is down will not be able to get to the new
    quorum resource.



    Event Id: 1065 Source: ClusSvc
    Cluster resource %1 failed to come online.



    Event Id: 1066 Source: ClusSvc
    Cluster disk resource resourcename is corrupted. Running Chkdsk /F to repair
    problems.



    Event Id: 1067 Source: ClusSvc
    Cluster disk resource %1 has corrupt files. Running Chkdsk /F to repair
    problems.



    Event Id: 1068 Source: ClusSvc
    The cluster file share resource resourcename failed to start. Error 5.



    Event Id: 1069 Source: Cluster Service Clussvc
    Cluster resourceNetwork Name in Resource Group GroupName failed.


    Event Id: 1069 Source: ClusSvc
    Cluster resource Disk [Q]: failed.



    Event Id: 1070 Source: ClusSvc
    Description 2: Cluster node attempted to join the cluster but failed with
    error 5052.

    Description 2:
    The node failed to begin the process of joining the server cluster. The
    error code was 1726.



    Event Id: 1071 Source: ClusSvc
    Cluster node Numberattempted to join but was refused. The error code was
    <error code>.



    Event Id: 1073 Source: ClusSvc
    Microsoft Cluster Server was halted to prevent an inconsistency within the
    cluster. The error code was 5028.



    Event Id: 1077 Source: ClusSvc
    The TCP/IP interface for cluster IP address resourcename has failed.



    Event Id: 1079 Source: ClusSvc
    The node cannot join the cluster because it cannot communicate with node xxx
    over any network configured for internal cluster communication. Check the
    network configuration of the node and the cluster.



    Event Id: 1080 Source: ClusSvc
    The Microsoft Cluster Server could not write file W:\MSCS\Chk7f5.tmp. The
    disk may be low on disk space, or some other serious condition exists.



    Event Id: 1082 Source: ClusSvc
    The Microsoft Clustering Service failed restore a registry key for resource
    %ResourceName% when it was brought online. This error code was <NTSTATUS>.
    Some changes may be lost.



    Event Id: 1089 Source: Clussvc
    Microsoft Clustering Service failed to query a registry value. The value
    name was ProductSuite. The error code was 2.



    Event Id: 1093 Source: ClusSvc
    Node %1 is not a member of cluster %2. If the name of the node has changed,
    Microsoft Cluster Server must be reinstalled.


    Event Id: 1095 Source: ClusSvc
    Microsoft Cluster Server failed to obtain information about the network.
    Error 2147942405



    Event Id: 1096 Source: ClusSvc
    Microsoft Cluster Server cannot use network adapter %1 because it does not
    have a valid IP address assigned to it.



    Event Id: 1097 Source: ClusSvc
    Microsoft Cluster Server did not find any network adapters with valid IP
    addresses installed in the system. The node will not be able to join a
    cluster.



    Event Id: 1098 Source: ClusSvc
    The node is no longer attached to cluster network network_id by adapter
    adapter. Microsoft Cluster Server will delete network interface interface
    from the cluster configuration.



    Event Id: 1100 Source: ClusSvc
    Microsoft Cluster Server discovered that the node is now attached to cluster
    network network_id by adapter adapter. A new cluster network interface will
    be added to the cluster configuration.



    Event Id: 1102 Source: ClusSvc
    Microsoft Cluster Server discovered that the node is attached to a new
    network by adapter adapter. A new network and network interface will be
    added to the cluster configuration.



    Event Id: 1104 Source: ClusSvc
    Microsoft Cluster Server failed to update the configuration for one of the
    nodes Network interfaces. The error code was errorcode.



    Event Id: 1105 Source: ClusSvc
    Microsoft Cluster Server failed to initialize the RPC services. The error
    code was %1.



    Event Id: 1107 Source: ClusSvc
    Cluster node node name failed to make a connection to the node over network
    network name. The error code was 1715.



    Event Id: 1109 Source: ClusSvc
    The node was unable to secure its connection to cluster node %1. The error
    code was %2. Check that both nodes can communicate with their domain
    controllers.


    Event Id: 1115 Source: ClusSvc
    An unrecoverable error caused the join of node nodename to the cluster to be
    aborted. The error code was errorcode.



    Event Id: 1116 Source: Clussvc
    The Cluster Resource Monitor died unexpectedly, an attempt will be made to
    restart it.



    Event Id: 1119 Source: clussvc
    The registration of DNS name IP address of cluster resource for network name
    resource Name of cluster resource failed for the following reason: DNS
    Server failure



    Event Id: 1121 Source: ClusSvc
    The crypto checkpoint for cluster resource sa1 could not be restored to the
    container name EXPWMGMT-44a028991371419ebf3cc0661fafe7c1. The resource may
    not function correctly. Data: 0000: 05 00 00 00



    Event Id: 1122 Source: ClusSvc
    The node (re)established communication with cluster node machine on network
    heartbeat.



    Event Id: 1123 Source: ClusSvc
    The node lost communication with cluster node <server name> on network
    <network name>.



    Event Id: 1126 Source: ClusSvc
    The interface for cluster node ClusterNode on network Public Network is
    unreachable by at least one other cluster node attached to the network. The
    cluster was not able to determine the location of the failure. Look for
    additional entries in the system event log indicating which other nodes have
    lost communication with node ClusterNode. If the condition persists, check
    the cable connecting the node to the network. Next, check for hardware or
    software errors in the nodes network adaptor. Finally, check for failures in
    any other network components to which the node is connected such as hubs,
    switches, or bridges.



    Event Id: 1127 Source: ClusSvc
    The interface for cluster node ClusterNode on network Public Network failed.
    If the condition persists, check the cable connecting the node to the
    network. Next, check for hardware or software errors in nodes network
    adapter. Finally, check for failures in any network components to which the
    node is connected such as hubs, switches, or bridges.



    Event Id: 1130 Source: ClusSvc
    Cluster network Private Heartbeat Network(1)(2) is down. None of the
    available nodes can communicate using this network. If the condition
    persists, check for failures in any network components to which the nodes
    are connected such as hubs or switches.



    Event Id: 1135 Source: ClusSvc
    Cluster node ClusterNode was removed from the active cluster membership. The
    Clustering Service may have been stopped on the node, the node may have
    failed, or the node may have lost communication with the other active
    cluster nodes.


    Event Id: 1137 Source: ClusSvc
    Event Log replication queue OUTQ is full. xxx event(s) is (are) discarded of
    (total) size xxx.



    Event Id: 1145 Source: ClusSvc
    Cluster resource ResourceName timed out. If the pending timeout is too short
    for this resource, then you should consider increasing the pending timeout
    value.



    Event Id: 1146 Source: ClusSvc
    The cluster resource monitor died unexpectedly, an attempt will be made to
    restart it. The following entries may be generated in the Cluster.log:



    Event Id: 1146 Source: Cluster Service Clussvc
    The cluster resource monitor died unexpectedly, an attempt will be made to
    restart it.



    Event Id: 1147 Source: ClusSvc
    The Microsoft Clustering Service encountered a fatal error. The vital quorum
    log file Q:\MSCS\quolog.log could not be found. If you have a backup of the
    quorum log file, you may try to start the cluster service by entering
    clussvc -debug -noquorumlogging at a command window, copy the backed up
    quorum log file to the MSCS directory in the quorum drive, stop the cluster
    service, and restart the cluster service normally using the net start
    clussvc command. If you do not have a backup of the quorum log file, you may
    try to start the cluster service as clussvc -debug -resetquorumlog and this
    will attempt to create a new quorum log file based on possibly stale
    information in the cluster hive. You may then stop the cluster service and
    restart it normally using the net start clussvc command.



    Event Id: 1148 Source: ClusSvc
    Cluster service encountered a fatal error. The vital quorum log file
    Q:\MSCS\quolog.log is corrupt. If you have a backup of the quorum log file,
    you may try to start Cluster service by entering
    clussvc -debug -noquorumlogging at a command window, copy the backed up
    quorum log file to the MSCS directory on the quorum drive, stop Cluster
    service, and restart Cluster service normally using the net start clussvc
    command. If you do not have a backup of the quorum log file, you may try to
    start Cluster service as clussvc -debug -resetquorumlog and this will
    attempt to create a new quorum log file based on possibly stale information
    in the server cluster database. You may then stop Cluster service and
    restart it normally using the net start clussvc command.



    Event Id: 1149 Source: ClusSvc
    The DNS Host (A) and Pointer (PTR) records associated with Cluster resource
    TestClusterName were not removed from the resources associated DNS server.
    If necessary, they can be deleted manually. Contact your DNS administrator
    to assist with this effort.



    Event Id: 1173 Source: ClusSvc
    Cluster service is shutting down because the membership engine detected a
    membership event while trying to join the server cluster. Shutting down is
    the normal response to this type of event. Cluster service will restart per
    the Service Managers recovery actions.



    Event Id: 1194 Source: ClusSvc
    Description 1.
    The computer account for Cluster resource Network Name Resource in domain
    microsoft.com could not be created for the following reason: Unable to set
    ServicePrincipalName attribute.
    Description 2.
    The computer account for Cluster resource Network Name Resource in domain
    microsoft.com could not be created for the following reason: Unable to
    update password.
    Description 3.
    The computer account for Cluster resource Network Name Resource in domain
    microsoft.com could not be created for the following reason: Unable to set
    DnsHostName attribute.



    Event Id: 1196 Source: ClusSvc
    The required registration of the DNS name(s) associated with Cluster
    resource NetworkName failed.


    GROUP:Windows OS

    Event Id: 1202 Source: ClusSvc
    The time delta between node NODE01 and node NODE02 is 153275856(in 100
    nanosecs).



    Event Id: 1232 Source: ClusSvc
    Cluster generic script resource MyScript timed out. Online script entry
    point did not complete execution in a timely manner. This could be due to an
    infinite loop or a hang in this entry point, or the pending timeout may be
    too short for this resource. Please review the Online script entry point to
    make sure theres no infinite loop or a hang in the script code, and then
    consider increasing the pending timeout value if necessary. In a command
    shell, run "cluster res "MyScript" /prop PersistentState=0" to disable this
    resource, and then run "net stop clussvc" to stop the cluster service.
    Ensure that any problem in the script code is fixed. Then run "net start
    clussvc" to start the cluster service. If necessary, ensure that the pending
    time out is increased before bringing the resource online again.



    Event Id: 1233 Source: ClusSvc
    Cluster generic script resource MyScript: Request to perform the Online
    operation will not be processed. This is because of a previous failed
    attempt to execute the Online entry point in a timely fashion. Please review
    the script code for this entry point to make sure there is no infinite loop
    or a hang in it, and then consider increasing the resource pending timeout
    value if necessary. In a command shell, run "cluster res "MyScript" /pro
    PersistentState=0" to disable this resource, and then run "net stop clussvc"
    to stop the cluster service. Ensure that any problem in the script code is
    fixed. Then run "net start clussvc" to start the cluster service. If
    necessary, ensure that the pending time out is increased before bringing the
    resource online again.



    Event Id: 1234 Source: ClusSvc
    The Cluster service account does not have the following required user
    rights: Act as part of the operating system Lock pages in memory These user
    rights were granted to the Cluster service account during cluster setup and
    must not be removed.



    Event Id: 1237 Source: ClusSvc
    The description for Event ID ( 1237 ) in Source ( ClusSvc ) cannot be found.
    The local computer may not have the necessary registry information or
    message DLL files to display messages from a remote computer. You may be
    able to use the /AUXSOURCE= flag to retrieve this description; see Help and
    Support for details. The following information is part of the event: Drive
    Letter.



    Event Id: 1238 Source: ClusSvc
    The description for Event ID ( 1238 ) in Source ( ClusSvc ) cannot be found.
    The local computer may not have the necessary registry information or
    message DLL files to display messages from a remote computer. You may be
    able to use the /AUXSOURCE= flag to retrieve this description; see Help and
    Support for details. The following information is part of the event: Drive
    Letter.





    "Mark Bradley" <Mark [email protected]> wrote in message
    news:[email protected]...
    > I am looking for a list of event id's from the ClusSvc as we are

    streamlining
    > our monitoring for clusters and I would like to ensure that we capture all
    > the necessary events.
    >
    > Can anyone help?
    >
    > Thanks in advance.




  5. #5
    Ryan Sokolowski [MVP] Guest

    Re: Event ID list for Clusters

    I would also suggest using the preset capabilities of the MOM Management
    pack for MSCS:

    http://www.microsoft.com/downloads/d...displaylang=en


    --
    Ryan Sokolowski
    MVP - Windows Server - Clustering
    MCSE, CCNA, CCDA, BCFP
    Clustering101.com - Coming Soon!

    This posting is provided "AS IS" with no warranties, and confers no rights.
    "Mark Bradley" <Mark [email protected]> wrote in message
    news:[email protected]...
    >I am looking for a list of event id's from the ClusSvc as we are
    >streamlining
    > our monitoring for clusters and I would like to ensure that we capture all
    > the necessary events.
    >
    > Can anyone help?
    >
    > Thanks in advance.




Similar Threads

  1. Replies: 4
    Last Post: 10-08-2010, 10:22 PM
  2. How to remove bad clusters / sectors from HDD?
    By Pyrotechnic in forum Tips & Tweaks
    Replies: 4
    Last Post: 15-03-2010, 04:32 PM
  3. Event ID 8032 Browser service fails to retrieve backup list
    By Tom C. in forum Windows Server Help
    Replies: 7
    Last Post: 17-09-2009, 01:58 PM
  4. Vista ScanDisk to fix bad clusters
    By EULALIA in forum Windows Software
    Replies: 3
    Last Post: 14-07-2009, 09:48 AM
  5. Disaster recovery for clusters
    By CFPDSA in forum Windows Server Help
    Replies: 25
    Last Post: 21-02-2008, 01:48 AM

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  
Page generated in 1,751,864,291.97189 seconds with 16 queries