A Microsoft Cluster Troubleshooting Guide

Here are some of the tools we can use when troubleshooting a cluster, Scale-Out File Server, Hyper-V, and other cluster issues:

Failover Cluster Manager 

The FCM gives us the ability to dig into the various Windows Logs and delimit them by time, node, and log type.

• FCM --> Cluster Name --> Cluster Events --> Query

We set up a few different queries out of the box. One with everything Cluster, Failover Clustering, and Hyper-V related. We then create a subset of queries. The various queries get saved to a local folder on the management DC/RSAT system.

Get-ClusterLog

The Get-ClusterLog PowerShell commandlet allows us to pull the full log set from one or all nodes. Note that the default output folder is \\NODE\C$\Windows\Cluster\Cluster.LOG (C:\Windows\Cluster\Cluster.LOG) unless specified in the command.

This log can be very busy and a bit of a challenge to work through. If one has a good idea of what to look for then the log can be quite informative.

• Get-ClusterLog -Destination .
  • Places the log in the local directory (we create C:\Temp on all nodes for this kind of thing)
• (get-cluster).ClusterLogLevel=5
  • There are five levels with 5 being the most verbose. Default level is 3 and best left there unless absolutely needed. Level 5 file can be large.

EDIT: The Default cluster log location is C:\Windows\Cluster\Reports\Cluster.log

Microsoft Message Analyzer

This is an in-depth tool. There is no way around it. Thus, a learning curve is required.

• TechNet Blogs: MessageAnalyzer
• Download the Microsoft Message Analyzer

However, there is an amazing amount of information that we can then have at our fingertips and not only that colour coded!

One can use a series of filters under the log file settings to delimit by time period among others.

We can set up our columns:

Once we have our Cluster column, for example when looking for a problematic cluster component, we can set up a filter:

And that is just the tip of the iceberg. One will need to spend some time with this tool to really get into its abilities such as colour coding source node, information levels, and so much more!

Please check the Message Analyzer Blog for more information.

Note that an absence of System Centre and its components is deliberate. We find, at least at this time, that Failover Cluster Manager provides a far superior cluster management experience.

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen ASP Project
Find out more at
Third Tier: Enterprise Solutions for Small Business