when did the cluster fail over?

Mike Bonvie · Joined: 05 Aug 2007 Posts: 29

We have an Exchange 2003 SP2 2 node cluster.
The Exchange resource group (containing all services + disk resources)
failed over to its peer node - we never noticed it.

I'm looking through the cluster log file in C:\windows\cluster for when &
why it failed.

Is there a smoking gun in this logfile, a specific entry which indicates
when or why it failed over.

Thanks!
Mike Bonvie

Archived from group: microsoft>public>exchange>clustering

Edwin vMierlo [MVP] · Joined: 05 Aug 2007 Posts: 18

"Mike Bonvie" wrote in message@TK2MSFTNGP06.phx.gbl...
> We have an Exchange 2003 SP2 2 node cluster.
> The Exchange resource group (containing all services + disk resources)
> failed over to its peer node - we never noticed it.

Time to start researching monitoring solutions !
MOM obviously should be on your list to evaluate.

>
> I'm looking through the cluster log file in C:\windows\cluster for when &
> why it failed.

the cluster log has a maximum size, and will overwrite after time. It could
be it is already overwritten the actual failover.

>
> Is there a smoking gun in this logfile, a specific entry which indicates
> when or why it failed over.

Look at the sytem event log, look for Event ID 1069 (generic Event for a
resource failing) or Event ID 1200 (attempting to bring group online),
obviously when you see an Event ID 1200 for nodeB, that means it probably
went offline on nodeA first
That might give you a clue on when this happened, look for events coming up
to that time for more clues on why it happened.

Rgds,
Edwin.

John Toner [MVP] · Joined: 05 Aug 2007 Posts: 9

FYI, you could also set up a generic script resource in your cluster to
notify you when it has failed over. See
http://support.microsoft.com/kb/260527 for an example how to do this.

I agree with Edwin, that the System Event logs should be where you look
first. Look for the 1069 errors and/or informational events from clussvc
1200, 1201, 1203, 1204, 1205...these are posted on 2003 servers when a group
is moved. The 1069 is the key error as this will tell you which resource is
failing.

Once you've identified which resource is failing, you can then scan the
cluster.log on that node and see if your log contains the error code
explaining why the resource failed. The cluster.log is based in GMT time and
not local system time, so make sure you adjust accordingly. The cluster.log
is also a circular log so its possible that the logs might have wrapped
depending on how long ago this failure occurred.

Regards,
John

Visit my blog: http://msmvps.com/blogs/jtoner

"Edwin vMierlo [MVP]" wrote in
message @TK2MSFTNGP05.phx.gbl...
>
> "Mike Bonvie" wrote in message
> @TK2MSFTNGP06.phx.gbl...
> > We have an Exchange 2003 SP2 2 node cluster.
> > The Exchange resource group (containing all services + disk resources)
> > failed over to its peer node - we never noticed it.
>
> Time to start researching monitoring solutions !
> MOM obviously should be on your list to evaluate.
>
> >
> > I'm looking through the cluster log file in C:\windows\cluster for when
&
> > why it failed.
>
> the cluster log has a maximum size, and will overwrite after time. It
could
> be it is already overwritten the actual failover.
>
> >
> > Is there a smoking gun in this logfile, a specific entry which indicates
> > when or why it failed over.
>
> Look at the sytem event log, look for Event ID 1069 (generic Event for a
> resource failing) or Event ID 1200 (attempting to bring group online),
> obviously when you see an Event ID 1200 for nodeB, that means it probably
> went offline on nodeA first
> That might give you a clue on when this happened, look for events coming
up
> to that time for more clues on why it happened.
>
> Rgds,
> Edwin.
>
>

Cluster service could not join an existing server cluster Hi, We have x2 blade servers running Windows 2003 SP1 Enterprise Server edition. They each have a dual qlogic HBA attached to a MSA1500. We presented a LUN for the quorum drive and proceeded to install / configure MS Cluster. Cluster install went fine. Wh

FBA on cluster Hi, I have to run OWA Form Based A. on cluster exchange 2003. Is it any way to do it? Michael

New cluster same name? We have an Exchange 2003 A/P cluster and the hardware has just gone to pieces. So here is the question. Can you create a new cluster and somehow get Exchange on it as the same exchange server name without cuasing all sorts of problems. We want to essen

BYE BYE CLUSTER I currently have an Exchange 2003 2-node cluster that I wish to disassemble. When considering the costs affiliated with DR and the complexities the cluster introduces (at least while we are still on Exchange 2003) we have decided to scale

cluster setup Hello All, I have to build an Exchange 2007 cluster and wsa wondering if anybody has some of the installation he/she did. I Think I did it right the third time I installed everyting but ust to be sure I would like to review my installation