View Events and Logs for a Failover Cluster

  • Article

Applies To: Windows Server 2008

When you view events through the Failover Cluster Management snap-in, you can see events for all nodes in the cluster instead of seeing events for only one node at a time. When you generate and view logs by using a Command Prompt window, you can see detailed listings (traces) of the recent series of actions taken by the failover clustering software.

For information about viewing the reports from the failover cluster wizards, see View Reports of the Actions of Failover Cluster Wizards.

This topic provides only selected information about using events and logs for a failover cluster. For additional information, see https://go.microsoft.com/fwlink/?LinkId=92314.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at Local and Domain Default Groups (https://go.microsoft.com/fwlink/?LinkId=83477).

Viewing events and logs for a failover cluster

  • Using the Windows interface

  • Using a Command Prompt window

To view events and logs for a failover cluster by using the Windows interface

  1. In the Failover Cluster Management snap-in, if the cluster is not displayed, in the console tree, right-click Failover Cluster Management, click Manage a Cluster, and then select or specify the cluster that you want.

  2. If the console tree is collapsed, expand the tree under the cluster for which you want to view events.

  3. In the console tree, right-click Cluster Events and then click Query.

  4. In the Cluster Events Filter dialog box, select the criteria for the events that you want to display.

    To return to the default criteria, click the Reset button.

  5. Click OK.

  6. To sort the events, click a heading, for example, Level or Date and Time.

  7. To view a specific event, click the event and view the details in the Event Details pane.

Additional considerations

  • To open the failover cluster snap-in, click Start, click Administrative Tools, and then click Failover Cluster Management. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.

  • You can also use Event Viewer to open a log related to failover clustering. To locate the log, in Event Viewer, expand Applications and Services Logs, expand Microsoft, expand Windows, and then expand FailoverClustering. The log file is stored in systemroot\system32\winevt\Logs.

Additional references

To view detailed logs for a failover cluster by using a Command Prompt window

  1. To open a Command Prompt window, click Start, right-click Command Prompt, and then either click Run as administrator or click Open.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.

  3. Enter a command of the following form:

    CLUSTER [cluster-name] LOG /GEN /COPY:"pathname"

    A detailed trace log from each of the nodes is generated and copied to the path you specify.

  4. To change to the folder where the log is located, note the pathname you specified in the previous step and enter a command of the following form:

    CD "pathname"

  5. Type:

    DIR

  6. To view a log in Notepad, find the name of the log file and type:

    NOTEPAD "filename"

Value Description

cluster-name

The name of the cluster that you want to generate a log for.

"pathname"

The drive and path of the log file that you want to generate or that was generated.

"filename"

The name of the log file that was generated.

To view the complete syntax for this command, at a command prompt, type:

CLUSTER LOG /?

Additional references