Cluster Events Query Incomplete

I have a six-node 2012 R2 Failover Cluster running Hyper-V. When I go to Cluster Events, it says on the title: "Cluster Events (0 events, query incomplete)". When I query one node at a time, only node 2 returns results, and every other
node says "query incomplete". I can read all the event logs separately through remote MMC. What does this mean, "Cluster Events (query incomplete)", and how do I get all the nodes to report in?

Hi rpseekell,
Please refer the following article to confirm whether this node FailoverClustering ETW session is running. Please install the Recommended hotfixes and updates for Windows
Server 2012 R2-based failover clusters updates.
The related article:
View Events and Logs for a Failover Cluster
http://technet.microsoft.com/en-us/library/cc772342.aspx
Recommended hotfixes and updates for Windows Server 2012 R2-based failover clusters
http://support.microsoft.com/kb/2920151
How to create the cluster.log in Windows Server 2008 Failover Clustering
http://blogs.msdn.com/b/clustering/archive/2008/09/24/8962934.aspx
Windows Server 2008 and R2 Cluster Log Appears to Be Missing Gaps of Data
http://blogs.technet.com/b/thbrown/archive/2010/07/31/windows-server-2008-and-r2-cluster-log-and-missing-gaps-of-data.aspx
The similar thread:
Cluster events not written to system event log
http://social.technet.microsoft.com/Forums/windowsserver/en-US/b713b63c-4674-4491-847c-75c6f8b9ea55/cluster-events-not-written-to-system-event-log
How to find event log and system information of Nodes in Cluster
http://social.technet.microsoft.com/Forums/windowsserver/en-US/59365d4f-1a10-4c6d-bead-496bf67628e2/how-to-find-event-log-and-system-information-of-nodes-in-cluster?forum=sqlgetstarted
I’m glad to be of help to you!
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Similar Messages

[Bug?] DSC - Clusters Different between 'Read Alarm.vi' and 'Alarm and Event Query.vi" but Contain 'Same' Data

Howdy!
Why are the clusters different coming out of the Read Alarm.vi and the Alarm and Event Query.vi when they have the exact same data?
The only difference is the order of two last elements.
I am leaning towards bug on this one, unless these clusters need to be distinct for some reason?
Certified LabVIEW Architect * LabVIEW Champion

Thanks for posting Ravens Fan
I re-jiggered my API to reverse my datatypes then applied changes to my application code.
It wasn't that painful to update.
My current understanding is that this bug affects one VI, so I decided it was easier to wrap that VI with the bugfix.
Attached is my implementation if anyone wants it too.
Cheers
-JG
[LV 2009]
Certified LabVIEW Architect * LabVIEW Champion
Attachments:
Alarm & Event Query_bugfix.vi ‏30 KB
Convert Alarm And Event Query Cluster.vi ‏21 KB

Alarm & Event Query To Spreadsheet File VI doesn't work correctly (DSC 7.1)

I am using the Alarm & Event Query To Spreadsheet File VI to write alarms/events to an Excel spreadsheet. However there are two things it does wrong:
1. Global variables in the header are not correctly inserted. I am using the header "{creationDate}{delimiter}{creationTime}" but none of the variables are translated to their actual values. The same header in Write Traces To Spreadsheet VI works correctly, so I assume it is only the Alarm & Event Query To Spreadsheet File VI that isn't working.
2. My display format is set to display the date of the alarms but it never appears. Set time/ACK time, etc all appear, just not the date.
Can anyone explain what might be wrong?

Hi AndrewWilliams,
I have been looking into this problem for you and I can't quite figure out exactly what it is you are trying to do. Could you possibly send me your VI's (for the Alarm & Event Query To Spreadsheet File VI and for the Write Traces To Spreadsheet VI) so I can get a better idea of it.
Have you looked at the Export Alarms to File VI in the LabVIEW examples that are installed with the DSC module. This is a very good VI and it might help you to see any faults in your code.
Hope this helps, I look forward to speaking to you soon.
Best regards,
Peter H.
Applications Engineer.
National Instruments.

Alarm & Event Query To Spreadsheet.vi

dear all,
i m using "Alarm & Event Query To Spreadsheet.vi" for alarm transfer using following inputs
1. Filter
2.Display Format
3. Output file path(C:\Program Files\National Instruments\LabVIEW 7.1\*.ALR)
and Database URL it will take by default i.e current tagfile.scf
on running this i get following error
"HIST_AlarmsToSpreadsheet.vi, Citadel: (Hex 0x8ABC1008) Read alarm failed because of connection or query failure."
if i give the database URL manually in the following way
\\computer name\Labview
then i get the following error out
"HIST_AlarmsToSpreadsheet.vi, IAK_SHARED: (Hex 0x8ABC700A) Not found."
so pls solve my problem as early as possible for u
thanks and regards,
dhanwanti

Hi dhanwanti,
There could be a couple possibilities here -- one is that the database you are trying to reference has become disconnected -- Make sure you can see historical data in MAX. If needed, reconnect your database or create a new one and change this in the .scf file in the Tag Configuration Editor.
Another possibility is that some of the parameters you have set in the filtering could be incorrect such as start and stop time. I would suggest creating a simple test VI to make sure you can get the Alarm & Event Query To Spreadsheet.vi working, and then double check how it integrates into your project. You may also want to take a look at the example that ships with the DSC Module for this VI, found in the Example Finder under Toolkits and Modules » Datalogging and Supervisory Control » Alarms and Events » Export Alarms to File.VI.
Doug M
Applications Engineer
National Instruments
For those unfamiliar with NBC's The Office, my icon is NOT a picture of me

Alarm and Event Query Very Slow

Group,
I am using the DSC Alarm and Event Query vi to pull data from the SQL database (not the Citadel). I have a filter set up that specifies the "Alarm Area" and the start and stop dates with maximun results set to 22. These dates are set to only pull the last 24 hrs. This vi will return around 10 to 20 entries out of perhaps 80-90 total events in the last 24 hours in the database. This database is ~2M in size. I have to set the timeout to almost 10 min for this vi to not produce a timeout error. The results returned are correct but it just seems that the time to run this vi is excessive. It is quering a database on the same system that the quering vi is running on. Should I expect better preformance?
Thanks
Todd

Verne,
I have boiled down the code to this attachment. This query took almost 7 min to return 22 results from a database size that is listed as 2.09877E+6. I have also tried the Alarms and Event Query to spreadsheet vi also and it takes the same amount of time. I am wondering if I place the Alarms and Events into the same (Citidel) database that the traces are going if it would be much faster. I seem to get trace data back very fast. If I recall correctly I seperated the alarms from the trace because I was having some sort of problem accessing the alarm data in the combined database...but that was several labVIEW versions ago. Anyone else having this problem?
Thanks
Todd
Attachments:
Generate Alarm Log General Test.vi ‏19 KB

Cluster Event Warning after Installing SCDPM 2012 R2

Hi
I just installed SCDPM 2012 R2 on Server 2012 R2 Box (that is also a cluster node), after installing the SCDPM 2012 R2 on Hyper-V Cluster Node i am getting below Warning in Cluster Events. I just want to know what are the impact of this event ..??
Is it also impacts on SCDPM Backup??? is any solution to resolve this warning.
Error
Shailendra Dev

Hi Shailendra Dev,
This event can caused by third Party filter driver has been identified, you can refer the following article to find out the incompatible driver then uninstall the software.
More related information:
Troubleshooting ‘Redirected Access’ on a Cluster Shared Volume (CSV)
http://blogs.technet.com/b/askcore/archive/2010/12/16/troubleshooting-redirected-access-on-a-cluster-shared-volume-csv.aspx
Allocated Altitudes
http://msdn.microsoft.com/en-us/library/windows/hardware/dn265170(v=vs.85).aspx
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Auditing cluster events - can we see who paused a node?

Hello
We have a 2 node cluster with an active passive configuration - running server 2008 r2 / SQL 2008
We had an issue today where one of the nodes was paused; and the active node had an issue with the cluster services, which ended up taking the resources offline (as you would expect)
I fixed the issue via resuming the paused node; failing over the resources and restarting the cluster services - and bringing the resources back online
Im trying to find out the 'why' behind the inactive node being left paused, as such i want to know if there are any events logged when a node is paused (i.e. a security event)
I did a test scenario on the server, I paused the node but nothing is logged in any of the usual event places. Does the inactive node have to be left paused for a certian period of time before the cluster events / cluster operations log start logging things?
Any help would be appreciated

Hello,
After checking the cluster related logs and systme/application logs, it appears that there're no logs recorded when pausing a cluster node.
And generally, pausing a node is usually done when applying software updates to the node, where the recommended sequence is to move all services and applications off of the node, pause the node, then apply software updates to the node.
You may refer to the following link for more information.
Pause or Resume a Node in a Failover Cluster
http://technet.microsoft.com/en-us/library/cc731291.aspx
Best Regards,
Sophia Sun
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
Thanks - I was afraid of that
I know that pausing a node is only usually done when updating / patching etc, but windows updates fore this cluster are not done whatsoever - which put me down this path to begin with
Appreciate everyones input on this

In the Alarm & Event Query VI how to show the alarm data

In the Alarm & Event Query VI how to show the alarm data in the front pannel using the table or multicolumn listbox .thank you very much！！！

Hi,
Most likely there is something wrong with your specific database or your LabVIEW DSC installation. I just used the Alarm & Event Query.vi in my machine and it seems to work fine, I can see all the alarms as well as events containned in the database.
You may considerer generate another database (change the logging directory) and see if the behavior goes away. Also, make sure you have alarms and events on that database.
I could run the Alarm & Query.vi by just openning its front panel and placing the correct database in the appropriated control.

"Cluster Events" via powershell

I have been looking around and am not seeing what i need.
I am just wanting to get what is listed in the "Cluster Events" via powershell.

Hi,
You can sue the
Get-ClusterLog cmdlets to view the cluster log.
The related KB:
Get-ClusterLog
http://technet.microsoft.com/en-us/library/hh847315.aspx
More information:
Failover Clusters Cmdlets in Windows PowerShell
http://technet.microsoft.com/en-us/library/hh847239.aspx
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Query on view cluster event trigger during transport

Hi SAP Gurus,
I would just like to ask if the subroutines set in events for view clusters would also get triggered upon transport.
We had created a function module which is meant to regenerate a dynamic program when changes are made to a particular table. We're planning to call this function module in a subroutine that is called during an event in the view cluster (set to "before saving the data to database"). However, we would also like for this dynamic program to be regenerated automatically once the table changes are transported to the test/prod systems. Thus, I wondered if setting up the event is sufficient, and that it would also be triggered automatically prior to saving the changes to the database during transport, or if we still need to set up XPRA for this.
Thanks!

Some events are triggered when exportingthe changed data,
- 10 After creating the change request header entries (E071)
- 11 After changing a key entry in the change request (E071K)
- 12 After changing the key entries in the change request (E071K)
which are suitable to add a XPRA entry in the request
But many events (AFAIK those without dialog) are triggered during import (and we can check if the program is called via transaction or import via flag VIM_IMPORT_MODE_ACTIVE, eg. do not execute a form which fill hidden fields like created by and created at.)
Regards,
Raymond

IPS event query ** Help needed badly**

Greetings all. Apologies for the dramatic headline but I'm in a bit of a time crunch.
I have a 4215 running 6.0(3)E1. The device is inline. Below is an event which triggered,
========================
evIdsAlert: eventId=1184881408377311643 severity=low vendor=Cisco
originator:
hostId: xyz
appName: sensorApp
appInstanceId: 380
time: 2007/09/24 15:11:25 2007/09/24 15:11:25 UTC
signature: description=Recognized content type id=12673 version=S149
subsigId: 0
sigDetails: Recognized content type
marsCategory: Info/Misc
interfaceGroup: vs0
vlan: 0
participants:
attacker:
addr: locality=any a.a.a.a
port: 80
target:
addr: locality=any b.b.b.b
port: 51095
os: idSource=unknown relevance=relevant type=unknown
actions:
deniedFlow: true
context:
fromAttacker: <stuff>
riskRatingValue: attackRelevanceRating=relevant targetValueRating=medium 50
threatRatingValue: 15
interface: fe2_1
protocol: tcp
========================
I have an external application which pull this same event from the sensor using a query *like* the following,
wget --user foo --password hoo http://a.b.c.d/cgi-bin/event-server?events=evAlert
I'm able to pull most of the event information but not all. What I can't seem to get from query is the " deniedFlow: true" value. I'm seeing something like,
></attack></participants><actions></actions></evAlert>
Notice the "deniedFlow: true" information missing between action.
Is my wget-ish query missing some arguments which is preventing me from pulling all the same information I can see from the CLI?
Thanks in advance.

The problem is that you are using the 5.x-style event-server and so you do not see all of the event fields. You need to change the app to pull from the "sdee-server" and then you will see all of the event fields:
http://a.b.c.d/cgi-bin/sdee-server?events=evAlert

Failover Cluster events through email

Team,
I'm trying to get Windows Server 2008 Failover clustering events through email. I don't see "Attach a task" option in Clustering events.
Could anybody suggest how to accomplish it. Please note down we have a 4 node cluster and would like to run the script on remote computer.
Thanks

Hi Reddy, this forum is not for writing scripts. Please request in this
link
You can try help like shown below
help Send-MailMessage -Detailed
help Get-EventLog -Detailed
help Get-WinEvent -Detailed
If you need further help post here
Regards Chen V [MCTS SharePoint 2010]
Hi Chen, It seems to be you misunderstood my question. I was looking for Attach a task" option in Clustering events. Do you see this option in clustering events? You can see the same in event viewer but not in clustering events

Windows Server 2012r2 Failover Cluster Event Trace Log files

Hi
The only documentation I can find regarding event trace log files (Diagnostic.etl.*) for Failover Clustering relate to Server 2008/2008r2, which state that the etl files should be in C:\Windows\System32\winevt\Logs.
I have been exploring a clustering lab for Server 2012r2 and cannot find these files in that folder.
Strangely the PS cmdlet Get-ClusterLog still works!
Where are the etl files?
TIA

Hi,
Please check if the log is available in C:\ProgramData\Microsoft\Windows\WER\ReportQueue\.
If not, you can use Get-ClusterLog with the Destination parameter to get the log file.
Destination
Specifies the location to copy the cluster log(s) to. To copy to the current folder use "-Destination ." for this parameter.
http://technet.microsoft.com/en-us/library/ee461045.aspx
Thanks.
Jeremy Wu
TechNet Community Support

Solaris cluster event log

Someone please tell me there is a way to get readable data from the even log in /var/cluster/log. I'm not finding anything in my searches, so I really hope I'm just overlooking something simple. Thanks in advance for any help.

Hi,
there's a binary called showev4 but I do not remember from where I've downloaded it. :)
Sun Cluster 3.x series clusters records event logs as binary log files. Log files can not be read with standard cluster commands. showev4 is a binary to read these log files.
Usage :
./showev4 /var/cluster/logs/eventlog
Sample output :
Tue May 29 08:37:38 2007
class: EC_Cluster subclass: ESC_cluster_gds_probe
vendor: SUNW pub: gds pid: 2347
cluster_id: 0x45E81ADA cluster: test3210g node: testxdb1
ts_sec: 1180417058 ts_usec: 538717
severity: 0 (Info) initiator: 3 (Agent)
r_name: mysql-server
rg_name: mysql-rg status_msg: Probe has been executed with exit code 0 [opt/SUNWscmys/bin/probe_mysql -R mysql-server -G mysql-rg -B /global/mysql -D /global/mysql-data -U mysql -H mysql-IP -F fmuser%fmuser -L /global/mysql-data/logs -C ]
Tue May 29 08:37:38 2007
class: EC_Cluster subclass: ESC_cluster_gds_probe
vendor: SUNW pub: gds pid: 2347
cluster_id: 0x45E81ADA cluster: test3210g node: testxdb1
ts_sec: 1180417058 ts_usec: 539543
severity: 0 (Info) initiator: 3 (Agent)
r_name: mysql-server
rg_name: mysql-rg status_msg: The probe result is 0

Can we monitor Sun Cluster events

Hi,
Whenever there are some events, issues in cluster, we see logs on the node consoles regarding the same. Is there any way to capture these
events through some other application? Better, is there any way by which we can send these events, in some standard format (protocol way) to some application that can send emails etc to administrators so that one need not keep eye continuously on the console for issus in cluster?

Well, I did not get a chance to experiment with CRNP, however, came up with a strategy that can be used.
First of all, we can do this with Solaris 9 and above as we do not have a resource type SUNW.Event available with Solaris 8. This resource type needs to be registered with only one resource group on the cluster, the resource group can be related to your data service.
So, one should first get the file SUNW.Event from the cluster source, copy it at /usr/cluster/lib/rgm/rtreg, also, copy corresponding RT_BASEDIR contents mentioned in this file at appropriate location. This directory contains start, stop, check and monitor scripts.
One can set the required properties SUNW.Event.
All this needs to be done on all the nodes.
The properties of this resource type cover the port and logical address (which is usually the cluster address) where the events would be sent. One can then write a client to listen to this port and process the events.
Hope this clarifies the point, please confirm if you see any issues with this.

Cluster Events Query Incomplete

Similar Messages

Maybe you are looking for