Event Logs of VMs Migration in Hyper-V Cluster

Hello All,
We're running Failover Cluster of Win Server 2012 R2 Hyper-V hosts. If any host gets down unexpectedly (due to any reason power/bugcheck/hardware failure or what so ever), then the VMs on that host, of course, get migrated (either quick or live) to some
other host within the cluster.
I want to have logs/events of this VMs migration. I want to know that which of the VMs were residing on that host at that time of failure. Of course, we can't have this info in the Cluster events is Failover Cluster Manager. I am unable to find this info
anywhere. I have searched in Event Viewer --> Administrative Roles --> Hyper-V. I have searched a lot in the SCVMM, but no success. We're using SCVMM 2012 R2 with UR5.
Please help me in finding the exact location of these logs/events. I would also like to know that if the VM was quick migrated or live migrated, and to which host the VM got migrated.
I'd be highly grateful.
Thanks in anticipation.
Regards,
Hasan

You have posted this same question in two different forums.  The answer on where to look is posted in the other forum. 
https://social.technet.microsoft.com/Forums/en-US/7f0da2a8-debc-4dd8-9214-72ed46e3c76b/event-logs-of-vms-migration-in-failover-cluster-of-hyperv-hosts?forum=winserverhyperv
In the future, forum etiquette requests that you do not cross-post.
Again, when a host fails, there is no migration, quick or live, to another node of the cluster.  There is a restart.  When a host fails, the VMs on that host also fail.  The cluster detects the failure and the resources (VMs) that had
been running on the failed node are restarted on another node.  You will see different events entered into the event log for a resource start than for a quick/live migration.
The easiest way to see this is to do it.  Open up the event viewer on a host to which you plan to migrate a VM.  Perform a quick/live migration.  Refresh the event viewer and note the events that were logged.
. : | : . : | : . tim

Similar Messages

  • Event Logs of VMs Migration in Failover Cluster of Hyper-V Hosts

    Hello All,
    We're running Failover Cluster of Hyper-V hosts of Windows Server 2012 R2. Using SCVMM 2012 R2 with UR5 for management.
    If any host gets down unexpectedly (due to any reason power/bugcheck/hardware failure or what so ever), then the VMs on that host, of course, get migrated (either quick or live) to some other host within the cluster.
    I want to have logs/events of this VMs migration. I want to know that which of the VMs were residing on that host at that time of failure. Of course, we can't have this info in the Cluster events is Failover Cluster Manager. I am unable to find this info
    anywhere. I have searched in Event Viewer --> Administrative Roles --> Hyper-V. I have searched a lot in the SCVMM, but no success.
    Please help me in finding the exact location of these logs/events. I would also like to know that if the VM was quick migrated or live migrated, and to which host the VM got migrated.
    I'd be highly grateful.
    Thanks in anticipation.
    Regards,
    Hasan Bin Hasib

    This post was cross-posted in the clustering forum.  As noted in that forum, a failure of a host does not initiate a quick or live migration.  Migration requires both the source and destination nodes be operational during the entire migration
    process.  Should a host fail, it is impossible for that host to participate in a migration.  In the case of a host failure, the VM is restarted on another node of the cluster.  You can still use the information provided by Elton for viewing
    events in the event log.  If you want to see the exact sequence of log entries, perform quick/live migrations in a lab and notices the changes in the event log.  You can also fail a host and see the sequence of log entries.
    . : | : . : | : . tim

  • No events logged while VMS offline

    IDS and VMS are working fine, the issue is when my Windows box running VMS goes offline(crash, reboot....). I bring the VMS box back online and poll the IDS, but it reports no events.
    I tested it by running Nessus while the VMS box is offline, from the CLI I see events, but when the VMS box comes online and polls the IDS....Nothing...
    Do I need to setup the IDS to store the events until the VMS box can poll again?
    Thanks,
    Jamey

    I did a "sh event alert past 23:00" and it does show the old alerts, however security monitor still does not show then. It only show alerts that happen while it is connected.
    I cleared the alerts on the IDS. ran Nessus, then did "sh event alert past 23:00" and it did show the past events (from the nessus scan). I then turned on the VMS box. But security monitor does not show any events (it is set show earliest).
    Any other thoughts?
    Jamey

  • Event Log Replication on Cluster Server (MS Server 2003)

    Please help me about the EnableEventLogReplication on SERVER 2003. I just saw the recommended on MS support about it.
    "If the EnableEventLogReplication registry entry is set to 1, the cluster node replicates events in the event log to all other nodes in the cluster. Tools that monitor multiple
    servers, report a single event multiple times, one time from each node. "
    I have got the problem about event logs replicates and hard to summary event logs on all nodes. If I want to disable this function I would like to know the effect about this one. it will not replicates events and will not get any worse cases on the server
    that my customer using? Could you please advise?

    As you mentioned, if you disable EnableEventLogReplication, Event Log Replication will be disable for one or more node in the cluster or the entire cluster. One or more cluster node is down or has experienced a failure, and preventing Event Log Replication
    from taking place.
    Note: if you disable the replication at a specific node, replication of events from that node to other nodes is disabled. Other nodes that have the EnableEventLogReplication property turned on still replicate to that node. This only replicates the System,
    Application and Security event logs.
    http://support.microsoft.com/kb/229071/en-us
    http://support.microsoft.com/default.aspx?kbid=224969

  • Running domain controller as VMs on a hyper-v 2012 cluster

    Hi gurus
    I have a question. I want to run two VMs on a Hyper-v cluster. I want to make these VMs as domain controller and leverage the cluster. Can I do this? I have not been able find any information on this. The hyper-v is running on windows 2012, but it can be
    upgraded to R2 if there are any benefits associated with this.
    Any help will be appreciated.
    Regards

    Hi,
    Additional, you can deploy your DC on failover cluster, but we recommend that your clustered servers be member servers. If they are, you need an additional server that acts
    as the domain controller in the domain that contains your failover cluster.
    And same time, you should attempt to avoid creating potential single points of failure when you plan your virtual domain controller deployment. You can avoid introducing potential
    single points of failure by implementing system redundancy. For example, consider the following recommendations while keeping in mind the potential for increases in the cost of administration:
    1. Run at least two virtualized domain controllers per domain on different virtualization hosts, which reduces the risk of losing all domain controllers if a single virtualization
    host fails.
    2. As recommended for other technologies, diversify the hardware (using different CPUs, motherboards, network adapters, or other hardware) on which the domain controllers
    are running. Hardware diversification limits the damage that might be caused by a malfunction that is specific to a vendor configuration, a driver, or a single piece or type of hardware.
    3. If possible, domain controllers should be running on hardware that is located in different regions of the world. This helps to reduce the impact of a disaster or failure
    that affects a site at which the domain controllers are hosted.
    4. Maintain physical domain controllers in each of your domains. This mitigates the risk of a virtualization platform malfunction that affects all host systems that use that
    platform.
    The related KB:
    Hyper-V: Using Hyper-V and Failover Clustering
    http://technet.microsoft.com/es-es/library/cc732181(v=ws.10).aspx
    Running Domain Controllers in Hyper-V
    http://technet.microsoft.com/en-us/library/d2cae85b-41ac-497f-8cd1-5fbaa6740ffe(v=ws.10)#usn_and_usn_rollback
    Hope this helps.
    We
    are trying to better understand customer views on social support experience, so your participation in this
    interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

  • Migration of VMs from WS2012 Hyper-V Hosts Cluster to WS2012 R2 Hyper-V Hosts Cluster

    Hello All,
    We’re currently running our production VMs on a Failover Cluster of Windows Server 2012 Hyper-V Hosts. We’re planning to migrate these VMs to the cluster of
    Windows Server 2012 R2 Hyper-V Hosts.
    I have created a failover cluster of Windows Server 2012 R2 Hyper-V Hosts, and successfully tested the HA of my new test VMs on this new cluster.
    Anyone please tell me the procedure, steps and best practices to migrate these VMs from Windows Server 2012 Hyper-V Hosts to Windows Server 2012 R2 Hyper-V
    Hosts.
    Thank you.
    Regards,
    Hasan Bin Hasib

    Hi Hasan Bin Hasib,
    You can refer the following related cross-version live migration KB:
    Hyper-V: Migration Options
    https://technet.microsoft.com/en-us/library/dn486792.aspx?f=255&MSPPError=-2147217396
    I’m glad to be of help to you!
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

  • VSS snapshot of 1.1TB is ending after few hours with timeout. No errors in event log

    Hello,
    does someone have experienced issue where starting making snapshot (forum GUI or command line) is taking a lot of time and then it just ends with timeout?
    I have scenario on virtualised Windows Web Server 2008 R2 where backup is being made by Idera Backup Software but since it relies on VSS Snapshots then we can just skip this point because making snapshots from directly Windows command line or drive preferences/GUI
    is ending with timeout for this single drive after few hours. Affected system has 3 drives: C - 95GB, D-1.06TB and E-120GB. C and E can be backuped correctly and only drive D has problems. System is updated with latest drivers vssadmin for writers returns
    list without any errors and snapshot for drive D which ends with timeout is not generating any error in event log. I wanted to configure VSS trace like it is being instructed on this site:
    http://publib.boulder.ibm.com/infocenter/tsminfo/v6/index.jsp?topic=%2Fcom.ibm.itsm.tshoot.doc%2Ft_pdg_traceprfrm.html
    but I don't see any trace.txt file on given location. If I remove drive D from backup process it ends without errors. System was restarted many times. Only thing which is visible in windows Event log (application part) is that "The VSS service is shutting
    down due to idle timeout." about 4 hours after snapshot making proces is starting.
    I've contacted Idera backup about this but they can't help too much if Windows snapshot process is failing. They suggested that something can be wrong with this drive but since this is virtualised machine and all of my VM are being stored on RAID10 disk
    array connected to my server using fiber connections then I don't think that this is hardware issue (especially when other two drives are located on the same LUN on disk array).
    Any suggestions?
    Regards

    Hi,
    Do you create VMs on Hyper-V or VMWare? Based on research, possible causes could be:
    1. Files changes in the volume is very huge. So the shadow size may be big and the current shadow storage my not able to hold it. And that’s cause the shadow copy creation failure. 
    2. The I/O in D drive is heavy and make the shadow copy I/O failed. 
    3. Server is too busy to handle the request.
    4. The disk is heavily defragment.
    Please refer to the articles to troubleshoot the issue:
    Time-out errors occur in Volume Shadow Copy service writers, and shadow copies are lost during backup and during times when there are high levels of input/output
    http://support.microsoft.com/kb/826936/en-us
    VSS timeouts during backup? What could contribute to that?
    https://blogs.technet.com/b/askpfeplat/archive/2012/09/12/vss-timeouts-during-backup-check-fragmentation.aspx
    Regards,
    Mandy
    We
    are trying to better understand customer views on social support experience, so your participation in this
    interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

  • Seemingly successful install of Exchange 2013 SP1 turns into many errors in event logs after upgrade to CU7

    I have a new Exchange 2013 server with plans to migrate from my current Exchange 2007 Server. 
    I installed Exchange 2013 SP1 and the only errors I saw in the event log seemed to be long standing known issues that did not indicate an actual problem (based on what I read online). 
    I updated to CU7 and now lots of errors have appeared (although the old ones seem to have been fixed so I have that going for me). 
    Currently the Exchange 2013 server is not in use and clients are still hitting the 2007 server.
    Issue 1)
    After each reboot I get a Kernel-EventTracing 2 error.  I cannot find anything on this on the internet so I have no idea what it is.
    Session "FastDocTracingSession" failed to start with the following error: 0xC0000035
    I did read other accounts of this error with a different name in the quotes but still can’t tell what this is or where it is coming from.
    Issue 2)
    I am still getting 5 MSExchange Common 106 errors even after reregistering all of the perf counters per this page:
    https://support.microsoft.com/kb/2870416?wa=wsignin1.0
    One of the perf counters fails to register using the script from the link above.
    66 C:\Program Files\Microsoft\Exchange Server\V15\Setup\Perf\InfoWorkerMultiMailboxSearchPerformanceCounters.xml
    New-PerfCounters : The performance counter definition file is invalid.
    At C:\Users\administrator.<my domain>\Downloads\script\ReloadPerfCounters.ps1:19 char:4
    +    New-PerfCounters -DefinitionFileName $f
    +    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        + CategoryInfo         
    : InvalidData: (:) [New-PerfCounters], TaskException
        + FullyQualifiedErrorId : [Server=VALIS,RequestId=71b6bcde-d73e-4c14-9a32-03f06e3b2607,TimeStamp=12/18/2014 10:09:
       12 PM] [FailureCategory=Cmdlet-TaskException] 33EBD286,Microsoft.Exchange.Management.Tasks.NewPerfCounters
    But that one seems unrelated to the ones that still throw errors. 
    Three of the remaining five errors are (the forum is removing my spacing between the error text so it looks like a wall of text - sorry):
    Performance counter updating error. Counter name is Count Matched LowFidelity FingerPrint, but missed HighFidelity FingerPrint, category name is MSExchange Anti-Malware Datacenter Perfcounters. Optional code: 3. Exception: The
    exception thrown is : System.InvalidOperationException: The requested Performance Counter is not a custom counter, it has to be initialized as ReadOnly.
       at System.Diagnostics.PerformanceCounter.InitializeImpl()
       at System.Diagnostics.PerformanceCounter.set_RawValue(Int64 value)
       at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.set_RawValue(Int64 value)
    Last worker process info : System.ArgumentException: Process with an Id of 7384 is not running.
       at System.Diagnostics.Process.GetProcessById(Int32 processId)
       at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.GetLastWorkerProcessInfo()
    Performance counter updating error. Counter name is Number of items, item is matched with finger printing cache, category name is MSExchange Anti-Malware Datacenter Perfcounters. Optional code: 3. Exception: The exception thrown
    is : System.InvalidOperationException: The requested Performance Counter is not a custom counter, it has to be initialized as ReadOnly.
       at System.Diagnostics.PerformanceCounter.InitializeImpl()
       at System.Diagnostics.PerformanceCounter.set_RawValue(Int64 value)
       at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.set_RawValue(Int64 value)
    Last worker process info : System.ArgumentException: Process with an Id of 7384 is not running.
       at System.Diagnostics.Process.GetProcessById(Int32 processId)
       at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.GetLastWorkerProcessInfo()
    Performance counter updating error. Counter name is Number of items in Malware Fingerprint cache, category name is MSExchange Anti-Malware Datacenter Perfcounters. Optional code: 3. Exception: The exception thrown is : System.InvalidOperationException:
    The requested Performance Counter is not a custom counter, it has to be initialized as ReadOnly.
       at System.Diagnostics.PerformanceCounter.InitializeImpl()
       at System.Diagnostics.PerformanceCounter.set_RawValue(Int64 value)
       at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.set_RawValue(Int64 value)
    Last worker process info : System.ArgumentException: Process with an Id of 7384 is not running.
       at System.Diagnostics.Process.GetProcessById(Int32 processId)
       at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.GetLastWorkerProcessInfo()
    Issue 3)
    I appear to have some issues related to the healthmailboxes. 
    I get MSExchangeTransport 1025 errors for multiple healthmailboxes.
    SMTP rejected a (P1) mail from 'HealthMailbox23b10b91745648819139ee691dc97eb6@<my domain>.local' with 'Client Proxy <my server>' connector and the user authenticated as 'HealthMailbox23b10b91745648819139ee691dc97eb6'. The Active Directory
    lookup for the sender address returned validation errors. Microsoft.Exchange.Data.ProviderError
    I reran setup /prepareAD to try and remedy this but I am still getting some.
    Issue 4)
    I am getting an MSExchange RBAC 74 error. 
    (Process w3wp.exe, PID 984) Connection leak detected for key <my domain>.local/Admins/Administrator in Microsoft.Exchange.Configuration.Authorization.WSManBudgetManager class. Leaked Value 1.
    Issue 5)
    I am getting MSExchange Assistants 9042 warnings on both databases.
    Service MSExchangeMailboxAssistants. Probe Time Based Assistant for database Database02 (c83dbd91-7cc4-4412-912e-1b87ca6eb0ab) is exiting a work cycle. No mailboxes were successfully processed. 2 mailboxes were skipped due to errors. 0 mailboxes were
    skipped due to failure to open a store session. 0 mailboxes were retried. There are 0 mailboxes in this database remaining to be processed.
    Some research suggested this may be related to deleted mailboxes however I have never had any actual user mailboxes on this server. 
    If they are healthmailboxes or arbitration mailboxes that might make sense but I am unsure of what to do on this.
    Issue 6)
    At boot I am getting an MSExchange ActiveSync warning 1033
    The setting SupportedIPMTypes in the Web.Config file was missing. 
    Using default value of System.Collections.Generic.List`1[System.String].
    I don't know why but this forum is removing some of my spacing that would make parts of this easier to read.

    Hi Eric
    Yes I have uninstalled and reinstalled Exchange 2013 CU7 for the 3<sup>rd</sup> time. 
    I realize you said one issue per forum thread but since I already started this thread with many issues I will at least post what I have discovered on them in case someone finds their way here from a web search.
    I have an existing Exchange 2007 server in the environment so I am unable to create email address policies that are defined by “recipient container”. 
    If I try and do so I get “You can't specify the recipient container because legacy servers are detected.”
     So I cannot create a normal email address policy and restrict it to an OU without resorting to some fancy filtering. 
    Instead what I have done is use PS to modify extensionAttribute1 (otherwise known as Custom Attribute 1 to exchange) for all of my users. 
    I then applied an address policy to them and gave it the highest priority. 
    Then I set a default email address policy for the entire organization. 
    After reinstalling Exchange all of my system mailboxes were created with the internal domain name. 
    So issue number 3 above has not come up. 
    For issue number one above I have created a new thread:
    https://social.technet.microsoft.com/Forums/office/en-US/7eb12b89-ae9b-46b2-bd34-e50cd52a4c15/microsoftwindowskerneleventtracing-error-2-happens-twice-at-boot-ex2013cu7?forum=exchangesvrdeploy
    For issue number four I have posted to this existing thread where there is so far no resolution:
    https://social.technet.microsoft.com/Forums/exchange/en-US/2343730c-7303-4067-ae1a-b106cffc3583/exchange-error-id-74-connection-leak-detected-for-key?forum=exchangesvradmin
    Issue number Five I have managed to recreate and get rid of in more than one way. 
    If I create a new database in ECP and set the database and log paths where I want, then this error will appear. 
    If I create the database in the default location and then use EMS to move it and set the log path, then the error will not appear. 
    The error will also appear (along with other errors) if I delete the health mailboxes and let them get recreated by restarting the server or the Health Manager service. 
    If I then go and set the retention period for deleted mailboxes to 0 days and wait a little while, these will all go away. 
    So my off hand guess is that these are caused by orphaned system mailboxes.
    For issue number six I have posted to this existing thread where there is so far no resolution:
    https://social.technet.microsoft.com/Forums/exchange/en-US/dff62411-fad8-4d0c-9bdb-037374644845/event-1033-msexchangeactivesync-warning?forum=exchangesvrmobility
    So for the remainder of this thread we can try and tackle issue number two which is the perf counters. 
    The exact same 5 perf counter were coming up and this had been true each time I have uninstalled and reinstalled Exchange 2013CU7. 
    Actually to be more accurate a LOT of perf counter errors come up after the initial install, but reloading the perf counters using the script I posted above reduces it to the same five. 
    Using all of your suggestions so far has not removed these 5 remaining errors either.  Since there is no discernible impact other than these errors at boot I am not seriously bothered by them but as will all event log errors, I would prefer
    to make them go away if possible.

  • Cluster Quorum Disk failing inside Guest cluster VMs in Hyper-V Cluster using Virtual Disk Sharing Windows Server 2012 R2

    Hi, I'm having a problem in a VM Guest cluster using Windows Server 2012 R2 and virtual disk sharing enabled. 
    It's a SQL 2012 cluster, which has around 10 vhdx disks shared this way. all the VHDX files are inside LUNs on a SAN. These LUNs are presented to all clustered members of the Windows Server 2012 R2 Hyper-V cluster, via Cluster Shared Volumes.
    Yesterday happened a very strange problem, both the Quorum Disk and the DTC disks got the information completetly erased. The vhdx disks themselves where there, but the info inside was gone.
    The SQL admin had to recreated both disks, but now we don't know if this issue was related to the virtualization platform or another event inside the cluster itself.
    Right now I'm seen this errors on one of the VM Guest:
     Log Name:      System
    Source:        Microsoft-Windows-FailoverClustering
    Date:          3/4/2014 11:54:55 AM
    Event ID:      1069
    Task Category: Resource Control Manager
    Level:         Error
    Keywords:      
    User:          SYSTEM
    Computer:      ServerDB02.domain.com
    Description:
    Cluster resource 'Quorum-HDD' of type 'Physical Disk' in clustered role 'Cluster Group' failed.
    Based on the failure policies for the resource and role, the cluster service may try to bring the resource online on this node or move the group to another node of the cluster and then restart it.  Check the resource and group state using Failover Cluster
    Manager or the Get-ClusterResource Windows PowerShell cmdlet.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-FailoverClustering" Guid="{BAF908EA-3421-4CA9-9B84-6689B8C6F85F}" />
        <EventID>1069</EventID>
        <Version>1</Version>
        <Level>2</Level>
        <Task>3</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8000000000000000</Keywords>
        <TimeCreated SystemTime="2014-03-04T17:54:55.498842300Z" />
        <EventRecordID>14140</EventRecordID>
        <Correlation />
        <Execution ProcessID="1684" ThreadID="2180" />
        <Channel>System</Channel>
        <Computer>ServerDB02.domain.com</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
        <Data Name="ResourceName">Quorum-HDD</Data>
        <Data Name="ResourceGroup">Cluster Group</Data>
        <Data Name="ResTypeDll">Physical Disk</Data>
      </EventData>
    </Event>
    Log Name:      System
    Source:        Microsoft-Windows-FailoverClustering
    Date:          3/4/2014 11:54:55 AM
    Event ID:      1558
    Task Category: Quorum Manager
    Level:         Warning
    Keywords:      
    User:          SYSTEM
    Computer:      ServerDB02.domain.com
    Description:
    The cluster service detected a problem with the witness resource. The witness resource will be failed over to another node within the cluster in an attempt to reestablish access to cluster configuration data.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-FailoverClustering" Guid="{BAF908EA-3421-4CA9-9B84-6689B8C6F85F}" />
        <EventID>1558</EventID>
        <Version>0</Version>
        <Level>3</Level>
        <Task>42</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8000000000000000</Keywords>
        <TimeCreated SystemTime="2014-03-04T17:54:55.498842300Z" />
        <EventRecordID>14139</EventRecordID>
        <Correlation />
        <Execution ProcessID="1684" ThreadID="2180" />
        <Channel>System</Channel>
        <Computer>ServerDB02.domain.com</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
        <Data Name="NodeName">ServerDB02</Data>
      </EventData>
    </Event>
    We don't know if this can happen again, what if this happens on disk with data?! We don't know if this is related to the virtual disk sharing technology or anything related to virtualization, but I'm asking here to find out if it is a possibility.
    Any ideas are appreciated.
    Thanks.
    Eduardo Rojas

    Hi,
    Please refer to the following link:
    http://blogs.technet.com/b/keithmayer/archive/2013/03/21/virtual-machine-guest-clustering-with-windows-server-2012-become-a-virtualization-expert-in-20-days-part-14-of-20.aspx#.Ux172HnxtNA
    Best Regards,
    Vincent Wu
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

  • DFSN-Server ID 516 Flooding Event Log

    Good Day,
     Since setting up a Server 2012 server as a DFS root the Administrative Events log is getting flooded with DFSN-Server ID 516 warning events. We have multiple name spaces and we get a message for each every 15 minutes, so for our 6 name spaces
    that is over 500 messages a day.
    DFSN service has started performing complete refresh of metadata for namespace <DFS-Root>. This task can take time if the namespace has large number of folders and may delay namespace administration operations.
    Although I found one solution on the Russian Technet forum DFSN-Server EventID 516 this disables the entire DFSN-Server
    Admin log, so if there are any problems with the refresh they will not appear.
    The main cause of the problem appears to be that the 516 Events have a Warning level 3 for something that should be Information level 4. There is no reason for a warning to be issued for what is a regular update process.
    Thanks,
    James

    What bothers me is that those events mention only "started a complete refresh", but they never mention so far completing one ... weird...
    Thank you Microsoft (sarcasm).
    If you look directly at the log, you'll see this message is quickly followed by ID 517 which states it has completed the refresh.  Event 517 is an informational event, so it won't display in the default "Administrative Events" filter.
    My suggestion to Microsoft:  Change the severity on ID 516 to Informational.  I don't believe
    anyone would consider this routine refresh a warning-level concern!!
    yes, you are right. sorry for super late reply, but I was swamped in company move and server upgrades, new installations, new IP phone system, new IP cams, site-to-site VPN, new faster firewall for new faster Internet link, NAT config changes ... man ...
    a bit too much for a single person to manage sometimes ...
    anyways, I didn't see the 517 events in "Custom Views - Administrative Events" that's why I was alerted with a flood of 516 (there is 1 every 12 minutes), can't understand why MS would drop one informational event (categorized wrongly as warning)
    and not add the other one stating it was completed right after (because it's still informational only) ... I finally found the following 517's when I went to the tree of Apps and Services Logs - MS - Win - DFSN-Server - Admin ... it's kinda buried down there
    very annoying it still is in end of October, especially then I am troubleshooting a non-replication conditions without any errors between two DFS servers (also DC roles installed) running 2012R2. Ended up removing DFS from secondary DC (VM actually) and
    building a new DFS dedicated VM with fixed sized disks on Hyper-V 2012 R2 server, hoping it resolves the issue when replication would just stop without error creating a huge file count (and content!) mismatch over time... a flood of meaningless events in administrative
    logs in not helping with troubleshooting ...

  • Server 2012 R2 Hyper-V Cluster, VM blue screens after migration between nodes.

    I currently have a two node Server 2012 R2 Hyper-v Cluster (fully patched) with a Windows Server 2012 R2 Iscsi target.
    The VMs run fine all day long, but when I try to do a live/quick migration the VM blue screens after about 20 minutes. The blue reports back about a “Critical_Structure_Corruption”.
    I’m being to think it might be down to CPU, as one system has an E-2640v2 and the other one has an E5-2670v3. Should I be able to migrate between these two systems with these type of CPU?
    Tim

    Sorry Tim, is that all 50 blue screen if live migrated?
    Are they all on the latest integration services? Does a cluster validation complete successfully? Are the hosts patched to the same level?
    The fact that if you power them off then migrate them and they boot fine, does point to a processor incompatibility and the memory BIN file is not accepted on the new host.
    Bit of a long shot but the only other thing I can think of off the top of my head if the compatibility option is checked, is checking the location of the BIN file when the VM is running to make sure its in the same place as the VHD\VHDX in the
    CSV storage where the VM is located and not on the local host somewhere like C:\program data\.... that is stopping it being migrated to the new host when the VM is live migrated.
    Kind Regards
    Michael Coutanche
    Blog:   
    Twitter:   LinkedIn:
    Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

  • Cannot open eventlog service on computer '.'. (Windows Event Log service doesn't exist)

    This problem used to be solved after moving a computer object into the appropriate OU and restarting, and if that didn't work, it used to be solved when uninstalling and reinstalling Microsoft FEP (restarts in-between).  Now, the only way to access
    event logs is by logging in as a domain admin, or by accessing event logs through remote manage.
    If a machine object is added to the domain, dropped into the computers container, and restarted, we get this error when going into Computer Management:
    "Cannot open eventlog service on computer '.'."
    The original problem was noticed on our VMs, but I also tried it with a Lenovo Windows 7 build out of the box, added it to our domain, and the problem occurred. When our desktops are built, SCCM's task manager drops it into the appropriate OU immediately,
    so desktops don't have issues.  With VMs, they are dropped into the computers container and restarted, so once this problem occurs, it almost never leaves.  SOMETIMES, removing it from the domain solves the problem, but not always.
    I've tried all of the suggestions I've seen online and none of them have worked, such as cleaning up the policies (through registry, and the appropriate system folders), adding the proper NTFS permissions on the RtBackup folder and %SystemRoot%\System32\winevt\logs, netsh
    winsock reset, cleanboot, etc.
    I did notice that I'm unable to find the NT Service\EventLog user group. I wanted to add it to %systemroot%\system32\winevt\logs, but the group cannot be found on the local computer. Even if that's the problem, why is it missing?
    It doesn't seem like anyone else on the internet gets this exact error.

    Hi Kate!
    Yes, the Windows Event Log service is missing. I had already tried your method (#3), and I did try it again. This is the error I get:
    "The specified service already exists."
    If you check services.msc, it's still not there. If you try to start the Event Viewer, the same error comes up:
    Cannot open eventlog service on computer '.'.
    Hi, 
    Please check for the existence of this key. If not found, create a *.reg file from another machine and import.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
    Then, check the issue again.
    If this doesn't work, let's run System file checker tool to repair system:
    Run SFC command in elevated command prompt
    SFC /scannow
    Any error message, please post here to let me know.
    Keep post.
    Kate Li
    TechNet Community Support

  • VM cannot get IP and shows host MAC in event logs

    I have a strange issue where the VM on a user's laptop worked fine in the office with a Wireless NIC but when he got home we began having some problems (no network in the VM, only get 169.x.x.x IP in the VM, host network connection drops when we try
    to access or configure the networking inside the VM).
    Here is what I know so far:
    Bridge exists on host (wireless NIC to virtual NIC) and is enabled
    Adapter in VM has MAC of 00-15-5D-0A-A5-00, cannot get IP
    VM settings for the wireless NIC show the MAC is Dynamic and the one assigned is within the range setup on the Virtual Switch
    Adapter on host has MAC of 9C-4E-36-AC-83-68, gets IP of 192.168.0.14
    In the VM, you cannot renew or assign an IP, it says the MAC exists on the network and has an address assigned.  Network connectivity also drops if you try to renew the IP
    In the system event logs on the VM, I see TCPIP event 4199, exact message is - The system detected an address conflict for IP address 192.168.0.14 with the system having hardware address 9C-4E-36-AC-83-68.
    There are no errors in the event logs on the host.
    Deleting the NIC inside the VM and removing/re-adding it to the VM settings does not resolve it
    Deleting and recreating the virtual switch does not resolve it
    The option to allow the management OS to also use the wireless NIC is enabled on the virtual switch.
    The wired connection also worked in our office during the build and testing but he doesn't not have a cable at home for me to test the wired there.
    We have another machine which is configured the same way and is working correctly, both in the office and offsite.
    Why is the VM trying to use the host MAC to get an IP, shouldn't it be using the one assigned by Hyper-V?  Could this be an issue with his home office network or maybe specifically with his WAP?  What other items could cause this?
    I have asked my user to go connect to a wireless network in a different location and test it but I haven't heard back from him yet.
    Thanks in advance for any suggestions.

    Hi Milos,
    1 - Unfortunately I can't test this, the router is supplied by his ISP and is not one that we have any management capabilities on.
    2 - Any time I access network information in the VM (even just to run "ipconfig /all" at a command line), the network drops temporarily on the host and I loose access to it.
    3 - I've not used this before, I'll check it out.
    It seemed really odd to me that the VM showed the host MAC in the event logs when everything else in the VM shows the one assigned by Hyper-V.
    Do you know if the "Virtual Networking and Wireless network adapters" entry in Ben Armstrong's Virtualization blog still applies in Windows 8.1?  It won't let me post the link to it directly, sorry.
    I've seen it referred to recent posts but it's from 2005.
    It makes sense if it is since symptom #2 sounds like what I am seeing.

  • How to monitor the performances of VMs & Hyper-v Cluster host node running on SCVMM Cluster.

    hello...,
    How to monitor the performances of VMs & Hyper-v Cluster hosts node running on SCVMM Cluster from SCOM so that we can
    Identify the highest utilized(CPU and Memory ) VM on that from cluster  hyper-v host.
    Identify the lowest utilized (CPU and Memory )Hyper-v Host in the Cluster .
    After identifies VMs and Hyper-v cluster  host on SCVMM , so that we  can  proceed to do migrate the Highest Utilized VM to Lowest Utilized
    Hyper-v cluster host. 
    To identified and implement above ,what are the things I need to do or configured on SCOM.
    Thanks
    RICHA KM

    hello...,
    How to monitor the performances of VMs & Hyper-v Cluster hosts node running on SCVMM Cluster from SCOM
    so that we can
    Identify the highest utilized(CPU and Memory ) VM on that from cluster  hyper-v
    host.
    Identify the lowest utilized (CPU and Memory )Hyper-v Host in the Cluster .
    After identifies VMs and Hyper-v cluster  host on SCVMM , so that we  can  proceed
    to do migrate the Highest Utilized VM to Lowest Utilized Hyper-v cluster host. 
    To identified and implement above ,what are MPs i need to installed on SCOM for implementing
    this.
    Thanks
    RICHA KM

  • [solved] No sound and AMD-Vi: Event logged

    Hello,
    Today I started to migrate my HTPC from openElec to Arch Linux since several things started to annoy me.
    For now, I have made a fresh install and installed XBMC but I can't get audio. It is a AMD setup and has an Asus Xonar XD PCIe card installed. Integrated HD Audio is disabled.
    The user xbmc is in the audio group and when I ssh into the HTPC and try to play a file with aplay I get tons of these on the TV:
    [ 46.215678] AMD-Vi: Event logged [IO_PAGE_FAULT device=02:00.0 domain=0x0000 address=0x0000000000100000 flags=0x0050]
    Channels are unmuted and I priorized the output with the following alsa-base.conf:
    options snd slots=snd_virtuoso
    options snd_virtuoso index=0
    Alsamixer shows the desired sound card as default.
    xbmc@xbmc ~ % LANG= aplay -l
    **** List of PLAYBACK Hardware Devices ****
    card 0: DX [Xonar DX], device 0: Multichannel [Multichannel]
    Subdevices: 1/1
    Subdevice #0: subdevice #0
    card 0: DX [Xonar DX], device 1: Digital [Digital]
    Subdevices: 1/1
    Subdevice #0: subdevice #0
    card 1: HDMI [HDA ATI HDMI], device 3: HDMI 0 [HDMI 0]
    Subdevices: 1/1
    Subdevice #0: subdevice #0
    xbmc@xbmc ~ % aplay -L
    null
    Discard all samples (playback) or generate zero samples (capture)
    default:CARD=DX
    Xonar DX, Multichannel
    Default Audio Device
    sysdefault:CARD=DX
    Xonar DX, Multichannel
    Default Audio Device
    front:CARD=DX,DEV=0
    Xonar DX, Multichannel
    Front speakers
    surround40:CARD=DX,DEV=0
    Xonar DX, Multichannel
    4.0 Surround output to Front and Rear speakers
    surround41:CARD=DX,DEV=0
    Xonar DX, Multichannel
    4.1 Surround output to Front, Rear and Subwoofer speakers
    surround50:CARD=DX,DEV=0
    Xonar DX, Multichannel
    5.0 Surround output to Front, Center and Rear speakers
    surround51:CARD=DX,DEV=0
    Xonar DX, Multichannel
    5.1 Surround output to Front, Center, Rear and Subwoofer speakers
    surround71:CARD=DX,DEV=0
    Xonar DX, Multichannel
    7.1 Surround output to Front, Center, Side, Rear and Woofer speakers
    iec958:CARD=DX,DEV=0
    Xonar DX, Multichannel
    IEC958 (S/PDIF) Digital Audio Output
    hdmi:CARD=HDMI,DEV=0
    HDA ATI HDMI, HDMI 0
    HDMI Audio Output
    Setting iommu=pt as suggested here did not do any trick...
    Does anyone here have a hint of what can be wrong?
    Maybe this is interesting, too. The device, the AMD-Vi-Event refers to, is the mentioned sound card.
    xbmc@xbmc ~ % lspci
    00:00.0 Host bridge: Advanced Micro Devices, Inc. [AMD] Family 15h (Models 10h-1fh) Processor Root Complex
    00:00.2 IOMMU: Advanced Micro Devices, Inc. [AMD] Family 15h (Models 10h-1fh) I/O Memory Management Unit
    00:01.0 VGA compatible controller: Advanced Micro Devices, Inc. [AMD/ATI] Trinity [Radeon HD 7480D]
    00:01.1 Audio device: Advanced Micro Devices, Inc. [AMD/ATI] Trinity HDMI Audio Controller
    00:02.0 PCI bridge: Advanced Micro Devices, Inc. [AMD] Family 15h (Models 10h-1fh) Processor Root Port
    00:04.0 PCI bridge: Advanced Micro Devices, Inc. [AMD] Family 15h (Models 10h-1fh) Processor Root Port
    00:10.0 USB controller: Advanced Micro Devices, Inc. [AMD] FCH USB XHCI Controller (rev 03)
    00:10.1 USB controller: Advanced Micro Devices, Inc. [AMD] FCH USB XHCI Controller (rev 03)
    00:11.0 SATA controller: Advanced Micro Devices, Inc. [AMD] FCH SATA Controller [AHCI mode] (rev 40)
    00:12.0 USB controller: Advanced Micro Devices, Inc. [AMD] FCH USB OHCI Controller (rev 11)
    00:12.2 USB controller: Advanced Micro Devices, Inc. [AMD] FCH USB EHCI Controller (rev 11)
    00:13.0 USB controller: Advanced Micro Devices, Inc. [AMD] FCH USB OHCI Controller (rev 11)
    00:13.2 USB controller: Advanced Micro Devices, Inc. [AMD] FCH USB EHCI Controller (rev 11)
    00:14.0 SMBus: Advanced Micro Devices, Inc. [AMD] FCH SMBus Controller (rev 14)
    00:14.2 Audio device: Advanced Micro Devices, Inc. [AMD] FCH Azalia Controller (rev 01)
    00:14.3 ISA bridge: Advanced Micro Devices, Inc. [AMD] FCH LPC Bridge (rev 11)
    00:14.4 PCI bridge: Advanced Micro Devices, Inc. [AMD] FCH PCI Bridge (rev 40)
    00:14.5 USB controller: Advanced Micro Devices, Inc. [AMD] FCH USB OHCI Controller (rev 11)
    00:18.0 Host bridge: Advanced Micro Devices, Inc. [AMD] Family 15h (Models 10h-1fh) Processor Function 0
    00:18.1 Host bridge: Advanced Micro Devices, Inc. [AMD] Family 15h (Models 10h-1fh) Processor Function 1
    00:18.2 Host bridge: Advanced Micro Devices, Inc. [AMD] Family 15h (Models 10h-1fh) Processor Function 2
    00:18.3 Host bridge: Advanced Micro Devices, Inc. [AMD] Family 15h (Models 10h-1fh) Processor Function 3
    00:18.4 Host bridge: Advanced Micro Devices, Inc. [AMD] Family 15h (Models 10h-1fh) Processor Function 4
    00:18.5 Host bridge: Advanced Micro Devices, Inc. [AMD] Family 15h (Models 10h-1fh) Processor Function 5
    01:00.0 PCI bridge: PLX Technology, Inc. PEX8112 x1 Lane PCI Express-to-PCI Bridge (rev aa)
    02:04.0 Multimedia audio controller: C-Media Electronics Inc CMI8788 [Oxygen HD Audio]
    03:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8111/8168 PCI Express Gigabit Ethernet controller (rev 06)
    Last edited by And1G (2013-08-20 13:43:11)

    Can't anyone help on this one? I just checked with a Fedora 19 Live image (Kernel 3.9.5) and I get the same error messages in dmesg as in this Arch installation, also no audio.
    I believe the problem here might not be directly audio related, but where could I search for the cause?
    Also, I don't really think it's a hardware failure since audio is working nice with openElec (using Kernel 3.10, if I remember that right)...
    Edit: So I've set up openELEC to boot (over PXE, so I don't have to reinstall everything) and sound is working out of the box. Here is some data for comparison to the above statements from the Arch system:
    xbmc:~ # cat /proc/cmdline
    root=/dev/ram0 rdinit=/init BOOT_IMAGE=openelec/KERNEL ip=dhcp boot=NFS=192.168.178.20:/srv/nfs/openelec disk=NFS=192.168.178.20:/srv/nfs/openelec overlay
    xbmc:~ # uname -r
    3.10.5
    xbmc:~ # lspci
    00:00.0 Host bridge: Advanced Micro Devices [AMD] Family 15h (Models 10h-1fh) Processor Root Complex
    00:00.2 IOMMU: Advanced Micro Devices [AMD] Family 15h (Models 10h-1fh) I/O Memory Management Unit
    00:01.0 VGA compatible controller: Advanced Micro Devices [AMD] nee ATI Device 9993
    00:01.1 Audio device: Advanced Micro Devices [AMD] nee ATI Device 9902
    00:02.0 PCI bridge: Advanced Micro Devices [AMD] Family 15h (Models 10h-1fh) Processor Root Port
    00:04.0 PCI bridge: Advanced Micro Devices [AMD] Family 15h (Models 10h-1fh) Processor Root Port
    00:10.0 USB controller: Advanced Micro Devices [AMD] Hudson USB XHCI Controller (rev 03)
    00:10.1 USB controller: Advanced Micro Devices [AMD] Hudson USB XHCI Controller (rev 03)
    00:11.0 SATA controller: Advanced Micro Devices [AMD] Hudson SATA Controller [AHCI mode] (rev 40)
    00:12.0 USB controller: Advanced Micro Devices [AMD] Hudson USB OHCI Controller (rev 11)
    00:12.2 USB controller: Advanced Micro Devices [AMD] Hudson USB EHCI Controller (rev 11)
    00:13.0 USB controller: Advanced Micro Devices [AMD] Hudson USB OHCI Controller (rev 11)
    00:13.2 USB controller: Advanced Micro Devices [AMD] Hudson USB EHCI Controller (rev 11)
    00:14.0 SMBus: Advanced Micro Devices [AMD] Hudson SMBus Controller (rev 14)
    00:14.2 Audio device: Advanced Micro Devices [AMD] Hudson Azalia Controller (rev 01)
    00:14.3 ISA bridge: Advanced Micro Devices [AMD] Hudson LPC Bridge (rev 11)
    00:14.4 PCI bridge: Advanced Micro Devices [AMD] Hudson PCI Bridge (rev 40)
    00:14.5 USB controller: Advanced Micro Devices [AMD] Hudson USB OHCI Controller (rev 11)
    00:18.0 Host bridge: Advanced Micro Devices [AMD] Family 15h (Models 10h-1fh) Processor Function 0
    00:18.1 Host bridge: Advanced Micro Devices [AMD] Family 15h (Models 10h-1fh) Processor Function 1
    00:18.2 Host bridge: Advanced Micro Devices [AMD] Family 15h (Models 10h-1fh) Processor Function 2
    00:18.3 Host bridge: Advanced Micro Devices [AMD] Family 15h (Models 10h-1fh) Processor Function 3
    00:18.4 Host bridge: Advanced Micro Devices [AMD] Family 15h (Models 10h-1fh) Processor Function 4
    00:18.5 Host bridge: Advanced Micro Devices [AMD] Family 15h (Models 10h-1fh) Processor Function 5
    01:00.0 PCI bridge: PLX Technology, Inc. PEX8112 x1 Lane PCI Express-to-PCI Bridge (rev aa)
    02:04.0 Multimedia audio controller: C-Media Electronics Inc CMI8788 [Oxygen HD Audio]
    03:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8111/8168B PCI Express Gigabit Ethernet controller (rev 06)
    xbmc:~ # aplay -l
    **** List of PLAYBACK Hardware Devices ****
    card 0: DX [Xonar DX], device 0: Multichannel [Multichannel]
    Subdevices: 1/1
    Subdevice #0: subdevice #0
    card 0: DX [Xonar DX], device 1: Digital [Digital]
    Subdevices: 1/1
    Subdevice #0: subdevice #0
    card 1: HDMI [HDA ATI HDMI], device 3: HDMI 0 [HDMI 0]
    Subdevices: 1/1
    Subdevice #0: subdevice #0
    card 2: Generic [HD-Audio Generic], device 0: ALC887-VD Analog [ALC887-VD Analog]
    Subdevices: 1/1
    Subdevice #0: subdevice #0
    card 2: Generic [HD-Audio Generic], device 1: ALC887-VD Digital [ALC887-VD Digital]
    Subdevices: 1/1
    Subdevice #0: subdevice #0
    xbmc:~ # aplay -L
    null
    Discard all samples (playback) or generate zero samples (capture)
    default:CARD=DX
    Xonar DX, Multichannel
    Default Audio Device
    sysdefault:CARD=DX
    Xonar DX, Multichannel
    Default Audio Device
    front:CARD=DX,DEV=0
    Xonar DX, Multichannel
    Front speakers
    surround40:CARD=DX,DEV=0
    Xonar DX, Multichannel
    4.0 Surround output to Front and Rear speakers
    surround41:CARD=DX,DEV=0
    Xonar DX, Multichannel
    4.1 Surround output to Front, Rear and Subwoofer speakers
    surround50:CARD=DX,DEV=0
    Xonar DX, Multichannel
    5.0 Surround output to Front, Center and Rear speakers
    surround51:CARD=DX,DEV=0
    Xonar DX, Multichannel
    5.1 Surround output to Front, Center, Rear and Subwoofer speakers
    surround71:CARD=DX,DEV=0
    Xonar DX, Multichannel
    7.1 Surround output to Front, Center, Side, Rear and Woofer speakers
    iec958:CARD=DX,DEV=0
    Xonar DX, Multichannel
    IEC958 (S/PDIF) Digital Audio Output
    hdmi:CARD=HDMI,DEV=0
    HDA ATI HDMI, HDMI 0
    HDMI Audio Output
    default:CARD=Generic
    HD-Audio Generic, ALC887-VD Analog
    Default Audio Device
    sysdefault:CARD=Generic
    HD-Audio Generic, ALC887-VD Analog
    Default Audio Device
    front:CARD=Generic,DEV=0
    HD-Audio Generic, ALC887-VD Analog
    Front speakers
    surround40:CARD=Generic,DEV=0
    HD-Audio Generic, ALC887-VD Analog
    4.0 Surround output to Front and Rear speakers
    surround41:CARD=Generic,DEV=0
    HD-Audio Generic, ALC887-VD Analog
    4.1 Surround output to Front, Rear and Subwoofer speakers
    surround50:CARD=Generic,DEV=0
    HD-Audio Generic, ALC887-VD Analog
    5.0 Surround output to Front, Center and Rear speakers
    surround51:CARD=Generic,DEV=0
    HD-Audio Generic, ALC887-VD Analog
    5.1 Surround output to Front, Center, Rear and Subwoofer speakers
    surround71:CARD=Generic,DEV=0
    HD-Audio Generic, ALC887-VD Analog
    7.1 Surround output to Front, Center, Side, Rear and Woofer speakers
    iec958:CARD=Generic,DEV=0
    HD-Audio Generic, ALC887-VD Digital
    IEC958 (S/PDIF) Digital Audio Output
    Not a single one of these AMD-Vi Events is in the dmesg output.
    Does anyone have a clue on how I could figure out if they installed uncommon patches or use weird parameters to get all this running?
    Edit #2:
    So I've searched through some of these odd IOMMU options and found this: https://www.kernel.org/doc/Documentatio … ptions.txt
    I tried iommu=soft as a kernel parameter and I get audio output and the AMD-Vi Events are no longer present. But can anyone explain to me what exactly I have done here? Using a "software bounce buffering" seems weird to me if I have some hardware present, that can do such things (The IOMMU, I assume)...
    Since this really does not look like only audio-related problem, can someone perhaps move the thread to the right place. Although I'm not quite sure which this will be.
    Last edited by And1G (2013-08-19 22:12:20)

Maybe you are looking for