Windows Server Failover Cluster Log

Windows Server Failover Cluster Log

Generating the Cluster.log  Get-ClusterLog

  => The output looks like for all node in the cluster: 

The Cluster.log files can be found in the \cluster\reports directory (usually c:\windows\cluster\Reports) on each node. 

You can use the –Destination parameter to cause the files to be copied to a specified directory with the Server’s name

The time stamps default to UTC (which some people call GMT)

For instance, if you are in that time zone and a problem occurred at 1:38pm (13:38), UTC time stamp in the cluster log would be (21:38)

The –UseLocalTime parameter for Get-ClusterLog causes the cluster.log to write timestamps that are already adjusted for the server’s time zone instead of using UTC

Tip: The sections of the cluster.log are encased in [===   ===], which makes it easy to navigate down the log to each section by doing a find on “[===”.  As a bit of trivia, this format was chosen because it kind of looks like a Tie Fighter and we thought it looked cool. 

Cluster Objects

The cluster.log now dumps these objects in a Comma Separated Values list with headers. 
Here is an example: 
[===Networks ===] 

Name,Id,description,role,transport,ignore,AssociatedInterfaces,PrefixList,address,addressMask,ipV6Address,state,linkSpeed,rdmaCapable,rssCapable,autoMetric,metric, 

You can find the DiagnosticVerbose section in the cluster.log by doing a find on “DiagnosticeVerbose”.  It will go the section header: 

[=== Microsoft-Windows-FailoverClustering/DiagnosticVerbose ===] 

[Verbose] 00000244.00001644::2015/04/22-01:04:29.623 DBG 

New in Windows Server 2016 cluster log, the following event channels will also be dumped into the cluster.log for each node.  Since they are all in one file, you no longer need to go to the nodes and pull each log individually. 
[=== System ===] 

[=== Microsoft-Windows-FailoverClustering/Operational logs ===] 

[=== Microsoft-Windows-ClusterAwareUpdating-Management/Admin logs ===] 

[=== Microsoft-Windows-ClusterAwareUpdating/Admin logs ===] 
Here is an example: 
[=== System ===] 

If the size of the cluster.log file is bigger than you desire, the –TimeSpan switch for Get-ClusterLog will limit

Set-ClusterLog -Level 1