Microsoft KB Archive/295648

= How to Analyze the Cluster Configuration Log Files =

PSS ID Number: 295648

Article Last Modified on 11/4/2003

-

The information in this article applies to:


 * Microsoft Windows Server 2003, Enterprise Edition
 * Microsoft Windows Server 2003, Datacenter Edition

-



This article was previously published under Q295648



SUMMARY
This article describes how to analyze the cluster configuration log files.



MORE INFORMATION
The Cluster service is installed by default on all server products. When you create or configure a node to be a member of a cluster, the information is saved to a log file in the following location:

%SystemRoot%\System32\LogFiles\Cluster\ClCfgSrv.log

This log file contains all of the information and the errors that have been encountered by the Configuration Wizard. This log file can be very beneficial to you when you have to troubleshoot.

The ClCfgSrv.log file appends all Setup attempts, and can be useful in identifying Setup trends and problems. Each Setup attempt is separated by a time and date stamp header in the following format:




 * yyyy-mm-dd hh:mm:ss.sss



There are two different types of entries in the log file: One type of entry is for each function that the configuration process is attempting to accomplish, and the other type of entry is for any type of dialog that can be displayed to a user.

An example of a task that the Configuration Wizard can perform:

2001-04-05 08:11:19.252 node1: Created network adapter {Local Area Connection} (hr=0x00000000,{05AA0768-5F49-49CD-AFDC-96F9D51802D4},{00000000-0000-0000-0000-000000000000},0,1,1), (null)

An explanation of the preceding task is:
 * The first entry is the local time and date stamp, in the format of &quot;yyyy-mm-dd hh:mm:ss.sss&quot;. This entry can be used to search for extensive delays in the Setup process.
 * The next part of the line is the name of the node on which the configuration occurs. In this situation, the name of the node is the computer name or the network basic input/output system (NetBIOS) name of &quot;node1&quot;. This entry is useful when you add multiple nodes to identify on what node the command occurred.
 * The next part of the line is a name with a brief description of the function that the configuration performs, for example, &quot;Created network adapter {Local Area Connection}.&quot; This entry helps you to identify the source of a problem.
 * The next entry is one of the most important, as it is the return value. This entry displays a hex value for the status, for example, &quot;hr=0x00000000&quot;. If you use &quot;WinError.exe -S 0x00000000&quot;, you can observe that the task has been successful. Therefore, there have been no problems with this command.
 * The next entry is for the major globally unique identifier (GUID). The major GUID correlates to the category that the configuration process has been placed. In this example, the category is: &quot;{05AA0768-5F49-49CD-AFDC-96F9D51802D4}&quot;. This entry is most easily observed in the Configuration Wizard. Typically, this entry is the root of the tree, or category. The GUID can be used to find the exact line in the source code where the error occurred. The major GUID is only beneficial if you have cluster source code access.
 * The next entry is for the minor GUID. The minor GUID also correlates to where you can locate the source code for this particular process. The minor GUID is the subcategory of the major GUID. In this example, the minor GUID is: &quot;{00000000-0000-0000-0000-000000000000}&quot;. There are all zeros in this example because this entry is a major entry, not a subcomponent. With the combination of the major and minor GUID, you can quickly find the exact code in your source. This entry is only beneficial for internal troubleshooting purposes.
 * The final numerical values are the indicators of the performance of this command, and they are in the format of &quot;Min&quot;, &quot;Max&quot;, and &quot;Current.&quot;

The other type of entry that you may observe in the ClCfgSrv.log file is for any dialog box that has been sent as output to the user screen. This entry is also logged, for example:

2001-04-05 08:11:20.971 [SRV] Found IP Address {169.254.145.57} with subnet mask {255.255.0.0}.

Typically, this entry provides a description of a function. In this situation, the entry provides an accurate description for a customer involved in the preceding process.

The acronyms in brackets displayed after the time / date, refer to the component that wrote the LogMsg.

BC = BaseCluster Component

SRV = “The Server” Component

PC = Post Config Component

WIZ = Wizard Component

MT = MiddleTier Component

SN = Startup Notify Component

EN = Evict Notify Component

EC = Evict Cleanup Component

Additional query words: MSCS ClCfgSrv

Keywords: kbenv kbinfo KB295648

Technology: kbWinServ2003Data kbWinServ2003DataSearch kbWinServ2003Ent kbWinServ2003EntSearch kbWinServ2003Search

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© 2004 Microsoft Corporation. All rights reserved.