Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1069 Source: ClusSvc

Cluster resource '<cluster resource>' failed.
- Resource: "Disk: <disk drive>" - See ME945058.
- Resource: "MSDTC" - See ME899426.
- Resource: "SQL Server" - See ME306034 and ME883732.
- Resource: "SQL Full Text" - After an unsuccessful uninstall of SQL 2000 we had to manually remove it (see ME290991). The data drive (S:) was formatted, after which the reinstall did not work. The installation creates S:\Program Files\Microsoft SQL Server, but not the required subfolders. After manually recreating S:\Program Files\Microsoft SQL Server\MSSQL\FTDATA the reinstall worked. More information can be found in ME304282.
- Resource: "SQL Server Fulltext (LIVE)" - This is a problem when the full text services fail to fail over to a different node in the cluster. When moved, the full text services will not start and then it fails back to original node. This was found to be a problem with the DLL's not being registered properly. This can be fixed by running the following as a batch file on the node that is having problems:

regsvr32 "C:\Program Files\Common Files\System\MSSearch\Bin\ftsqlpar.dll"
regsvr32 "C:\Program Files\Common Files\System\MSSearch\Bin\mssadmin.dll"
regsvr32 "C:\Program Files\Common Files\System\MSSearch\Bin\msscntrs.dll"
regsvr32 "C:\Program Files\Common Files\System\MSSearch\Bin\mssmmcsi.dll"
regsvr32 "C:\Program Files\Common Files\System\MSSearch\Bin\mssmsg.dll"
regsvr32 "C:\Program Files\Common Files\System\MSSearch\Bin\mssmulpi.dll"
regsvr32 "C:\Program Files\Common Files\System\MSSearch\Bin\mssph.dll"
regsvr32 "C:\Program Files\Common Files\System\MSSearch\Bin\mssrch.dll"
regsvr32 "C:\Program Files\Common Files\System\MSSearch\Bin\msstools.dll"
regsvr32 "C:\Program Files\Common Files\System\MSSearch\Bin\nlhtml.dll"
regsvr32 "C:\Program Files\Common Files\System\MSSearch\Bin\objcreat.dll"
regsvr32 "C:\Program Files\Common Files\System\MSSearch\Bin\offfilt.dll"
regsvr32 "C:\Program Files\Common Files\System\MSSearch\Bin\propdefs.dll"
regsvr32 "C:\Program Files\Common Files\System\MSSearch\Bin\srchidx.dll"
regsvr32 "C:\Program Files\Common Files\System\MSSearch\Bin\tquery.dll"
regsvr32 "C:\Program Files\Common Files\System\MSSearch\Common\mssitlb.dll"
regsvr32 "C:\windows\system32\athprxy.dll"
regsvr32 "C:\windows\cluster\gathercl.dll".
- Resource: "IIS Web" - I found that this problem was caused by the cluster service account not having appropriate rights to the web services (IISAdmin/WWW). The server had resided in an OU in Active Directory where the IISAdmin and WWW service did not have “Administrators” or the cluster service account (which did not exist at that time) with the correct rights. The server was moved to a new OU with no policy. However, service permissions are tattooed and do not revert even when a policy is not in affect. To correct the issue, follow KB 257247 to reset the service permissions manually, or push a new policy on the services with the correct rights. Once this was done, the error ceased and clustering worked correctly.
- Resource: "Exchange HTTP Virtual Server Instance" - See ME821966.
- Resource: "SA" - See ME329208.

Also check ME307781, ME817229, and the link to "EventID 1069 from source Cluster Service Clussvc" for more information related to this event.

As per Microsoft: "This issue may occur if a failure occurs during DNS name registration of the cluster resource". See ME871111 to fix this problem.
Indicates a failure of a MSCS resource. Look for the application-specific events for more details about the problem as this event by itself just reports the failure without additional information.

Resource "spooler" - You can only have one spooler resource per group. See ME280452.

Resource "SMTP Virtual Server" - When you have more than one Exchange 2000 virtual server running on one node of a cluster, and you take one of the virtual servers offline or move one, the Simple Mail Transfer Protocol (SMTP) service on the remaining virtual server may go briefly offline, and then come back online.  See ME301507.

Resource "XLANG Scheduler" - ME311417 suggests to configure the identity for the XLANG Scheduler COM+ package created in Component Services to match the Log On account for the Cluster Service.

The Cluster Server on Windows NT 4.0 does not support more than 900 shares or this event may be recorded. See ME185212.

Resource "<share name>" - If the file share resource indicated by "share name" is configured as a DFS Root in its advanced options, these error messages could indicate that the DFS service has been stopped on the node in the server cluster while the cluster resource was online on that node. The service could have been stopped by manual intervention or by a problem with the service. See ME232478 for details. ME220819 provides details on how to configure DFS Root on a Windows 2000 Server cluster.

Resource "Cluster IP Address" - This issue can occur if you have replaced your network adapter, or have changed the IP address of your public network adapter. See ME267548 for resolution.

Resource "Disk <disk drive>:" - Conflicting home folder mappings may cause cluster disks to go offline. This behavior occurs because drive letter mapping for the home folder succeeds and causes a conflict with the drive letter mapping for the physical disk. Therefore, the storage device loses the drive letter and causes the failure of the physical disk resource to occur. On a standalone server, similar behavior can occur if a home folder mapping conflicts with the drive letter mapping of a storage device. In this scenario, the storage device loses the drive letter assignment and the home folder mapping succeeds; the storage device becomes inaccessible. If the physical disk resource is the quorum resource, the Cluster service may stop working. See ME303948. ME259237 provides details on troubleshooting disk problems on clusters.

Resource "SA" -  See limitations on Exchange 2000 Clusters that have more than two nodes - ME329208.
Resource "Network Name" - See ME257903.
SQL Cluster Resource "Full Text - See ME304282. Be careful on tightening permissions to the SQL directories on a cluster. Removing local admins group(and keeping only SQL admins) may remove the cluster service account from the appropriate directories.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.