Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1071 Source: ClusSvc

Source
Level
Description
Cluster node Numberattempted to join but was refused. The error code was <error code>.
Comments
 
As per Microsoft: "If the node was previously evicted from the cluster, you must remove and then reinstall the Cluster service on the affected server. Look in Cluster Administrator to see if the other node is listed as a possible cluster member". See the link to "Windows Cluster Service Troubleshooting and Maintenance" to download the original white paper.
- Error code: 5056 - This problem appears because the Cluster service account is not in the Local Administrators group.
- Error code: 5075 - If you use the command net helpmsg 5075, you can see that this event log error corresponds to the following message: "The cluster join operation failed due to incompatible software versions between the joining node and its sponsor". See ME811272 for more details.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...