Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1080 Source: ClusSvc

Microsoft Cluster Server could not write file <file>. The disk may be low on disk space or some other serious condition exists.
Check the quorum disk for FS inconsistency if CLX - FS witness, run chkdsk /f on server, where arbitrator share resides.
This event can occur if you manually add a domain controller for the Configuration domain controller on the Directory Access tab of the server properties. After you close the server properties, you open the server properties again, and then you click to select the "Automatically discover servers" check box on the Directory Access tab. See ME897666 and ME914148 for two hotfixes applicable to Microsoft Exchange Server 2003.

See ME307469 and ME948047 for additional information about this event.

As per Microsoft: "Check the quorum drive for available disk space. The file system may be corrupted, or the device may be failing. Check file system permissions to make that the Cluster service account has full access to the drive and directory". See the link to "Windows Cluster Service Troubleshooting and Maintenance" to download the original white paper.
From a newsgroup post: "I have seen this before with Antivirus. Something is preventing Cluster
from deleting those files. Make sure normal ACL's are on that folder and as well:
- Exclude that folder
- Exclude c:\windows\cluster
- Exclude quorum drive.
- Restart antivirus service.
- Restart Cluster Service."

The most obvious reason would be a lack of disk space as the event description suggests - verify if that's the case before trying other remedies.
As per Microsoft: "This behavior can occur if the disk that contains the Quorum log file does not have any free disk space". See ME251284 and ME888200 to resolve this problem.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.