Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1146 Source: Microsoft-Windows-FailoverClustering

Level
Description
The cluster resource host subsystem (RHS) stopped unexpectedly. An attempt will be made to restart it. This is usually due to a problem in a resource DLL. Please determine which resource DLL is causing the issue and report the problem to the resource vendor.
Comments
 
T773478 provides a general approach in troubleshooting this type of problems, including instructions on configuring a resource to run in its own Resource Monitor.
As per ME978527, this may be recorded because the path defined for the cluster resource DLL contains a system environment variable in the path, which contains another environment variable in its path. The RHS.exe process incorrectly overwrites heap memory beyond its tail when the RHS.exe process expands the multiple system environment variables. See the article for a suggested hotfix available for Windows Server 2008 R2.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...