Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1202 Source: ClusSvc

Source
Level
Description
The time delta between node <server> and node <server> is <value>(in 100 nanosecs).
Comments
 
This event message is informational only. It does not indicate a problem if the reported time delta is less than five minutes. Time-sensitive programs and the Kerberos protocol require accurate time to work correctly. The Windows Time service will correct the time during the next polling interval. See ME914025 for additional information about this issue.
In my experience if you reboot one of cluster nodes, time discrepancy between them may occur while the re-sync with NTP source such as local Domain Controller has not yet happened. For reliable cluster operation, it is preferred to keep them synchronized.
This is why once the discrepancy appeared servers apparently start controlling their tick rate to reduce it. The following messages show the decreasing difference, which is eliminated at a decreasing rate (i.e. it starts to decrease quickly, let's say 9 seconds in a minute, then the adjustment rate slows to 8 seconds in 100 seconds, and so on...).
It is very easy to see the current amount of discrepancy in more measurable units - 100 ns is 10 to the minus 7-th power of a second. Therefore, to convert this "big number" mentioned in the event text to seconds, you just need to select the rightmost 7 digits with mouse. Then the non-selected part to the left will show the difference in seconds. Let us say "the big number" is 420291839, then by selecting out the right 7 digits you get 42 seconds.
These messages are informational and normally would subside quickly, as soon as the cluster nodes finish the time synchronization process.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...