Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1209 Source: Clusdisk

Cluster service is requesting a bus reset for device \device\clusdisk0part0
Connect to the SAN switches, identify the right port for cluster node which indicates this issue with event IDs 1209 or 118 (maybe both) and perform a port reset. If this will doesn't help, power down both cluster nodes. Next start-up 1st cluster node and the the 2nd cluster node. After this action, the Microsoft Windows Cluster Service will be again up and running fine on both nodes. At the end, don't forget to divide the cluster resources as per your policies.
This event occurs after you apply hotfix ME911030 because the implementation of the Microsoft cluster driver (Clusdisk.sys) resets the bus even for the success case SCSISTAT_GOOD of the SCSI status code. See ME923424 for a hotfix applicable to Microsoft Windows Server 2003.

See ME938615 for additional information about this event.
The cluster service was unable to mount a shared disk, possibly the quorum disk. Verify that the shared drive is active; try to shutdown all the cluster servers including the shared storage and restart the storage and servers.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.