How to creates a log file for all nodes, or a specific a node, in a failover cluster.
Here is the command which i use to get the ClusterLog in userlocaltime for timespan of X minutes
you can execute below command to retrieve the clusterlog in userlocaltime for timespan of X minutes
You will execute this command on command prompt
Powershell.exe -ImportSystemModules -ExecutionPolicy Unrestricted -command Get-ClusterLog -Destination 'C:\xfer' -Node 'WIN2K12-2' -TimeSpan X -Uselocaltime
Here X can be any number between 1 to 60.
output be like:-
00000e4c.00000ab4::2018/08/10-10:11:54.758 INFO [RES] Network Name: Agent: Sending request Netname/RecheckConfig to NN:1982beb0-3c46-43d4-8009-ea661b3aa6b0:Netbios
00000e4c.000012e4::2018/08/10-10:11:54.992 ERR [RES] IP Address <Cluster IP Address>: IP address 192.168.1.13 is already in use on the network, status 5057.
00000e4c.000012e4::2018/08/10-10:11:54.992 INFO [RES] IP Address <Cluster IP Address>: Deleting IP interface D01A8C0.
00000e4c.000012e4::2018/08/10-10:11:54.992 ERR [RHS] Online for resource Cluster IP Address failed.
00000de8.00000b3c::2018/08/10-10:11:54.992 WARN [RCM] HandleMonitorReply: ONLINERESOURCE for 'Cluster IP Address', gen(1) result 5018/0.
00000de8.00000b3c::2018/08/10-10:11:54.992 INFO [RCM] Res Cluster IP Address: OnlinePending -> ProcessingFailure( StateUnknown )
00000de8.00000b3c::2018/08/10-10:11:54.992 INFO [RCM] TransitionToState(Cluster IP Address) OnlinePending-->ProcessingFailure.
00000de8.00000b3c::2018/08/10-10:11:54.992 ERR [RCM] rcm::RcmResource::HandleFailure: (Cluster IP Address)
00000de8.00000b3c::2018/08/10-10:11:54.992 INFO [RCM] resource Cluster IP Address: failure count: 1, restartAction: 2 persistentState: 1.
00000de8.00000b3c::2018/08/10-10:11:54.992 INFO [RCM] Resource Cluster IP Address is causing group Cluster Group to failover.
00000de8.00000b3c::2018/08/10-10:11:54.992 INFO [RCM] rcm::RcmGroup::Failover: (Cluster Group)
00000de8.00000b3c::2018/08/10-10:11:54.992 WARN [RCM] Not failing over group Cluster Group, failoverCount 1, failoverThresholdSetting 4294967295, lastFailover 1601/01/01-00:00:00.000
00000de8.00000b3c::2018/08/10-10:11:54.992 INFO [RCM] Cluster Name merits neither a notification nor a delayed restart