Event Log Replication on Cluster Node Generates Event ID 1137

The following warning message may be reported in the system event logs when the Cluster service starts or during normal operation of a server cluster.

This issue occurs because server clusters send event log entries from each node to all other nodes in the cluster so that each node has all of the event log entries. This behavior helps the administrator identify issues with the cluster and reduces the administrative task of having to check each node's event log.

When the cluster nodes are up, they actively exchange event log messages. If the rate of the logged messages exceeds the rate with which messages are being sent to other nodes, some of the event messages may be dropped. This behavior is expected. If the message is dropped, the event is still written to the local node. However, they are not written to the remote nodes. This behavior prevents disruptions in programs that are attempting to log an entry when the replication cannot keep up.

When the Cluster service starts, it may receive many event log messages that occurred on the system before the Cluster service was started. If the number of messages exceeds the size limit of the queue, the messages are dropped.

The event ID 1137 message does not reveal the true issue. To find out the root of the issue, you must find out what is generating all of the event log entries. To correct this error, troubleshoot the other errors that are being generated by the system.

If the cluster server is a print server, disable the Informational print messages option in the Spooler properties. This option may cause excessive event log entries.

For additional information, click the article number below to view the article in the Microsoft Knowledge Base: