How to turn on cluster logging in Microsoft Cluster Server

Server clusters log errors and events to the System Event log. You can also turn on and configure verbose logging for the cluster service to a text file named "Cluster.log" for advanced troubleshooting.

By default, Windows 2000 and later enable cluster logging. To enable cluster logging on a Windows NT 4.0 server cluster, you must set the following System environment variables:

To set the System environment variables, follow these steps:

1. In the System tool in Control Panel, click the Environment tab.
2. Click an entry in the System Environment Variable window.
3. Click to clear the Variable and the Value text boxes.
4. Type ClusterLog in the Variable box, type path\cluster.log in the Value box, and then click Set, where path is the drive and folder to store the Cluster Server log file.
   
   Note: The recommended default path in Windows 2000 and later is %SystemRoot%\Cluster. For example, C:\WinNT\Cluster\Cluster.log.
5. Type ClusterLogLevel in the Variable box, type the value that you want in the Value box (a list of values follows), and then click Set.
   
   The value that you type in the Value box determines what logging functions the Cluster service performs. You can type any one of the following values:
   • 0=No logging
   • 1=Errors only
   • 2=Errors and Warnings
   • 3=Everything that occurs
   Note: The CLUSTERLOGLEVEL variable only defines the output to the screen when you start the Cluster service by using the /Debug switch. It does not affect the contents of the Cluster.log file.
6. Click OK.
7. Restart your computer for Cluster service to read the variables correctly.

You can type SET at the command prompt to verify that you entered the variables correctly after you have restarted the computer.

Note: You also can type User Variables in the Environment dialog box.

By default, the cluster log is set to have a maximum size of 8 megabytes (MB). When the cluster log reaches its maximum size, it truncates by deleting the first half of the log file and moves the data in the last half of the log file to the beginning of the log file. It then continues to fill the log file until it reaches the maximum size again, when it truncates again.

Note: Cluster log data is moved in 64KB chunks. The first 64KB chunk from the log file is deletes, and then the first 64KB chunk that is after the half-way point in the log file moves to the beginning of the log. Then, the second 64 KB chunk from the log file deletes and the second 64KB chunk that is after the half way point in the log file moves to the second 64KB at the beginning of the log. This process continues until the log is only half the maximum size. During this process, the cluster service buffers additional log entries, and then records them in the log when the truncation completes.

You can increase the maximum log size from the default of 8 MB by adding another system environment variable, CLUSTERLOGSIZE, where its value is designated in MB. If you set the value of CLUSTERLOGSIZE to 10, the maximum size of the cluster log is 10 MB. After you modify the maximum log size, you only have to restart the cluster service for the changes to take effect.

The CLUSTERLOGOVERWRITE system environment variable can also be set (0 = Disabled, 1 = Enabled). With this setting defined, when you start the Cluster service, it copies the existing Cluster.log file to a file named "Cluster.log.bak". Then, it creates a new Cluster.log file and logs to it. With this switch you can retain a longer history of cluster logging events and smaller logs. This can make it easier to identify issues. However, be careful when you use this option because a new log is created every time the service starts. If the cluster service is started and stopped again in a short period of time, this creates multiple new logs and you may lose long-term history.

The following table describes the cluster log environment variables and their effects: