Sometimes, you know that a problem occurred but the tools do not give you the right information. If you ever look at the Cluster Failover Manager for a Windows Cluster, sometimes, that can happen. The user interface won’t show you any errors, but you know there was an issue. This is when knowing how to use other tools to extract information from the cluster log becomes useful.
You can choose to use either PowerShell or a command on the command prompt. I tend to lean towards PowerShell. I find it easier to utilize because it gives me the most flexibility.
The PowerShell cmdlet get-clusterlog is a quick and handy way to get information from the Windows Cluster. This cmdlet will create a text log file for all nodes or a specific node (if specified) within a failover cluster. You can even use the cmdlet to specify a certain time space, like the last 15 minutes which can be really handy if you know that the issue occurred within that time frame.
This is great and all, however, it can give you a lot of information to try to sift through. As you can see, the three log files shown below are about ~600MB worth of text! That’s a lot!
If you are looking through cluster logs, you are looking for specific messages, most likely error messages. Thankfully, the log categorizes each message and those error messages can be located.
Since ~600MB is a lot of data to try to manually sift through, there are easier ways. We can use PowerShell again to extract all the error messages. This allows us to efficiently locate the error messages that might be prudent to the issue in hand.
So, I wrote a quick and easy script that iterates through a folder of cluster log files and extracts any line that has the pattern “ERR" in it out to another file. Notice that the pattern has spaces at the beginning and the end of the pattern so that if there are instances of strings like “error”, they are not returned.
This was an easy script to write and it helped me narrow down just the error messages quickly so that I can help resolve the issue the cluster might be having. The effectiveness and flexibility of PowerShell continue to shine in situations like this.
If you haven’t started to learn PowerShell, you should. It’ll make your life easier in the long run.