SQL Clone
SQLServerCentral is supported by Redgate
Log in  ::  Register  ::  Not logged in

Window Server 2008 Failover Clustering Logs

In Windows 2003 failover clustering, Cluster nodes continuously putting details in log file on each node. This log is in readable plain text format & located in %SystemRoot%\Cluster folder on each node in the cluster and the name of the file is CLUSTER.LOG.

In Windows 2008, One of the major change is cluster logs logging. Microsoft change the logging mechanism & now cluster logs logging also work as per rest of Windows handles event logging. The legacy cluster.log file no more exists. In Windows 2008 the cluster log is handled by the Windows Event Tracing (ETW) process. This is the same as the System or Application Event logs you view in Event Viewer.

è Points :-

1. Cluster logs located in %windir%\Cluster\Reports directory on each node of the cluster

2. The log files are stored in an *.etl format.

3. Naming Format in Windows Server 2008


4. Naming Format in Windows Server 2008 R2

Microsoft-Windows-FailoverClustering Diagnostic.etl.001
Microsoft-Windows-FailoverClustering Diagnostic.etl.002
Microsoft-Windows-FailoverClustering Diagnostic.etl.003

5. The default size of these logs is 100MB each. You can change it as per your requirements.

6. We can have maximum 3 *.etl files.

7. The ETL.001 file is the active file being used by the live cluster service to write debug entries.

8. File rollover happens only on reboot. On reboot, new ETL.001 will be created & last file will be deleted.

9. In case, Latest ETL.001 file reach to MAX size, Data inside the file will start truncating on basis of FIFO (First In First Out). But file rollover happen only on reboot.

èHow to check cluster properties ?

Open an elevated command prompt and type the following:

C:\>cluster /prop

èHow to change the MAX size of cluster logs ?


C:\PS>Set-ClusterLog –Size X

Command Line

c:\>cluster log /Size:X

èHow to Generate a Cluster Log in readable format ?

Command Line

Switch Effect
c:\>cluster log /gen /COPY:”directory Dumps the logs on all nodes in the entire cluster to a single directory
c:\>cluster log /gen /SPAN:min Just dump the last X minutes of the log
c:\>cluster log /gen /NODE:”node-name Useful when the ClusSvc is down to dump a specific node’s logs


Switch Effect
C:\PS> Get-ClusterLog –Destination Dumps the logs on all nodes in the entire cluster to a single directory
C:\PS> Get-ClusterLog –TimeSpan Just dump the last X minutes of the log
C:\PS> Get-ClusterLog –Node Useful when the ClusSvc is down to dump a specific node’s logs

èHow to Change the level of the Cluster Log

Default cluster log level (ClusterLogLevel) is 3. Which is same as windows 2003 logging. You can have max level 5 to have more detailed information for analysis. Using higher level of level may impact system performance as well.

Level Error Warning Info Verbose Debug
0 (Disabled)
1 X
2 X X
4 X X X X
5 X X X X X


C:\PS>Set-ClusterLog –Level X

Command Line

c:\>cluster log /Level:X

Reference : Rohit Garg (http://mssqlfun.com/)

You can find and follow MSSQLFUN :-




Other Linked Profiles :-






I, Rohit Garg, am working as Consultant in IT Company. I am having an around 5 years of experience in MSSQL server & other Microsoft technologies. I am working as DBA in Microsoft SQL Server from last 5 years in e-Commerce, Telecom, Finance domain. In this tenure, I got a chance of working as Database administrator, Developer and trainer on SQL server 2000 to SQL Server 2012. I am holding Master’s degree in Computer Science along with certification in SQL Server & .Net. I like to learn new things by hand-on experience on regular basis. This journey is so far is delightful & valuable with the addition of wonderful friends.


Leave a comment on the original post [mssqlfun.wordpress.com, opens in a new window]

Loading comments...