• you run anti-virus on those nodes? I always check anti-virus logs when all else appears normal.