Home cluster shared volumes event id 5120 troubleshooting windows server

Troubleshooting Event ID 5120 on Windows Server Cluster Shared Volumes: A Quick Guide

Updated: • 0 • min read
Table of Contents

Decoding Event ID 5120: Your Guide to Troubleshooting Cluster Shared Volumes on Windows Server

Hey folks! Ever stumbled upon that dreaded Event ID 5120 while working with your Windows Server Cluster Shared Volumes? It’s a sign of communication hiccups between a cluster node and a volume, which can range from minor blips to full-blown disruptions. This guide breaks down everything you need to know about troubleshooting this pesky event, from initial checks to advanced solutions.

Event ID 5120
image just illustration

The Troubleshooting Checklist: Your First Line of Defense

When Event ID 5120 pops up, don’t panic! This simply means there’s been a communication interruption between a cluster node and a volume in your Cluster Shared Volumes (CSV). This could be a fleeting issue or something more persistent, impacting your services and applications. If it sticks around, check the System and Application event logs for more clues.

Here’s a quick checklist to get you started:

  1. Is Your CSV Online? The most basic check. Head to Start > Administrative Tools > Failover Cluster Manager. Once there, locate your cluster and expand the Cluster Shared Volumes. Check the volume’s status. If it’s offline, right-click it and select Bring this resource online.

  2. PowerShell to the Rescue: Open Windows PowerShell Modules from Start > Administrative Tools. Then, unleash the power of this cmdlet:

Get-ClusterSharedVolume

This displays the status of all your CSVs. If you want to check a specific volume, just add its name after the cmdlet.

  1. The Mysterious STATUS_CLUSTER_CSV_AUTO_PAUSE_ERROR (c0130021): If you spot a few of these errors in Event ID 5120, breathe easy! You can usually ignore them. They’re known to cause false alarms, but they’re generally harmless.

  2. Other Errors: Not So Harmless: If you encounter Event ID 5120 with any other error code besides the one mentioned above, take it seriously! Carefully examine the error code within the event description. Don’t be fooled by a single STATUS_CLUSTER_CSV_AUTO_PAUSE_ERROR – if other errors are lurking, there are likely fixes you need to apply.

Common Issues and Solutions: Decoding the Status Codes

The Description field of Event ID 5120 holds valuable clues in the form of status messages. Let’s decode some of the most frequent offenders:

STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)

Renaming files or folders on a CSV might throw this error, especially on the CSV owner node when using a process without administrator permissions. Workarounds include: using an administrator-level process or performing the operation on a node that doesn’t own the CSV. Microsoft has addressed this issue in a past update, so make sure your system is patched.

STATUS_BAD_NETWORK_NAME (c00000cc)

Suspect network issues, HBA problems, or disk troubles. Scan your system event log for related events. Ensure your network and storage drivers, firmware, and Microsoft updates are all up to date.

STATUS_BAD_NETWORK_PATH (c00000be)

Double-check your storage configuration and MPIO settings. Enable MPIO path verification on all cluster nodes using the Set-MPIOSetting PowerShell cmdlet:

Set-MPIOSetting -NewPathVerificationState Enabled
Set-MPIOSetting -NewPathVerificationPeriod <integer>

(Replace <integer> with the path verification time in seconds – default is 30).

STATUS_CLUSTER_CSV_AUTO_PAUSE_ERROR (c0130021)

Again, this one is often a false alarm. However, ensure your drivers, firmware, and Microsoft updates are current. Especially on Windows Server 2012 R2 and earlier, confirm you have KB2878635 installed. This status code is called STATUS_CLUSTER_CSV_NO_SNAPSHOTS in Windows Server 2016 and later.

STATUS_CONNECTION_DISCONNECTED (c000020c)

This signals a communication breakdown between a node and a CSV. It might be brief, or it could disrupt services. If it persists, dig deeper into your System or Application event logs for related events. Verify the CSV can come online using the steps described earlier or use the Get-ClusterSharedVolume PowerShell cmdlet.

STATUS_CONNECTION_RESET (c000020d)

Check for network connectivity problems, HBA issues, or disk errors in the event log. Ensure all drivers, firmware, and Microsoft updates are current. Also, review your antivirus exclusions—sometimes, they can interfere.

STATUS_DEVICE_BUSY (80000011)

Investigate your storage resources. This might indicate a lost persistent reservation on the volume. Keep drivers, firmware, and updates current.

STATUS_DEVICE_NOT_CONNECTED (c000009d)

Connectivity between your cluster nodes and storage has vanished. Review the event log for network, HBA, or disk problems and ensure everything is up to date.

STATUS_FILE_CLOSED (c0000128)

Focus on network connectivity. Look for events like Event ID 1135 and check the status of network-intensive workloads (e.g., backups). Update those drivers, firmware, and Microsoft updates!

STATUS_FILE_NOT_AVAILABLE (c0000467)

Check your Smart Array health and update related drivers and firmware. Keep everything else (network drivers, storage drivers, Microsoft updates) current too.

STATUS_INSUFFICIENT_RESOURCES (c000009a) – STATUS_VOLUME_DISMOUNTED (c000026e)

For these and other status codes like STATUS_IO_TIMEOUT, STATUS_MEDIA_WRITE_PROTECTED, STATUS_NETWORK_UNREACHABLE, STATUS_NO_MEDIA_IN_DEVICE, STATUS_NO_SUCH_DEVICE, STATUS_UNEXPECTED_NETWORK_ERROR, STATUS_UNSUCCESSFUL, and STATUS_USER_SESSION_DELETED, the primary troubleshooting steps are similar:

  1. Examine the system event log for storage, network, HBA, or disk problems.
  2. Ensure your drivers (network, storage), firmware, and Microsoft updates are the latest versions. Several specific hotfixes and updates address specific issues related to these codes, so thorough patching is essential.

Data Collection for Microsoft Support

If you’re still stuck, gathering data before contacting Microsoft Support can expedite the process. Use the Troubleshooting Script Toolset (TSS) to collect logs from the affected nodes. Check the Microsoft documentation for the TSS prerequisites and usage instructions. Also, consider capturing a live kernel memory dump for further analysis.

We’ve covered a lot of ground, from basic checks to advanced troubleshooting. Hopefully, this guide helps you conquer those Event ID 5120 woes. If you have any questions, tips, or war stories to share, drop them in the comments below. Let’s learn and troubleshoot together! Come back anytime for more tech insights!

Post a Comment