Cluster troubleshooting: failover clusters and Hyper-V VMs

Start DC01, SRV01, NODE1 and NODE2, and make sure CLUSTER1 is online. Work as SAATLAB\adm.rahul in PowerShell as administrator on NODE1 unless a step says otherwise.

1Check nodes, roles, resources and quorum

On NODE1:

Get-ClusterNode -Cluster CLUSTER1 | Select-Object Name, State
Get-ClusterGroup -Cluster CLUSTER1 | Select-Object Name, OwnerNode, State
Get-ClusterResource -Cluster CLUSTER1 | Where-Object State -ne 'Online' | Select-Object Name, State, OwnerGroup
Get-ClusterQuorum -Cluster CLUSTER1 | Select-Object QuorumResource

You’ll see something like this:

Name  State
----  -----
NODE1 Up
NODE2 Up

Name              OwnerNode State
----              --------- -----
Available Storage NODE2     Online
Cluster Group     NODE1     Online
FS-CLUSTER        NODE1     Online

QuorumResource
--------------
Cluster Disk 2

Both nodes are up, every role is online, no resource is failed (the third command printed nothing) and the disk witness is in place. This is your healthy picture to compare against later.

✅ Checkpoint: Both nodes are Up, all groups are Online, and no resource is failed.

2Generate and search the cluster log

Collect the last 30 minutes from both nodes, in local time:

New-Item C:\Lab -ItemType Directory -Force | Out-Null
Get-ClusterLog -Cluster CLUSTER1 -Destination C:\Lab -TimeSpan 30 -UseLocalTime
Get-ChildItem C:\Lab\*cluster.log | Select-Object Name, Length
Select-String -Path C:\Lab\NODE1_cluster.log -Pattern ' ERR ' | Select-Object -Last 2 Line

You’ll see something like this:

Name               Length
----               ------
NODE1_cluster.log 3145728
NODE2_cluster.log 2988032

Line
----
00000f2c.00001a10::2026/10/20-11:02:14.512 ERR   [RES] Network Name <FS-CLUSTER>: Unable to update DNS, status 9017
00000f2c.00001a10::2026/10/20-11:02:44.530 ERR   [RES] Network Name <FS-CLUSTER>: Unable to update DNS, status 9017

The cluster log is noisy, so search for ERR and WARN lines, then read the lines around the time of the problem. Your file may have no errors at all, which is good news.

✅ Checkpoint: C:\Lab holds a cluster log for each node, and you can search them for ERR lines.

3Run safe validation tests

Run the tests that don’t touch storage:

Test-Cluster -Cluster CLUSTER1 -Include 'Inventory', 'Network', 'System Configuration' -ReportName C:\Lab\Validate-NoStorage

You’ll see something like this:

WARNING: Network - Validate Network Communication: The test reported some warnings..
WARNING:
Test Result:
ClusterConditionallyApproved
Testing has completed successfully. The configuration appears to be suitable for clustering. However, you should
review the report because it may contain warnings which you should address to attain the highest availability.

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----        20/10/2026     11:10         412544 Validate-NoStorage.htm

Open the .htm report and read every warning. In the lab, a warning about a single network path between nodes is normal. Storage tests take the shared disks offline, so on a real cluster run them only in a maintenance window.

✅ Checkpoint: Test-Cluster produced C:\Lab\Validate-NoStorage.htm without running storage tests.

4Read FailoverClustering events

On NODE1, list the latest cluster events from the System log:

Get-WinEvent -FilterHashtable @{ LogName = 'System'; ProviderName = 'Microsoft-Windows-FailoverClustering' } -MaxEvents 5 |
    Select-Object TimeCreated, Id, @{ n = 'Message'; e = { ($_.Message -split "\r?\n")[0] } } | Format-Table -Wrap

You’ll see something like this:

TimeCreated            Id Message
-----------            -- -------
20/10/2026 10:41:07  1135 Cluster node 'NODE1' was removed from the active failover cluster membership.
20/10/2026 10:40:58  1177 The Cluster service is shutting down because quorum was lost.

These are probably your own tests from Lesson 37. On a real cluster, 1135 points to network or node health, 1177 to quorum design, and 1069 or 1205 to a specific resource.

✅ Checkpoint: You can list recent FailoverClustering events and say what each ID means.

5Check a Hyper-V VM’s health

On your laptop (the Hyper-V host from Lesson 28), in PowerShell as administrator:

Get-VM HV-TEST01 | Select-Object Name, State, Status, Uptime, MemoryAssigned
Get-VMIntegrationService HV-TEST01 | Select-Object Name, Enabled, PrimaryStatusDescription
Get-WinEvent -LogName Microsoft-Windows-Hyper-V-VMMS-Admin -MaxEvents 3 |
    Select-Object TimeCreated, Id, @{ n = 'Message'; e = { ($_.Message -split "\r?\n")[0] } } | Format-Table -Wrap

You’ll see something like this:

Name      State   Status             Uptime   MemoryAssigned
----      -----   ------             ------   --------------
HV-TEST01 Running Operating normally 00:12:41     2147483648

Name                    Enabled PrimaryStatusDescription
----                    ------- ------------------------
Guest Service Interface False   OK
Heartbeat               True    OK
Key-Value Pair Exchange True    OK
Shutdown                True    OK
Time Synchronization    True    OK
VSS                     True    OK

“Operating normally” and Heartbeat OK mean the guest is alive and talking to the host. A VM that’s Running with a heartbeat of “Lost Communication” is usually hung inside. The VMMS log records why a VM failed to start, move or take a checkpoint.

✅ Checkpoint: HV-TEST01 shows Operating normally and its integration services report OK.