SYMPTOM
=========================
Excessive 1146 events are logged on cluster nodes

Event ID: 1146
Source: Microsoft-Windows-FailoverClustering
Description: The cluster resource host subsystem (RHS) stopped unexpectedly. An attempt will be made to restart it. This is usually due to a problem in a resource DLL. Please determine which resource DLL is causing the issue and report the problem to the resource vendor.

RESOLUTION
==========================
Please call Microsoft CSS to obtain this hot fix "The Resource Hosting Subsystem (Rhs.exe) process stops unexpectedly when you start a cluster resource in Windows Server 2008 R2"
http://support.microsoft.com/kb/978527/en-us

Troubleshooting methods
==========================
Please configure Windows Error Reporting so that we can capture some data when problem recurs
Configuring the "Windows Error Reporting" to generate crash dump when RHS.exe crashes, we need to manually create following register values:

Note: You may need to backup the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting or the whole registry key before this change.

Key Name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\rhs.exe

  Name: DumpFolder
  Type: REG_EXPAND_SZ
  Data: C:\rhs_dumps

  Name: DumpType
  Type: REG_DWORD
  Data: 0x2

  Name: DumpCount
  Type: REG_DWORD
  Data: 0xa

When problem happens again, the dump file will be generated in the directory C:\rhs_dumps.
When the issue raises again, please collect the dump file and collect a new MPS report pack and send to me for further analysis.