SYMPTOM ========================= Excessive 1146 events are logged on cluster nodes Event ID: 1146 Source: Microsoft-Windows-FailoverClustering Description: The cluster resource host subsystem (RHS) stopped unexpectedly. An attempt will be made to restart it. This is usually due to a problem in a resource DLL. Please determine which resource DLL is causing the issue and report the problem to the resource vendor. RESOLUTION ========================== Please call Microsoft CSS to obtain this hot fix "The Resource Hosting Subsystem (Rhs.exe) process stops unexpectedly when you start a cluster resource in Windows Server 2008 R2" http://support.microsoft.com/kb/978527/en-us
Troubleshooting methods ========================== Please configure Windows Error Reporting so that we can capture some data when problem recurs Configuring the "Windows Error Reporting" to generate crash dump when RHS.exe crashes, we need to manually create following register values:
Note: You may need to backup the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting or the whole registry key before this change.
Key Name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\rhs.exe
Name: DumpFolder Type: REG_EXPAND_SZ Data: C:\rhs_dumps
Name: DumpType Type: REG_DWORD Data: 0x2
Name: DumpCount Type: REG_DWORD Data: 0xa
When problem happens again, the dump file will be generated in the directory C:\rhs_dumps. When the issue raises again, please collect the dump file and collect a new MPS report pack and send to me for further analysis.