A physical disk resource may not come online on a cluster node in Win2003/2008/2008R2 , KB981475

A physical disk resource may not come online on a cluster node in Win2003/2008/2008R2 , KB981475

  • Comments 1
  • Likes

clip_image002

 

Hi All

FYI, I just had this issue and in case you start seeing strange disk issues with cluster in any OS,

This problem is known to occur after you install or migrate to Symantec Endpoint Protection 11.0 Release Update 5 (RU5) on the cluster nodes.

On a cluster node that is running Windows Server 2003, a physical disk resource may enter the Failed state when you try to move a group that contains the physical disk resource. If you restart the cluster node that has the physical disk resource that did not come online, the problem is temporarily resolved.
When this problem occurs, the following entries are logged in the Cluster log for the physical disk resource that entered the failed state:

When this problem occurs, the following entries are logged in the Cluster log for the physical disk resource that entered the failed state:

 

000020cc.000014d0::2010/01/23-19:40:39.929 ERR Physical Disk <Disk Q:>:
DiskspCheckPath: GetFileAttrs(Q:) returned status of 87.
000020cc.000014d0::2010/01/23-19:40:39.929 WARN Physical Disk <Disk Q:>:
DiskspCheckDriveLetter: Checking drive name (Q:) returns 87

Additionally, the following events are logged in the System log:

Event Type: Error
Event Source: ClusSvc
Event Category: Physical Disk Resource
Event ID: 1066
Date: 1/24/2010
Time: 1:03:53 AM
User: N/A
Computer: NODE2
Description:
Cluster disk resource "Disk Q:" is corrupt. Run 'ChkDsk /F' to repair problems. The
volume name for this resource is
"<\\?\Volume{4323d41e-1379-11dd-9538-001e0b20dfe6}\>".
If available, ChkDsk output will be in the file "C:\WINDOWS\Cluster\ChkDsk_Disk2_SigB05E593B.log". ChkDsk may write information to the Application Event Log with Event ID 26180.
For more information, see Help and Support Center at
<http://go.microsoft.com/fwlink/events.asp>.
Event Type: Error
Event Source: ClusSvc
Event Category: Physical Disk Resource
Event ID: 1035
Date: 1/24/2010
Time: 1:03:53 AM
User: N/A
Computer: NODE2
Description:
Cluster disk resource 'Disk Q:' could not be mounted.
For more information, see Help and Support Center at
<http://go.microsoft.com/fwlink/events.asp>.

This problem is known to occur after you install or migrate to Symantec Endpoint Protection 11.0 Release Update 5 (RU5) on the cluster nodes.
For more information about this problem, visit the following Symantec Web site:

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009102815324448 (http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009102815324448)

To resolve this problem, follow these steps:

1. Verify that this problem is caused by Symantec Endpoint Protection (SEP) 11.0 Release Update 5 (RU5). To do this, run the Handle.exe utility immediately after the issue occurs on the cluster node where the physical disk resource did not come online.
At an elevated command prompt, type the following command, and then press ENTER:

Handle.exe -a -u drive_letter

Note The drive_letter placeholder is the drive designation for the cluster drive that did not come online.
For example, assume that the drive designation for the cluster drive that did not come online is drive Q. To run the Handle.exe utility in this scenario, type the following command, and then press ENTER:

Handle.exe -a -u Q:

The problem is caused by the Symantec application if you receive the following message that identifies the Smc.exe process as the process that owns the handle:

Handle v3.42
Copyright (C) 1997-2008 Mark Russinovich
Sysinternals - www.sysinternals.com
Smc.exe pid: 856 NT AUTHORITY\SYSTEM 66C: Q:

2. If the problem is caused by the Symantec application, contact Symantec to obtain Symantec Endpoint Protection 11 Release Update 6 (RU6), which was released to resolve this issue. For more information, visit the following Symantec website:

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/2c62c4ee0e697aae882573b000034ded?OpenDocument (http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/2c62c4ee0e697aae882573b000034ded?OpenDocument)

A physical disk resource may not come online on a cluster node in Win2003

http://support.microsoft.com/default.aspx?scid=kb;EN-US;981475

Comments
  • Thankyou so much for this post, it helped us out of a bind with our Win2k3 Exchange 2007 cluster. We had the exact same eventID's as posted, and using Handle.exe, identified the "smc.exe" process as the one locking the quorum (q:) drive.

    We temporarily uninstalled Syamntec endpoint off the passive cluster node, and then attempted to failed over the "Cluster Group" (not the Exchange group!) and the failover of the primary resources was successful, as was the failback.

    Thanks once again!!!

    Cheers

    Adrian

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment