Microsoft-Windows-FailoverClustering-Client
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | Parameter1. | Diagnostic | N | N |
| 2 | Parameter1. | Diagnostic | Y | N |
| 3 | Parameter1. | Diagnostic | N | N |
| 4 | Parameter1. | Diagnostic | N | N |
| 5 | Parameter1. | Diagnostic | N | N |
| 6 | Parameter1. | Diagnostic | N | N |
| 7 | Parameter1. | Diagnostic | N | N |
| 8 | Parameter1. | Diagnostic | N | N |
| 9 | Parameter1. | Diagnostic | N | N |
| 16 | Parameter1. | Diagnostic | N | N |
| 17 | Parameter1. | Diagnostic | N | N |
| 18 | Parameter1. | Diagnostic | N | N |
| 19 | Parameter1. | Diagnostic | N | N |
| 20 | Parameter1. | Diagnostic | N | N |
| 21 | Parameter1. | Diagnostic | N | N |
| 22 | Parameter1. | Diagnostic | N | N |
| 23 | Parameter1. | Diagnostic | N | N |
| 24 | Parameter1. | Diagnostic | N | N |
| 25 | Parameter1. | Diagnostic | N | N |
| 32 | Parameter1. | Diagnostic | N | N |
| 33 | Parameter1. | Diagnostic | N | N |
| 34 | Parameter1. | Diagnostic | N | N |
| 35 | Parameter1. | Diagnostic | N | N |
| 36 | Parameter1. | Diagnostic | N | N |
| 37 | Parameter1. | Diagnostic | N | N |
| 38 | Parameter1. | Diagnostic | N | N |
| 39 | Parameter1. | Diagnostic | N | N |
| 40 | Parameter1. | Diagnostic | N | N |
| 41 | Parameter1. | Diagnostic | N | N |
| 48 | Parameter1. | Diagnostic | N | N |
| 49 | Parameter1. | Diagnostic | N | N |
| 50 | Parameter1. | Diagnostic | N | N |
| 51 | Parameter1. | Diagnostic | N | N |
| 52 | Parameter1. | Diagnostic | N | N |
| 53 | Parameter1. | Diagnostic | N | N |
| 54 | Parameter1. | Diagnostic | N | N |
| 55 | Parameter1. | Diagnostic | N | N |
| 56 | Parameter1. | Diagnostic | N | N |
| 57 | Parameter1. | Diagnostic | N | N |
| 64 | Parameter1. | Diagnostic | N | N |
| 65 | Parameter1. | Diagnostic | N | N |
| 66 | Parameter1. | Diagnostic | N | N |
| 67 | Parameter1. | Diagnostic | N | N |
| 68 | Parameter1. | Diagnostic | N | N |
| 69 | Parameter1. | Diagnostic | N | N |
| 70 | Parameter1. | Diagnostic | N | N |
| 71 | Parameter1. | Diagnostic | N | N |
| 72 | Parameter1. | Diagnostic | N | N |
| 73 | Parameter1. | Diagnostic | N | N |
| 80 | Parameter1. | Diagnostic | N | N |
| 81 | Parameter1. | System | Y | N |
| 82 | Parameter1. | Operational | N | N |
| 83 | Parameter1. | Operational | N | N |
| 84 | Parameter1. | Operational | N | N |
| 85 | Parameter1. | Operational | N | N |
| 86 | Parameter1. | Operational | N | N |
Event ID 2: Parameter1.
#Message #
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-FailoverClustering-Client/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 2,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 2344,
"thread_id": 6904
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-Windows-FailoverClustering-Client",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 02:08:37.636Z",
"version": 0
},
"event_data": {
"Parameter1": "GetNodeServiceState (652): Error in opening handle for cluster service for node . Error 1060"
},
"message": ""
}
Event ID 81: Parameter1.
#Message #
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-FailoverClustering-Client",
"guid": "{A82FDA5D-745F-409C-B0FE-18AE0678A0E0}",
"event_source_name": "",
"event_id": 81,
"version": 0,
"level": 2,
"task": 0,
"opcode": 0,
"keywords": -9223372036854774784,
"time_created": "2026-06-13T13:35:28.9237459+00:00",
"event_record_id": 8619,
"correlation": {},
"execution": {
"process_id": 1760,
"thread_id": 6536
},
"channel": "System",
"computer": "telemetry-DC-c.cell-c.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Parameter1": "LogExtendedErrorInformation (975): Extended RPC error information:\nProcessID is 1760\nSystem time is: 32701/476/45871 529:0:40480:45144\nGenerating component is 2\nStatus is 1753\nDetection location is 501\nFlags is 0\nNumberOfParameters is 4\nUnicode string: ncacn_ip_tcp\nUnicode string: TELEMETRY-DC-C\nLong val: -1182943054\nLong val: 382312662\n"
},
"message": "LogExtendedErrorInformation (975): Extended RPC error information:\r\nProcessID is 1760\r\nSystem time is: 32701/476/45871 529:0:40480:45144\r\nGenerating component is 2\r\nStatus is 1753\r\nDetection location is 501\r\nFlags is 0\r\nNumberOfParameters is 4\r\nUnicode string: ncacn_ip_tcp\r\nUnicode string: TELEMETRY-DC-C\r\nLong val: -1182943054\r\nLong val: 382312662\r\n"
}
Provenance
ETW provider GUID a82fda5d-745f-409c-b0fe-18ae0678a0e0
Defined in clusapi.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB