| Event Id | 1148 |
| Source | ClusSvc |
| Description | Cluster service encountered a fatal error. The vital quorum log file Q:\MSCS\quolog.log is corrupt. If you have a backup of the quorum log file, you may try to start Cluster service by entering clussvc -debug -noquorumlogging at a command window, copy the backed up quorum log file to the MSCS directory on the quorum drive, stop Cluster service, and restart Cluster service normally using the net start clussvc command. If you do not have a backup of the quorum log file, you may try to start Cluster service as clussvc -debug -resetquorumlog and this will attempt to create a new quorum log file based on possibly stale information in the server cluster database. You may then stop Cluster service and restart it normally using the net start clussvc command. |
| Event Information | "According to Microsoft: CAUSE : The error message can occur if the quorum log file (Quolog.log) cannot be found or read at Cluster service startup. This file must be readable to confirm that the cluster configuration on the local node is current. If the Cluster service cannot read the log, the service is not prevented from loading stale configuration data. The log file may be corrupted if the time and date stamp of the Chkxxx.tmp file does not match the stamp of the Quolog.log file in the \MSCS folder on the quorum drive. The corruption can occur if you recently performed a restore operation, or if you experienced a power outage. RESOLUTION : To resolve this issue, start the Cluster service with the -ResetQuorumLog switch: 1. Start the Computer Management snap-in. 2. Open the properties of the Cluster service. 3. In the Start Parameters box, type -ResetQuorumLog, and then start the Cluster service. 4. To make sure that everything is running correctly, stop the Cluster service, and then start it again without any parameters. If this procedure does not start the Cluster service, you may have to completely re-create the checkpoint and the Quolog.log file from the local cluster registry. To do so: a. Start Computer Management. b. Open the properties of the Cluster service. c. In the Start Parameters box, type -NoQuorumLogging, and then start the Cluster service. d. Start Windows Explorer, and then move the Quolog.log file and all the Chkxxx.tmp files that are in the MSCS folder that is on the quorum drive to the root of the quorum drive so that they do not exist in the MSCS folder. e. Switch to Computer Management, and then stop the Cluster service. f. In the Start Parameters box, type -ResetQuorumLog, and then start the Cluster service again. Note : If the cluster is running Windows 2000 Service Pack 4 (SP4), and if the KB 872970 hotfix is installed, do not use the -ResetQuorumLog switch. Y |
| Reference Links | Error message: "Could not start the Cluster Service on Local Computer" The quorum log file becomes corrupted in your Windows 2000 Advanced Server-based cluster environment |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.