Event ID 2050 [MRR] Node 3: Dropping reply for unknown witness response 97953021

Question

En nuestro entorno tenemos un cluster compuesto con 9 nodos los cuales 3 de esos nodos (servidores) son de un hardware similar pero más nuevo que los otros 6 nodos; el entorno posee un SO Windows Server 2016.
Revisando el funcionamiento del cluster, encontramos en el visor de eventos varios WARNINGS con la siguiente descripción:

Log Name: Microsoft-Windows-FailoverClustering/Diagnostic
Source: Microsoft-Windows-FailoverClustering
Date: 4/5/2021 7:17:01 PM
Event ID: 2050
Task Category: None
Level: Warning
Keywords:
User: SYSTEM
Computer: NODO01.dominio.xx.xx
Description:
[MRR] Node 3: Dropping reply for unknown witness response 97953021
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-FailoverClustering" Guid="{​​​​​BAF908EA-3421-4CA9-9B84-6689B8C6F85F}​​​​​" />
<EventID>2050</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x2000000000000000</Keywords>
<TimeCreated SystemTime="2021-04-05T22:17:01.079670100Z" />
<EventRecordID>13567818</EventRecordID>
<Correlation />
<Execution ProcessID="3120" ThreadID="5128" />
<Channel>Microsoft-Windows-FailoverClustering/Diagnostic</Channel>
<Computer>NODO01.dominio.xx.xx</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="LogString">[MRR] Node 3: Dropping reply for unknown witness response 97953021</Data>
</EventData>
</Event>

La realidad es que el funcionamiento es óptimo, tenemos varias virtuales corriendo en el cluster y no tenemos inconvenientes. Me preocupa este mensaje porque no encuentro donde puede estar el problema y tampoco encontré información válida en internet. Solamente que este tipo de eventos son informativos y no es nada crítico, que puedo pasarlo por alto... lo cual no me deja tranquilo.
Alguien podrá darme una mano si ya le pasó y como lo resolvió? Muchas gracias.

Answer 1

Hi,
Back to the case, the log you provided is within the Diagnostic event log, which is basically the same as the cluster.log messages.

As far as I know, as long as the cluster is running well and the witness is functioning properly, the event 2050 can be ignored.
Similar case for your reference:

https://social.technet.microsoft.com/Forums/en-US/659a6c47-46f6-49ab-902a-d546fb8bc7a7/constant-log-error-id-2050-and-2051-after-added-fc-storage-and-made-it-ha-with-cvs?forum=winserverClustering

Thanks for your understanding.
Best Regards,
Danny

-----------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi,
I translated your issue in English for better understanding:
In our environment we have a cluster composed of 9 nodes, 3 of these nodes (servers) are of similar hardware but newer than the other 6 nodes; the environment has a Windows Server 2016 OS.
Reviewing the operation of the cluster, we find in the event viewer several WARNINGS with the following description:

Log Name: Microsoft-Windows-FailoverClustering / Diagnostic
Source: Microsoft-Windows-FailoverClustering
Date: 4/5/2021 7:17:01 PM
Event ID: 2050
Task Category: None
Level: Warning
Keywords:
User: SYSTEM
Computer: NODO01.domain.xx.xx
Description:
[MRR] Node 3: Dropping reply for unknown witness response 97953021
Event Xml:
<Event xmlns = "http://schemas.microsoft.com/win/2004/08/events/event">;
<System>
<Provider Name = "Microsoft-Windows-FailoverClustering" Guid = "{BAF908EA-3421-4CA9-9B84-6689B8C6F85F}" />
<EventID> 2050 </EventID>
<Version> 0 </Version>
<Level> 3 </Level>
<Task> 0 </Task>
<Opcode> 0 </Opcode>
<Keywords> 0x2000000000000000 </Keywords>
<TimeCreated SystemTime = "2021-04-05T22: 17: 01.079670100Z" />
<EventRecordID> 13567818 </EventRecordID>
<Correlation />
<Execution ProcessID = "3120" ThreadID = "5128" />
<Channel> Microsoft-Windows-FailoverClustering / Diagnostic </Channel>
<Computer> NODE01.domain.xx.xx </Computer>
<Security UserID = "S-1-5-18" />
</System>
<EventData>
<Data Name = "LogString"> [MRR] Node 3: Dropping reply for unknown witness response 97953021 </Data>
</EventData>
</Event>

The reality is that the operation is optimal, we have several virtual machines running in the cluster and we have no problems. I am concerned about this message because I cannot find where the problem may be and I did not find valid information on the internet either. Only that these types of events are informative and not critical, that I can ignore it ... which does not leave me calm.
Can someone give me a hand if it already happened to you and how did you solve it? Thank you.

Answer 3

Hi YuhanDeng, thank you for your response and sorry for taking a long time to respond.
From where you can have more official information about 2050 events, since different types of events appear with the same ID. Also some reference that indicates that it does not matter if everything works well.