FailoverClustering Event Subscription

Question

I'm setting up a server to collect FailoverClustering event logs from several machines in a Cluster using Event Viewer Subscriptions. I've set these up before where I select events by log, usually choose system or application logs and go from there.

However I cannot find the specific FailoverClustering log "Microsoft-Windows-FailoverClustering/Operational" and am wondering if I am perhaps going about this the wrong way or there is no option to do so?

For the moment I created a subscription that pulls only system events that I want to watch pertaining to FailoverClustering by entering comma separated list of event IDs.

Any suggestions or recommendations on doing what I'm attempting are appreciated!

Answer 1

Hello @TJwillians74

You can find the logs in the next path through EventViewer:

Services\Microsoft\Windows\FailoverClustering\Operational

You can also find a list of events for filtering here:
https://techcommunity.microsoft.com/t5/failover-clustering/list-of-failover-cluster-events-in-windows-2016-2019/ba-p/447150?attachment-id=12219

Hope this helps with your query,

------------

--If the reply is helpful, please Upvote and Accept as answer--