What we need to make this work

• (1) machine to be our iSCSI target
• (2) machines with the following features installed: Failover Clustering and Setup and Boot Eventing
  

Directions

1. On the machines to be used as the iSCSI target, setup your target using the instructions provided in the iSCSI Target Block Storage Overview.
2. Next, using the same TechNet article, configure the iSCSI initiator on each of the collectors in the cluster and connect to your new iSCSI target.
3. Start the iSCSI Initiator on all collectors in the cluster and Quick Connect to your iSCSI target.
   
   1. Verify that you are successfully connected by loading Disk Manager and verify that you can see the iSCSI target drive listed as a disk available to the system.
      
      1. Note: You may need to bring the drive online.
4. Install the Setup and Boot Event Collection feature on each of the collectors in the cluster.
5. Copy the C:\ProgramData\Microsoft\BootEventCollector folder to C:\ClusterStorage\Volume1, the shared disk.
6. Grant the Network Service account the following permissions to the BootEventCollector folder and its sub-folders.
   
   1. Read & Execute
   2. List folder contents
   3. Read
   4. Modify
   5. Write
7. Setup your failover cluster using the steps provided in the Create a Failover Cluster TechNet article.
   
   1. Add a Generic Service Role to your cluster, name it SBEC Service Role and choose the Boot Event Collector from the service list.
   2. For the Replicate Registry Settings step, replicate the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BootEventCollector\Parameters registry key in order to ensure the location of the configuration file is kept in sync.
8. Configure your SBEC collector following the steps outlined in Getting started with Setup and Boot Event Collection. You only need to run the steps to setup the Active configuration on the node that owns the storage because the configuration is stored on the shared storage provided by the iSCSI target and is shared with the remaining collectors via the cluster.

1. 1. Update the path to the logs and ETL storage location located on the shared storage location

<collector confiVersionMajor="1" statuslog="C:\ClusterStorage\Volume1\BootEventCollector\Logs\statuslog.xml">

<common>

<collectorport value ="50000"/>

<forwarder type="etl">

<set name="file" value="C:\ClusterStorage\Volume1\BootEventCollector\Etl\{computer}\{computer}_{#3}.etl"/>

<set name="size" value="10mb"/>

<set name="nfiles" value="10"/>

<set name="toxml" value="none"/>

</forwarder>

<target>

<ipv4 value="192.168.1.1"/>

<key value="a.b.c.d"/>

<computer value="computer1"/>

</target>

</common>

</collector>

9. Restart the BootEventCollector service after changing the path in the registry using one of the following methods.

• • Using PowerShell, run the following command: Restart-Service BootEventCollector.
  • Using the Services MMC, find the Boot Event Collector service and restart it.

10. Configure your target machines using the steps outlined in Setup and Boot Event Collection.

• Note: Be sure to specify the virtual IP (VIP) of the cluster, not the local IP of the collector when specifying the CollectorIP parameter.

There you have it, a clustered SBEC service with a shared iSCSI target for storage.  If you have any problems, feedback or ideas, please comment below.

Check out the How to setup Nano Server to send diagnostic messages off-box for remote analysis blog post for a quick walk-though.

Well, there is good news, Windows Server 2016 has a new feature that can be used to remotely collect setup and boot events from your Windows Server 2016 and Windows 10 client machines called “Setup and Boot Event Collection”.

Setup and Boot Event Collection is a new feature starting in Windows Server Technical Preview 2 that allows you to designate a “collector” computer that can gather a variety of important events that occur on other computers when they boot or go through the setup process. You can then later analyze the collected events with Event Viewer, Message Analyzer, Wevtutil, or Windows PowerShell cmdlets.

Here are a few of the setup and boot events you can monitor with the Setup and Boot Event Collection service:

• Loading of kernel modules and drivers
• Enumeration of devices and initialization of their drivers (including “devices” such as CPU type)
• Verification and mounting of file systems
• Starting of executable files
• Starting and completions of system updates
• The points when the system becomes available for logon, establishes connection with a domain controller, completion of service starts, and availability of network shares

With a few simple PowerShell commands and a couple lines of XML, you can have a low-level diagnostic collection system up and ready for action.

To help get you started, please check out Getting started with Setup and Boot Event Collection.