The Cluster Service May Experience a "MoveFileExW Failed" Error (321531)



The information in this article applies to:

  • Microsoft Windows 2000 Advanced Server

This article was previously published under Q321531

SYMPTOMS

You may experience one or more of the following symptoms on your Microsoft Windows 2000-based server cluster:
  • You cannot start the Cluster service on a cluster node. If you start the cluster service with the -fixquorum switch, it may start successfully.
  • The Cluster service quits unexpectedly on a cluster node and one or more events similar to the following appear in the system log of the Event Viewer:
    Date:     <date>          Source:   ClusSvc
    Time:     <time>          Category: 256
    Type:     Error           Event ID: 1000
    User:     N/A
    Computer: <computername>
    
    Description:
    Microsoft Clustering
    Service suffered an unexpected fatal error at line 2166 of source module 
    D:\nt\private\cluster\service\dm\dmlog.c. The error code was 5.
    -and-
    Date:     <date>          Source:   Service Control Manager
    Time:     <time>          Category: 0
    Type:     Error           Event ID: 7031
    User:     N/A
    Computer: <computername>
    
    Description:
    Cluster Service service terminated unexpectedly. It has done this 1 time(s).  
    The following corrective action will be taken in 60000 milliseconds: Restart 
    the service.  
  • Information similar to the following is recorded in the Cluster.log file: 000006c8.00000740::2002/04/16-00:45:14.278 [LM] LogpReset:: MoveFileExW failed. Error = 0x00000005
    000006c8.00000740::2002/04/16-00:45:14.278 [LM] LogClose : Entry LogFile=0x000c0dd8
    000006c8.00000740::2002/04/16-00:45:14.278 [LM] LogClose : Exit returning success
    000006c8.00000740::2002/04/16-00:45:14.278 [LM] LogpReset exit, returning 0x00000005
    000006c8.00000740::2002/04/16-00:45:14.278 [LM] LogReset exit, returning 0x00000005
    000006c8.00000740::2002/04/16-00:45:14.278 [DM]DmpCheckpointTimerCb - Failed to reset log, error=5
    000006c8.00000740::2002/04/16-00:45:14.278 Microsoft Clusterservice:
    Unexpected fatal error in Line 2166 of sourcemodule D:\nt\private\cluster\service\dm\dmlog.c. errorcode: 5.
    0000078c.00000788::2002/04/16-00:45:14.715 [RM] Going away, Status = 1, Shutdown = 0.

CAUSE

The log entry from the Cluster.log file indicates that the Cluster service cannot rename a temporary file to Quolog.log. The rename operation occurs for one of the following reasons:
  • The log file is full.
  • A node joins the cluster.
  • Four hours have passed.
The "error=5" error code in the Cluster.log file corresponds to the following error message:
ERROR_ACCESS_DENIED
This error may occur if a virus scanner program accesses the Quolog.log file when the rename operation is tried.

RESOLUTION

To resolve this issue, configure the antivirus program so that it does not scan the MSCS folder on the quorum disk.

MORE INFORMATION

For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

266274 How to Troubleshoot Cluster Service Startup Issues


Modification Type:MajorLast Reviewed:4/29/2003
Keywords:kberrmsg kbprb KB321531