Windows 2012–Event 5125: Cluster Shared Volumes (CSV) in redirected access mode

Trying to create VMs via SCVMM 2012 on Windows 2012 HyperV Cluster, and failing… what!!! Checking event logs I noticed System Event 5125 which did not make sense at first. The VM creation job was failing with an error but the XMLs were being created in the CSV volume. The VM properties was showing everything as expected but my new vhdx.

 

Log Name:      System
Source:        Microsoft-Windows-FailoverClustering
Event ID:      5125
Task Category: Cluster Shared Volume
Level:         Warning
Keywords:     
User:          SYSTEM
Description:
Cluster Shared Volume ‘Volume1’ (”) has identified one or more active filter drivers on this device stack that could interfere with CSV operations. I/O access will be redirected to the storage device over the network through another Cluster node. This may result in degraded performance. Please contact the filter driver vendor to verify interoperability with Cluster Shared Volumes.

Active filter drivers found:
lume7ResumeKeyFilter
Event Xml:

 

After “reading” the description of the event, further investigation revealed that the ResumeKeyFilter is a Microsoft Minifilter. Full list of Minifilters are listed in the “File System Minifilter Allocated Altitudes”: http://msdn.microsoft.com/en-us/windows/hardware/gg462961.aspx

When the failover cluster mmc checked, the CSV disk was in “Redirected Access” mode. (BTW, for troubleshooting Redirected access on CSV volumes , “Ask the Core Team” has a great post at http://blogs.technet.com/b/askcore/archive/2010/12/16/troubleshooting-redirected-access-on-a-cluster-shared-volume-csv.aspx

Then with the help of fltmc.exe (minifilter driver management), I figured what the culprit was: unsupported version of McAfee. Fortunately, as one of the servers did not have McAfee, it was easy to understand what was going on:

 

Figure below shows 2 nodes, node1 has Mcafee installed (mdehidk). As seen, when the CSV owned by node1, it has 3 minifilters. Once the CSV volume is moved to the node 2, CSV volume has 2 minifilters attached.

 

image

And the Cluster disk becomes happy again:

image

 

By the way, McAfee will be supporting Windows 2012 in the first quarter of 2013: https://kc.mcafee.com/corporate/index?page=content&id=KB75779

Apparently, there is also a known issue for Windows 2008 R2 clusters with certain versions of McAfee (https://kc.mcafee.com/corporate/index?page=content&id=KB73596) and the solution is to install http://support.microsoft.com/default.aspx?scid=kb;EN-US;2674551.

Bulent Tolu

Bulent Tolu

Sr. Systems Engineer at VMware
Bulent is an IT professional with Master's in MIS and 10-years of experience in broad range of Information Technologies. He is exposed to engineering/architecting, implementation/integration, and administration of various high-available IT systems and infrastructure. He has a passion to continually research, test and evaluate new technologies and follow industry best practices to secure and optimize IT systems. Currently, he lives in Istanbul and works as a Sr. Systems Engineer at VMware.
Bulent Tolu

Leave a Reply

Your email address will not be published. Required fields are marked *

Post Navigation

Share
Translate »