Windows 2012–Event 5125: Cluster Shared Volumes (CSV) in redirected access mode

Windows 2012–Event 5125: Cluster Shared Volumes (CSV) in redirected access mode

Trying to create VMs via SCVMM 2012 on Windows 2012 HyperV Cluster, and failing… what!!! Checking event logs I noticed System Event 5125 which did not make sense at first. The VM creation job was failing with an error but the XMLs were being created in the CSV volume. The VM properties was showing everything as expected but my new vhdx.

 

Log Name:      System
Source:        Microsoft-Windows-FailoverClustering
Event ID:      5125
Task Category: Cluster Shared Volume
Level:         Warning
Keywords:     
User:          SYSTEM
Description:
Cluster Shared Volume ‘Volume1’ (”) has identified one or more active filter drivers on this device stack that could interfere with CSV operations. I/O access will be redirected to the storage device over the network through another Cluster node. This may result in degraded performance. Please contact the filter driver vendor to verify interoperability with Cluster Shared Volumes.

Active filter drivers found:
lume7ResumeKeyFilter
Event Xml:

 

After “reading” the description of the event, further investigation revealed that the ResumeKeyFilter is a Microsoft Minifilter. Full list of Minifilters are listed in the “File System Minifilter Allocated Altitudes”: http://msdn.microsoft.com/en-us/windows/hardware/gg462961.aspx

When the failover cluster mmc checked, the CSV disk was in “Redirected Access” mode. (BTW, for troubleshooting Redirected access on CSV volumes , “Ask the Core Team” has a great post at http://blogs.technet.com/b/askcore/archive/2010/12/16/troubleshooting-redirected-access-on-a-cluster-shared-volume-csv.aspx

Then with the help of fltmc.exe (minifilter driver management), I figured what the culprit was: unsupported version of McAfee. Fortunately, as one of the servers did not have McAfee, it was easy to understand what was going on:

 

Figure below shows 2 nodes, node1 has Mcafee installed (mdehidk). As seen, when the CSV owned by node1, it has 3 minifilters. Once the CSV volume is moved to the node 2, CSV volume has 2 minifilters attached.

 

image

And the Cluster disk becomes happy again:

image

 

By the way, McAfee will be supporting Windows 2012 in the first quarter of 2013: https://kc.mcafee.com/corporate/index?page=content&id=KB75779

Apparently, there is also a known issue for Windows 2008 R2 clusters with certain versions of McAfee (https://kc.mcafee.com/corporate/index?page=content&id=KB73596) and the solution is to install http://support.microsoft.com/default.aspx?scid=kb;EN-US;2674551.

Bulent Tolu

No comments.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Share
Translate »