Windows 2012–Event 5125: Cluster Shared Volumes (CSV) in redirected access mode
Trying to create VMs via SCVMM 2012 on Windows 2012 HyperV Cluster, and failing… what!!! Checking event logs I noticed System Event 5125 which did not make sense at first. The VM creation job was failing with an error but the XMLs were being created in the CSV volume. The VM properties was showing everything as expected but my new vhdx.
Log Name: System
Event ID: 5125
Task Category: Cluster Shared Volume
Cluster Shared Volume ‘Volume1’ (”) has identified one or more active filter drivers on this device stack that could interfere with CSV operations. I/O access will be redirected to the storage device over the network through another Cluster node. This may result in degraded performance. Please contact the filter driver vendor to verify interoperability with Cluster Shared Volumes.
Active filter drivers found:
After “reading” the description of the event, further investigation revealed that the ResumeKeyFilter is a Microsoft Minifilter. Full list of Minifilters are listed in the “File System Minifilter Allocated Altitudes”: http://msdn.microsoft.com/en-us/windows/hardware/gg462961.aspx
When the failover cluster mmc checked, the CSV disk was in “Redirected Access” mode. (BTW, for troubleshooting Redirected access on CSV volumes , “Ask the Core Team” has a great post at http://blogs.technet.com/b/askcore/archive/2010/12/16/troubleshooting-redirected-access-on-a-cluster-shared-volume-csv.aspx
Then with the help of fltmc.exe (minifilter driver management), I figured what the culprit was: unsupported version of McAfee. Fortunately, as one of the servers did not have McAfee, it was easy to understand what was going on:
Figure below shows 2 nodes, node1 has Mcafee installed (mdehidk). As seen, when the CSV owned by node1, it has 3 minifilters. Once the CSV volume is moved to the node 2, CSV volume has 2 minifilters attached.
And the Cluster disk becomes happy again:
By the way, McAfee will be supporting Windows 2012 in the first quarter of 2013: https://kc.mcafee.com/corporate/index?page=content&id=KB75779
Apparently, there is also a known issue for Windows 2008 R2 clusters with certain versions of McAfee (https://kc.mcafee.com/corporate/index?page=content&id=KB73596) and the solution is to install http://support.microsoft.com/default.aspx?scid=kb;EN-US;2674551.