Event Log Replication on Cluster Node Generates Event ID 1137 (283078)



The information in this article applies to:

  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Datacenter Server

This article was previously published under Q283078

SYMPTOMS

The following warning message may be reported in the system event logs when the Cluster service starts or during normal operation of a server cluster.
Event ID: 1137
Source: ClusSvc
Description: Event Log replication queue OUTQ is full. xxx event(s) is (are) discarded of (total) size xxx.

CAUSE

This issue occurs because server clusters send event log entries from each node to all other nodes in the cluster so that each node has all of the event log entries. This behavior helps the administrator identify issues with the cluster and reduces the administrative task of having to check each node's event log.

When the cluster nodes are up, they actively exchange event log messages. If the rate of the logged messages exceeds the rate with which messages are being sent to other nodes, some of the event messages may be dropped. This behavior is expected. If the message is dropped, the event is still written to the local node. However, they are not written to the remote nodes. This behavior prevents disruptions in programs that are attempting to log an entry when the replication cannot keep up.

When the Cluster service starts, it may receive many event log messages that occurred on the system before the Cluster service was started. If the number of messages exceeds the size limit of the queue, the messages are dropped.

The event ID 1137 message does not reveal the true issue. To find out the root of the issue, you must find out what is generating all of the event log entries. To correct this error, troubleshoot the other errors that are being generated by the system.

RESOLUTION

If the cluster server is a print server, disable the Informational print messages option in the Spooler properties. This option may cause excessive event log entries.

MORE INFORMATION

For additional information, click the article number below to view the article in the Microsoft Knowledge Base:

224969 Configure Event Log Replication in Windows 2000 Cluster Servers

229071 No Event Log Replication on Cluster Servers

307781 Event Log entries may appear incomplete on mixed Windows 2000/Windows .NET Clusters


Modification Type:MinorLast Reviewed:1/26/2006
Keywords:kbClustering kbprb w2000mscs KB283078