I have a windows Server 2008 R2 cluster and I would like to be able to distinguish between a user initiated failover and a failover caused be a resource check failing.
I was hoping that the cluster service would write this information to the event log; but it appears this is not occurring. is there any way to make the cluster service write an event to the event log when a failover occurs?
How to create the cluster.log in Windows Server 2008 Failover Clustering
http://blogs.msdn.com/b/clustering/archive/2008/09/24/8962934.aspx
Maybe it's too late...
You can use this event IDs for monitoring when services move to another node
Event ID 1200 is the cluster trying to come online. Event ID 1201 is the cluster comming online. Event ID 1203 is the cluster trying to go offline. Event ID 1204 is the cluster comming offline.