Cluster failover logs needed for root cause analysis

Purpose:
  Logs required for analysis
Overview:

• Sudden Failover of cluster node.
• Switching between nodes.
• Unable to run one cluster group on a specific node, but other node no.
• Cannot start SAP or DB after some maintenance on one specific node.

Procedure:

1. Timestamp of when issue occurred.
2. Windows event viewer logs.
. Open the Event Viewer with "Start" -> "Control Panel" -> "Administrative Tools" -> "Event Viewer". Alternatively, use the command "eventvwr.exe".

• Windows Server 2003: Right-click the relevant logs and choose "Save Log File as". Save as type "Event Log" (evt format).

• Windows Server 2008: In the "Windows Logs" category, right-click the relevant event logs and choose "Save Events as". Save as type "Event Files" (evtx format).

 Compress the files (preferably use the "zip" format, e.g. use tool 7-ZIP from http://www.7-zip.org which has the best compression of all zip tools). You can also use sapcar.exe to compress the files, if no zip tool is available.
 Attach files to the incident.
 3. Windows Cluster log.  In Windows 2003 this is located at /system32/cluster  name of the log is cluster.log, For Windows 2008 or Windows 2008R2 you can use the cluster.exe command line
CLUSTER [cluster-name] LOG /GEN /COPY:"pathname A detailed trace log from each of the nodes is generated and copied to the path you specify. Need to attach several pages from the time of the failover
4. Trace files from the work directory of the failing instance ie ASCS or SCS in zip formatZip and attach  dev_disp, dev_w*, dev_ms, dev_rd. the stderr files, sapstartsrv and sapstart.log
Again use 7-ZIP to compress the files or sapcar.exe if no zip application is avaible