Hyper-V Cluster Error

alan2308

I inherited a 2 node Hyper-V cluster (Hyper-V Server 2012). Every day at around 12:05pm, I get this in the event log:

Warning Event 2511
Source: Server
Category: None
Username: N/A
Computer: xxxxxxxxxxx
Description: The server service was unable to recreate the share ClusterTestShare_{915570a5-22d6-4b04-a5ef-18ad010e7f7a} because the directory C:\ClusterTestDir_{915570a5-22d6-4b04-a5ef-18ad010e7f7a} no longer exists. Please run "net share ClusterTestShare_{915570a5-22d6-4b04-a5ef-18ad010e7f7a} /delete" to delete the share, or recreate the directory C:\ClusterTestDir_{915570a5-22d6-4b04-a5ef-18ad010e7f7a}.

The alphanumeric string in between { and } in the directory and share name change every day, but the error is there like clockwork. Any ideas where to go to start troubleshooting this?

kriscamaro68

What are you using for your storage? iSCSI, smb3 or fiber channel? If its smb3 maybe is a script that is mapping the drive and then deleting it or not able to map it at all?

lsud00d

The alphanumeric string is in the VM GUID format, can you trace it to an active VM?

Also, have you looked in the Hyper-V-VMMS (or other Hyper-V) event longs for anything more specific? It sounds like somethings wonky with a CSV, maybe a permissions/ownership issue with a parent node...or there's remnants of a CSV that resources are trying to connect to.

Also, since it happens at the same time every day, you could use Wireshark and see where (source, destination) the communication is taking place.

Is the test share a CSV from an iSCSI/FC SAN connection?

alan2308

@kriscamaro68 it's iSCSI.

@lsud00d Thanks, knowing that it's a VM GUID should definitely help. Since it appears to be a different one every time, I thought it might just be random. I don't know anything about these test shares other than they're in the root of the c:\ drive and the directory is gone when I go to the server and look. There are a couple iSCSI connections on the server, so it's possible they point to one of them somehow.

kriscamaro68

What does it show when you open up the failover cluster manager under storage?

lsud00d

Running something like this might help you figure out more details...I think it might be related to a snapshot


get-vm | get-vmsnapshot | where {$_.CreationTime -gt "4/7/2014 12:10 PM" -and $_.CreationTime -lt "4/7/2014 12:00 PM"} | fl *

Run that from the host that's getting these messages in event viewer. Obviously adjust the date/times in the script (you said it happens around 12:05 PM) and run it several times around when this event happens to catch the data since it seems to be an elusive one.