Vista - Detect cluster group move

Hello!

I administer some Windows 2003 clusters, with different cluster groups
and resources.
I'd like to receive a mail when a cluster group move (the best would
be if I could detect also the reason why the move has started)...
suggestions?
thanks!

You should be able to monitor the cluster groups and / or resources
and report on changes by using WMI. You can script this and there are
some general examples in the Script repository that should serve as a
starting point if you're not familiar with this already, especially
under Operating System, Monitoring:

http://www.microsoft.com/technet/scr....mspx?mfr=true

The key is knowing what it is within WMI you need to watch for and in
this case it will be the MSCluster classes:

http://msdn.microsoft.com/en-us/libr...76(VS.85).aspx

Instead of scripting you could look at a WMI Permanent Event
Subscription. This seems a more efficient way of doing it and may be
simpler than scripting once you are familiar with the way it works.
If, again, you aren't too familiar with this area there's some more
info here:

http://msdn.microsoft.com/en-us/libr...96(VS.85).aspx

Essentially you create a mof file that describes the filter that you
will apply to WMI events and the consumer that will take action when
the event occurs and compile this into WMI using the mofcomp command.
There is a built in smtpeventconsumer that handles delivering emails.
An example of the file would be something like this:

#pragma namespace ("\\\\.\\root\\subscription")

instance of __EventFilter as $FILTER
{
Name = "Cluster Resource Change";

EventNamespace = "root\\MSCluster";

Query = "SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE
TargetInstance ISA \"MSCluster_EventResourceStateChange\" ;

QueryLanguage = "WQL";
};


instance of SMTPEventConsumer as $CONSUMER
{
Name = "Cluster Resource Change";
ToLine = "my.address@xxxxxx";
ReplyToLine = "my.address@xxxxxx";
SMTPServer = "smtpserver.mydomain.com";
Subject = "WARNING: A cluster resource state change has
been logged";
Message = "The resource %TargetInstance.EventObjectName is
held by %TargetInstance.EventNode%. ";
};

instance of __FilterToConsumerBinding
{
Consumer = $CONSUMER ;
Filter = $FILTER ;
};


Unfortunately I don't have access to a cluster to test this and I
haven't done exactly this monitoring before so you may need to work on
this. It assumes that this will be on a Windows 2003 (and upwards)
system and that the correct EventNameSpace is "root
\MSCluster" (perhaps someone else could confirm this bit). You may
also be able to get some information about why the group or resource
has moved with the EventTypeMajor property but again I don't have any
way of testing this.

Dominic