Windows Server Failover Cluster Monitoring

Last updated - 24 November, 2025

Overview

LogicMonitor offers out-of-the-box monitoring for Windows Server Failover Clusters (WSFC). Monitoring is performed on a virtual device called a virtual network name (VNN). Each VNN is assigned a virtual IP address, and in some cases, multiple virtual IP addresses for specific services. There is no physical device for the cluster; nodes are added as physical devices or virtual machines.

All cluster alerting originates from the VNN. If a clustered service fails on a node and successfully rolls over to another node, there are no alerts on the cluster unless redundancy is at a critical level.

LogicMonitor also supports Storage Spaces Direct (S2D). These modules track the status and performance of S2D and alert for failure conditions.

For information about monitoring WSFC on SQL Server, see Windows Server Failover Cluster on SQL Server Monitoring.

Requirements for WSFC Monitoring

For WSFC monitoring, you need the following: 

• A Windows Collector

• PowerShell version 5 or later
• The addCategory_WindowsFailoverCluster and Powershell_Info PropertySources added to your portal
• Remote PowerShell enabled on all nodes in the cluster
  For more information, see Using PowerShell Scripts in LogicMonitor.
• A LogicMonitor Windows user with “Read-only Access” permissions set
  For more information, see Configuring a Read-only Access User for Monitoring.

Configuring a Read-Only Access User for Monitoring

1. In Microsoft, log into your administrator account. 
2. To grant read-only access to the cluster, do one of the following:
   1. To use the Failover Cluster manager, do the following:
      1. Navigate to the Failover Cluster Manager on any cluster node. 
      2. In the monitoring account field, enter in your monitoring account. For example, “Domain\monitorUser.” 
      3. Select the Read Access checkbox and ensure the Full Control checkbox is deselected. 
         For more information, see PowerShell for Failover Clustering: Read-Only Cluster Access. 
   2. To use PowerShell commands, do the following:
   3. Navigate to Administrative Tools and run the following PowerShell command:
      

      #powershell
        
      #Requires RSAT-AD-PowerShell and FailoverClusters modules
      $monitorUser = 'DOMAIN\monitorUser' # Replace with your service account
      #Find all the clusters in the domain
      $clusters = Get-ADComputer -Filter 'ObjectClass -eq "Computer" -and ServicePrincipalName -like "MSClusterVirtualServer"' -Properties DNSHostName
      foreach ($cluster in $clusters) { $clusterName = $cluster.DNSHostName if ($clusterName) \{ Grant-ClusterAccess -Cluster $clusterName -User $monitorUser -ReadOnly }
      }
      

      Copy
      For more information, see PowerShell for Failover Clustering: Read-Only Cluster Access. 
3. To verify read-only access, do the following:
   1. Log into your cluster using your LM service user account. 
   2. Run the following command:
      

      Get-Cluster -Cluster 

      Copy

After configuration the cluster information should display with no access denied error. 

Add Resources into Monitoring

To add your Windows Server Failover Cluster resources into monitoring, follow the standard process for adding resources in LogicMonitor. For more information, see Adding Resources.

Ensure that the necessary properties and credentials are configured for WSFC resources to enable proper monitoring and data collection. For more information, see Assigning Properties to Resources.

Assign Properties to Resources

The addCategory_WindowsFailoverCluster PropertySource automatically finds all cluster virtual resources and nodes and sets their system.categories property to “WSFC_VNN” or “WSFC_Node.” In addition, the following properties are added to the node and virtual cluster resources:

Property Name	Example Value
auto.wsfc.active_node	node1.example.com
auto.wsfc.fqdn	cluster1.example.com
auto.wsfc.ip	192.168.0.100
auto.wsfc.name	cluster1
auto.wsfc.nodes	node1,node2,node3

Import LogicModules

Install all WSFC LogicModules from the Exchange. For more information, see LogicModules in Package. If these LogicModules are already present, ensure you have the most recent version of each module. 

LogicModules in Package

LogicMonitor’s package for Windows Server Failover Cluster monitoring consists of the following LogicModules. For full coverage, import the following LogicModules into your platform:

Display Name	Type	Description
addCategory_WindowsFailoverCluster	PropertySource	Sets a category of “WSFC_VNN” for the cluster virtual resource and sets “WSFC_Node” for each node in a cluster in the system.categories property.
Windows Cluster Disks	Datasource	Monitors disks and volumes which are associated with the cluster, gathering metrics such as the storage details, number of partitions, and the overall utilization.
Windows Cluster MulticastMessages	DataSource	Monitors the Multicast Request-Response (MRR) messages throughout the cluster network, monitoring the multiple recipients and their responses.
Windows Cluster Network	DataSource	Monitors the cluster network throughput, message transmission, number of reconnections and message queue depth.
Windows Cluster NetworkInterfaces	DataSource	Monitors the operating state of the interfaces associated with the cluster.
Windows Cluster Nodes	DataSource	Monitors the individual nodes that comprise the cluster, monitoring their operating and drain state.
Windows Cluster NodeStatus	DataSource	Summary status of all nodes in a cluster.
Windows Cluster PrintServer	DataSource	Monitors the cluster print server spooler metrics such as job rate, total jobs, page rate, total pages, job spooling, job data, page references and errors.
Windows Cluster ResourceControlManager	DataSource	Monitors the Resource Control Manager(RCM) resource states and resource handling of failures and collections metrics such as number of groups currently online, Resource Host Monitor(RHS) processes and restarts.
Windows Cluster ResourceGroups	DataSource	Monitors the cluster resource group state. The current owner node is an instance property on the resource.
Windows Cluster Resources	DataSource	List all of the Cluster Resources and the current state.
Windows Cluster SharedVolumes	DataSource	Monitors Cluster Shared Volume operating state, backup state, fault state, cache state, storage utilization, storage capacity details, throughput, IOPS, latency, queue depth, flushes, cache IOPS, cache throughput, cache storage details and current LRU cache size.
Windows Cluster S2D StoragePoolStatus	DataSource	Monitors the status of storage pools in the S2D cluster.
Windows Cluster S2D Statistics	DataSource	Provides statistics from the S2D Health Report.
Windows Cluster S2D VirtualDisks	DataSource	Monitors S2D virtual disk names and status.

When setting static datapoint thresholds on the various metrics tracked by this package’s DataSources, LogicMonitor follows the technology owner’s best practice KPI recommendations.