In my case (2 x Windows Server 2022 as Cluster) the issue for "Online - data retreival failure" was due to "Microsoft-Windows-Kernel-IoTrace/Diagnostic" missing or corrupt. I was unable to open said event log in event viewer. A little bit of googling around lead me to a knowledge article from Dell: https://www.dell.com/support/kbdoc/de-de/000209937/pro-ax-650-online-data-retrieval-failures-occurred-due-to-microsoft-windows-kernel-iotrace-diagnostic-missing-or-corrupted
I followed their instructions - well almost - and issue fixed. As always: be sure to have working backups!
Solution as per Dell KB article (I changed a thing because DumpPolicy is for the cluster and thus needs to be changed only on ONE node):
Steps to disable the event log Microsoft-Windows-Kernel-IoTrace/Diagnostic:
Perform Steps 1 through 8 on ONE node of your cluster only:
- Log on to the target server as a user with administrator privileges.
- Start Windows PowerShell with administrator privileges.
- Execute the following command to check the current value of DumpPolicy.
Command: (Get-Cluster).DumpPolicy Example execution result in my environment: PS C:\Users\Administrator> (Get-Cluster).DumpPolicy
1376850201 - Convert the decimal value to binary. (converter tools: https://www.binaryhexconverter.com/decimal-to-binary-converter) *The following are the values in my verification environment, so please use the actual values. Decimal: 1376850201 => Binary: 01010010000100010001000100011001
- Change the 21st value count from the right to 0 in the above binary number. *The following are the values in our verification environment, so please use the actual values. Current value: 01010010000100010001000100011001 After change: 01010010000000010001000100011001
- Convert the above "after change" binary value to decimal. *The following are the values in my environment, so please use the actual values. Binary number after change: 01010010000000010001000100011001 Modified decimal number: 1375801625
- Execute the following command in Windows PowerShell started with administrator privileges. Command: (Get-Cluster).DumpPolicy= <your modified decimal number> Example execution result: PS C:\Users\Administrator> (get-cluster).DumpPolicy=1375801625 (Nothing is displayed if successful.)
- Confirm that the changed value is output by executing the following command again.
Command: (Get-Cluster).DumpPolicy
Example execution result:
PS C:\Users\Administrator> (Get-Cluster).DumpPolicy
1375801625
All nodes in the cluster should now give this number on (Get-Cluster).DumpPolicy
The following is to be performed on ALL nodes in the cluster:
- In Registry Editor, change the following registry data to 0 (disabled). Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-IoTrace/Diagnostic Name : Enabled Type: REG_DWORD data : 0
- Restart the OS, Make sure the event log Microsoft-Windows-Kernel-IoTrace/Diagnostic is disabled.