Windows failover cluster monitoring

Introduction

High availability enables your IT infrastructure to function continuously though some of the components may fail. High availability plays a vital role in case of a severe disruption in services that may lead to severe business impact.

It is a concept that entails the elimination of single points of failure to make sure that even if one of the components fail, such as a server, the service is still available.

Failover

Failover is a process. Whenever a primary system, network or a database fails or is abnormally terminated, then a Failover acts as a standby which helps resume these operations.

Failover Cluster

Failover cluster is a set of servers that work together to provide High Availability (HA) or Continuous availability (CA). As mentioned earlier, if one of the servers goes down another node in the cluster can take over its workload with minimal or no downtime. Some failover clusters use physical servers whereas others involve virtual machines (VMs).

CA clusters allow users to access and work on the services and applications without any incidence of timeouts (100% availability), in case of a server failure. HA clusters, on the other hand, may cause a short hiatus in the service, but system recovers automatically with minimum downtime and no data loss.

A cluster is a set of two or more nodes (servers) that transmit data for processing through cables or a dedicated secure network. Even load balancing, storage or concurrent/parallel processing is possible through other clustering technologies.

If you look at the above image, Node 1 and Node 2 have common shared storage. Whenever one node goes down, the other one will pick up from there. These two nodes have one virtual IP that all other clients connect to.

Let us take a look at the two failover clusters, namely High Availability Failover Clusters and Continuous Availability Failover Clusters.

High Availability Failover Clusters

In case of High Availability Failover Clusters, a set of servers share data and resources in the system. All the nodes have access to the shared storage.

High availability clusters also include a monitoring connection that servers use to check the “heartbeat” or health of the other servers. At any time, at least one of the nodes in a cluster is active, while at least one is passive.

Continuous Availability Failover Clusters

This system consists of multiple systems that share a single copy of a computer’s operating system. Software commands issued by one system are also executed on the other systems. In case of a failover, the user can check critical data in a transaction.

There are a few Failover Cluster types like Windows Server Failover Cluster (WSFC), VMware Failover Clusters, SQL Server Failover Clusters, and Red Hat Linux Failover Clusters.

Windows Server Failover Clustering (WSFC)

One of the powerful features of Windows Server is the ability to create Windows failover clusters. With Windows Server 2019, Windows Failover Clustering is more powerful than ever and can host many highly available resources for business-critical workloads.

Following are the types of Windows Server 2019 Failover Clustering:

• Hyper-V Clustering
• Clustering for File Services
• Scale-Out File Server
• Application Layer Clustering
• Host Layer Clustering
• Tiered Clustering

Each provides tremendous capabilities to ensure production workloads are resilient and highly available.

Windows Server 2019 Failover Clustering supports the new and demanding use cases with a combination of various cluster types and applications of various clustering technologies.

Windows Server Failover Clustering (WSFC) is a feature of the Windows server platform for improving the high availability of clustered roles (formerly called clustered applications and services). For example, say there are two servers. They communicate through a series of heartbeat signals over a dedicated network.

Prerequisites

1. The OpsRamp Gateway must be installed.
2. PS Remoting and WMI remoting to be enabled on each cluster node. If the configured user is non-administrator, then the below user should have privileges on WMI remoting and on Windows Services.

Following are the specific prerequisites for non-administrator/operator level users:

• 1. Enable WMI Remoting

  To enable WMI remoting:

  1. Click Start and select Run.
  2. Enter wmimgmt.msc and click OK.
  3. Right click WMI control (Local) and select Properties.
  4. Click Security tab.
  5. Expand Root.
  6. Select WMI and Click Security.
  7. Add user and select the following permissions:
     
     • Execute methods
       
     • Enable account
       
     • Enable remoting
       
     • Read security

• 2. Enable WMI Remoting – CPU, Disk, Network

  1. Click Start and select Run.
  2. Enter lusrmgr.msc and click OK.
  3. In the Groups folder, right click Performance Monitor Users and select Properties.
  4. Click Members of tab, and click Add.
  5. Add users.

• 3. Enable Windows Service Monitoring

  1. Retrieve the user SID of the User Account from the monitored device.
     
  2. Open Command Prompt in Administrator mode.
     
  3. Run the below command to retrieve the user SID.
     Note: Replace UserName with the user name for the User account.
     

      wmic useraccount where name="UserName" get name,sid
  
      Example:
      wmic useraccount where name="apiuser" get name,sid
      

  4. Note down the SID.
     

  (Ex. S-1-0-10-200000-30000000000-4000000000-500)

  5. Retrieve the current SDDL for the SC Manager.
  6. Run the below command which will save the current SDDL for the SC Manager to CurrentSDDL.txt.

      sc sdshow clussvc > CurrentSDDL.txt
      

  7. Edit the CurrentSDDL.txt and copy the entire content.
     The SDDL will look like below:

      D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)(A;;CC;;;AC)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)
      

  8. Update the SDDL:
     Frame new SDDL snippet for above SID
     

      (A;;CCLCRPWPRC;;; <SID of User> )
  
      Example:
      (A;;CCLCRPWPRC;;;S-1-0-10-200000-30000000000-4000000000-500)
      

  9. Place this snippet before “S:” of original SDDL.
     Updated SDDL will be like this:
     

      D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)(A;;CC;;;AC)(A;;CCLCRPWPRC;;;S-1-0-10-200000-30000000000-4000000000-500)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)
  
      

  10. Execute the below command with the updated SDDL:

      sc sdset clussvc D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)(A;;CC;;;AC)(A;;CCLCRPWPRC;;;S-1-0-10-200000-30000000000-4000000000-500)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)
  
      

• 4. Open ports and add user in all nodes and cluster

  • Opsramp gateway should be able to access cluster and nodes.
    
  • Ports to be opened are 5985 and 5986.
    Note: By default, WS-Man and PowerShell remoting use port 5985 and 5986 for connections over HTTP and HTTPS, users should be present in nodes and cluster.

Configure and install the integration

1. Go to Setup > Integrations and Apps.
2. Click + ADD on the INSTALLED APP page. The AVAILABLE INTEGRATIONS AND APPS page displays all the available applications along with the newly created application with the version.
   Note: You can even search for the application using the search option available. Also you can use the All Categories option to search.

3. Click ADD in the Windows Fail-over Cluster application.
4. In the Configurations page, click + ADD. The Add Configuration page appears.
5. Enter the below mentioned BASIC INFORMATION:

Note: Select App Failure Notifications; if turned on, you will be notified in case of an application failure that is, Connectivity Exception, Authentication Exception.

6. In the RESOURCE TYPE section, select:

   • ALL: All the existing and future resources will be discovered.
   • SELECT: You can select one or multiple resources to be discovered.

7. In the DISCOVERY SCHEDULE section, select Recurrence Pattern to add one of the following patterns:

   • Minutes
   • Hourly
   • Daily
   • Weekly
   • Monthly

8. Click Save.
   The configuration is saved and displayed on the page.

9. Now the configuration is saved and displayed on the configurations page after you save it.
   
   Note: From the same page, you may Edit and Remove the created configuration.
10. Click NEXT.
11. In the Installation page, select an existing registered gateway profile, and click FINISH.

The application is now installed and displayed on the Installed Integration page. Use the search field to find the installed application.

Modify the Configuration

• See Modify an Installed Integration or Application article.

  Note: Select the Windows Fail-over Cluster application.

View the Windows failover cluster device details

The discovered resource(s) are displayed in the Infrastructure page under Cluster, with Native Resource Type as Windows Failover Cluster. You can navigate to the Attributes tab to view the discovery details, and Metrics tab to view the metric details for Windows Failover Cluster.

The cluster nodes are displayed under Components.

Supported Metrics

Resource Type: Cluster

Resource Type: Server

Risks, Limitations & Assumptions

• For Cluster Object Discovery and Monitoring implementation, OpsRamp is considering the object which has Name equals to Cluster Name in Get-ClusterResource response.
• For ClusterGroup monitoring implementation, OpsRamp is considering the object which has Name as Cluster Group in Get-ClusterGroup response.
• windows_cluster_group_failover_status metric’s possible instance values are 0-if there is no change in OwnerNode, 1-If there is a change in OwnerNode, 2 If no OwnerNode.
• Application can handle Critical/Recovery failure alert notifications for below two cases of when user enables App Failure Notifications in configuration:
  • Connectivity Exception
  • Authentication Exception
• If the user enables same thresholds on Additional OS level monitoring metrics on both Cluster and Node, he might see 2 alerts with same details with respective metric names (i.e, Windows_cluster_system_disk_Utilization, Windows_cluster_node_system_disk_Utilization).
• While trying to fetch the node IP address we receive multiple node IPs, which will include many local IPs and actual IPs (example: let us say actual node IP is 10.1.1.1 when trying to fetch the details we will receive two IPs one associated with cluster(192.168.0.0) and other is the actual IP). to identify the actual node IP address from the list of IP addresses received we are assuming that node IP address is part of the same subnet of cluster IP address. meaning if cluster IP is 10.1.1.1 then node IPs will be 10.1.X.X.
• Have provided the provision to give Cluster IP Address OR HostName in configuration, But HostName provision will work only if the Host Name Resolution works.
• No support of showing activity log and applied time.
• No support for the option to get Latest snapshot metric.
• Powershell execution is not working in arm64 architecture due to which windows-failover-cluster application will not work in arm64 architecture.