During our proactive monitoring for a client we saw a failover occur for a SQL cluster, after getting everything back online we began checking the logs to ensure everything was ok. We noticed the below error:

This was actually a node in the clusters machine account, the one that interestingly was involved in the drop. After a bit of research it was suggested it may well be linked to SCOM – we do have the SCOM monitoring agent installed using a local system account. The alert was coming in around every 5 minutes so we stopped the SCOM service to see if the error would stop too. Sure enough it did. Looks like it had an old token and restarting the service created a new one – no more errors!

Hope it helps.

About the author