Forum Discussion

StevenRPF's avatar
StevenRPF
Brass Contributor
Oct 11, 2023

Hyper-V Cluster Failover Event viewer log showing SMB traffic connect to quorum disk network share

Hi,   To tweak my SIEM, I need to correlate smb network traffic between Hyper-V servers and witness disk stored on a network share on another server. I'm searching a log who tell me the Hyper-V is ...
clustering
Hyper-V
management
networking
windows server
Jamony's avatar
Jamony
MCT
Sep 18, 2026

SMB traffic between cluster nodes and a File Share Witness is expected because the witness itself is an SMB share.

 

For troubleshooting, collect the cluster log:

 

Get-ClusterLog -UseLocalTime -TimeSpan 30

 

Also inspect:

 

Microsoft-Windows-FailoverClustering/Operational

 

You can test SMB connectivity from each cluster node with:

 

Test-NetConnection <WitnessServer> -Port 445

 

For SIEM exclusions, I would not exclude all SMB traffic from the Hyper-V hosts. Restrict the exception to the known cluster nodes, the known witness server and TCP 445.