Forum Discussion

StevenRPF's avatar
StevenRPF
Brass Contributor
Oct 11, 2023

Hyper-V Cluster Failover Event viewer log showing SMB traffic connect to quorum disk network share

Hi,

 

To tweak my SIEM, I need to correlate smb network traffic between Hyper-V servers and witness disk stored on a network share on another server. I'm searching a log who tell me the Hyper-V is connecting to the witness disk (on network shared drive) for doing something ... probably I will be able to correlate and put exception when this happens and the SMB traffic between Hyper-V and the other server to stop always receive this alert.

 

Any cues would be appreciated!

Thanks

clustering
Hyper-V
management
networking
windows server

1 Reply

  • Jamony's avatar
    Jamony
    MCT
    Sep 18, 2026

    SMB traffic between cluster nodes and a File Share Witness is expected because the witness itself is an SMB share.

     

    For troubleshooting, collect the cluster log:

     

    Get-ClusterLog -UseLocalTime -TimeSpan 30

     

    Also inspect:

     

    Microsoft-Windows-FailoverClustering/Operational

     

    You can test SMB connectivity from each cluster node with:

     

    Test-NetConnection <WitnessServer> -Port 445

     

    For SIEM exclusions, I would not exclude all SMB traffic from the Hyper-V hosts. Restrict the exception to the known cluster nodes, the known witness server and TCP 445.