{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-123-check-what-remains-in-a-cluster-wer-report-before-relying-on-it/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260908-123-check-what-remains-in-a-cluster-wer-report-before-relying-on-it/",
        "slug": "dse-20260908-123-check-what-remains-in-a-cluster-wer-report-before-relying-on-it",
        "url": "https://update.dsesecurity.com/updates/dse-20260908-123-check-what-remains-in-a-cluster-wer-report-before-relying-on-it/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260908-123-check-what-remains-in-a-cluster-wer-report-before-relying-on-it.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-123-check-what-remains-in-a-cluster-wer-report-before-relying-on-it/"
        },
        "title": "Check what remains in a cluster WER report before relying on it",
        "summary": "Which cluster diagnostic artifacts should be preserved before a WER report is archived?",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-08T18:15:08+00:00",
        "modified_at": "2026-09-08T18:23:27+00:00",
        "reviewed_on": "2026-09-08",
        "reading_minutes": 1,
        "word_count": 211,
        "potentially_affected": "Administrators collecting failover-cluster evidence through Windows Error Reporting.",
        "dse_recommendation": "Agree on the diagnostic collection with the cluster owner before reproducing a failure.",
        "primary_source": {
            "name": "Troubleshooting a Failover Cluster using Windows Error Reporting",
            "url": "https://learn.microsoft.com/en-us/windows-server/failover-clustering/troubleshooting-using-WER-reports",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Microsoft describes Windows Error Reporting as an event-driven mechanism for collecting information about detected Windows hardware and software problems. For cluster diagnostics, the DumpLogQuery resource property holds multiple XPath queries used to collect logs after the relevant event channels are enabled. Microsoft notes that uploaded reports in the WER archive retain Report.wer while the accompanying report data is deleted. <a href=\"https://learn.microsoft.com/en-us/windows-server/failover-clustering/troubleshooting-using-WER-reports\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft documentation</a>.</p>\n<h2>Applicability</h2>\n<p>Identify the failing cluster resource, event time, collection configuration, report location, and support case. Review which event channels are needed for the investigation and the permissions required to collect them.</p>\n<h2>DSE recommendation</h2>\n<p>Agree on the diagnostic collection with the cluster owner before reproducing a failure. Preserve the report and relevant logs through the organization’s approved evidence process, documenting their origin and timestamps. Check the actual files present instead of assuming an archived report still contains every original artifact.</p>\n<h2>Verification</h2>\n<p>Open the retained evidence and confirm that it covers the resource and failure window being investigated. Compare the collection queries with the included event channels and list missing files explicitly. Use supported analysis tools and keep any gap in the report separate from a conclusion about the cluster’s root cause.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/windows-server/failover-clustering/troubleshooting-using-WER-reports\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Troubleshooting a Failover Cluster using Windows Error Reporting</a>. Source reviewed September 8, 2026.</p>",
        "content_text": "Source facts\nMicrosoft describes Windows Error Reporting as an event-driven mechanism for collecting information about detected Windows hardware and software problems. For cluster diagnostics, the DumpLogQuery resource property holds multiple XPath queries used to collect logs after the relevant event channels are enabled. Microsoft notes that uploaded reports in the WER archive retain Report.wer while the accompanying report data is deleted. Microsoft documentation.\nApplicability\nIdentify the failing cluster resource, event time, collection configuration, report location, and support case. Review which event channels are needed for the investigation and the permissions required to collect them.\nDSE recommendation\nAgree on the diagnostic collection with the cluster owner before reproducing a failure. Preserve the report and relevant logs through the organization’s approved evidence process, documenting their origin and timestamps. Check the actual files present instead of assuming an archived report still contains every original artifact.\nVerification\nOpen the retained evidence and confirm that it covers the resource and failure window being investigated. Compare the collection queries with the included event channels and list missing files explicitly. Use supported analysis tools and keep any gap in the report separate from a conclusion about the cluster’s root cause.\nOfficial references\nMicrosoft Learn: Troubleshooting a Failover Cluster using Windows Error Reporting. Source reviewed September 8, 2026.",
        "content_markdown": "## Source facts\n\nMicrosoft describes Windows Error Reporting as an event-driven mechanism for collecting information about detected Windows hardware and software problems. For cluster diagnostics, the DumpLogQuery resource property holds multiple XPath queries used to collect logs after the relevant event channels are enabled. Microsoft notes that uploaded reports in the WER archive retain Report.wer while the accompanying report data is deleted. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/failover-clustering/troubleshooting-using-WER-reports).\n\n## Applicability\n\nIdentify the failing cluster resource, event time, collection configuration, report location, and support case. Review which event channels are needed for the investigation and the permissions required to collect them.\n\n## DSE recommendation\n\nAgree on the diagnostic collection with the cluster owner before reproducing a failure. Preserve the report and relevant logs through the organization’s approved evidence process, documenting their origin and timestamps. Check the actual files present instead of assuming an archived report still contains every original artifact.\n\n## Verification\n\nOpen the retained evidence and confirm that it covers the resource and failure window being investigated. Compare the collection queries with the included event channels and list missing files explicitly. Use supported analysis tools and keep any gap in the report separate from a conclusion about the cluster’s root cause.\n\n## Official references\n\n[Microsoft Learn: Troubleshooting a Failover Cluster using Windows Error Reporting](https://learn.microsoft.com/en-us/windows-server/failover-clustering/troubleshooting-using-WER-reports). Source reviewed September 8, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260908-123-check-what-remains-in-a-cluster-wer-report-before-relying-on-it/",
                "url": "https://update.dsesecurity.com/updates/dse-20260908-123-check-what-remains-in-a-cluster-wer-report-before-relying-on-it/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-08"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260908-123-check-what-remains-in-a-cluster-wer-report-before-relying-on-it/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Check what remains in a cluster WER report before relying on it",
                        "item": "https://update.dsesecurity.com/updates/dse-20260908-123-check-what-remains-in-a-cluster-wer-report-before-relying-on-it/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260908-123-check-what-remains-in-a-cluster-wer-report-before-relying-on-it/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260908-123-check-what-remains-in-a-cluster-wer-report-before-relying-on-it/",
                "url": "https://update.dsesecurity.com/updates/dse-20260908-123-check-what-remains-in-a-cluster-wer-report-before-relying-on-it/",
                "headline": "Check what remains in a cluster WER report before relying on it",
                "description": "Which cluster diagnostic artifacts should be preserved before a WER report is archived?",
                "abstract": "Which cluster diagnostic artifacts should be preserved before a WER report is archived?",
                "articleBody": "Source facts\nMicrosoft describes Windows Error Reporting as an event-driven mechanism for collecting information about detected Windows hardware and software problems. For cluster diagnostics, the DumpLogQuery resource property holds multiple XPath queries used to collect logs after the relevant event channels are enabled. Microsoft notes that uploaded reports in the WER archive retain Report.wer while the accompanying report data is deleted. Microsoft documentation.\nApplicability\nIdentify the failing cluster resource, event time, collection configuration, report location, and support case. Review which event channels are needed for the investigation and the permissions required to collect them.\nDSE recommendation\nAgree on the diagnostic collection with the cluster owner before reproducing a failure. Preserve the report and relevant logs through the organization’s approved evidence process, documenting their origin and timestamps. Check the actual files present instead of assuming an archived report still contains every original artifact.\nVerification\nOpen the retained evidence and confirm that it covers the resource and failure window being investigated. Compare the collection queries with the included event channels and list missing files explicitly. Use supported analysis tools and keep any gap in the report separate from a conclusion about the cluster’s root cause.\nOfficial references\nMicrosoft Learn: Troubleshooting a Failover Cluster using Windows Error Reporting. Source reviewed September 8, 2026.",
                "datePublished": "2026-09-08T18:15:08+00:00",
                "dateModified": "2026-09-08T18:23:27+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260908-123-check-what-remains-in-a-cluster-wer-report-before-relying-on-it/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260908-123-check-what-remains-in-a-cluster-wer-report-before-relying-on-it/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Check what remains in a cluster WER report before relying on it"
                },
                "articleSection": [
                    "IT",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "IT",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 211,
                "timeRequired": "PT1M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Troubleshooting a Failover Cluster using Windows Error Reporting",
                    "url": "https://learn.microsoft.com/en-us/windows-server/failover-clustering/troubleshooting-using-WER-reports"
                }
            }
        ]
    }
}