Check what remains in a cluster WER report before relying on it

Source facts

Microsoft describes Windows Error Reporting as an event-driven mechanism for collecting information about detected Windows hardware and software problems. For cluster diagnostics, the DumpLogQuery resource property holds multiple XPath queries used to collect logs after the relevant event channels are enabled. Microsoft notes that uploaded reports in the WER archive retain Report.wer while the accompanying report data is deleted. Microsoft documentation.

Applicability

Identify the failing cluster resource, event time, collection configuration, report location, and support case. Review which event channels are needed for the investigation and the permissions required to collect them.

DSE recommendation

Agree on the diagnostic collection with the cluster owner before reproducing a failure. Preserve the report and relevant logs through the organization’s approved evidence process, documenting their origin and timestamps. Check the actual files present instead of assuming an archived report still contains every original artifact.

Verification

Open the retained evidence and confirm that it covers the resource and failure window being investigated. Compare the collection queries with the included event channels and list missing files explicitly. Use supported analysis tools and keep any gap in the report separate from a conclusion about the cluster’s root cause.

Official references

Microsoft Learn: Troubleshooting a Failover Cluster using Windows Error Reporting. Source reviewed September 8, 2026.