Cluster log won't write: 0x000013A7 error fix

You'll see error 0x000013A7 when a cluster node can't write to its cluster log because the file has hit the configured max size. This shows up most often after a network partition event or a disk witness failure that keeps the cluster logging non-stop for hours. The node might report the error in the system event log under source Failover Clustering, or the cluster console will show the node as down with this error in the details.

The root cause is simple: the cluster log file (located at %WINDIR%\Cluster\ClusSvc.log) is a fixed-size rotating log. By default, it's 256 MB on most Windows Server 2016 and 2019 installations. When the log fills up and the cluster service can't rotate old entries fast enough — or if rotation fails due to a permissions glitch or disk space issue — everything stops. The cluster service itself might hang or crash, taking the node offline.

The real fix has two options: clear the log or increase the max size. I'll walk you through both, starting with the faster one.

Before you start

You'll need at least local administrator rights on the affected node. If this is a production cluster, schedule a maintenance window — some steps require stopping the cluster service, and that will move all roles off the node temporarily.

Fix 1: Clear the cluster log (quickest)

1. Open PowerShell as Administrator on the affected node.
2. Run Get-ClusterLog -Destination C:\Temp\ — this captures the current log to a file before you trash it. Good for post-mortem analysis. If the error prevents even this, skip to the next step.
3. Stop the cluster service with Stop-Service -Name ClusSvc -Force. Wait a few seconds, then check with Get-Service -Name ClusSvc — the status should say Stopped.
4. Delete the log file manually: Remove-Item "$env:SystemRoot\Cluster\ClusSvc.log" -Force. Confirm it's gone with Test-Path "$env:SystemRoot\Cluster\ClusSvc.log" — should return False.
5. Start the cluster service: Start-Service -Name ClusSvc. After a few seconds, run Get-Service -Name ClusSvc — status should be Running.
6. Check the cluster: Get-ClusterNode. The affected node should show Up.

After step 6, the log will be re-created automatically with a fresh, empty file. If you still see the error, move to Fix 2.

Fix 2: Increase the max log size (prevents recurrence)

If the log filled up because you have persistent cluster issues (bad network, failing storage), clearing it won't help long-term. You need a bigger log.

1. Open Registry Editor (regedit) as Administrator.
2. Navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ClusSvc\Parameters.
3. Look for a DWORD (32-bit) value named ClusterLogSize. If it doesn't exist, right-click the right pane, select New > DWORD (32-bit) Value, name it ClusterLogSize.
4. Set the value to the size in megabytes, but use the formula: size_in_megabytes * 1024 * 1024 — but Windows expects bytes as a decimal. For a 512 MB log, set it to 536870912. For 1 GB, set it to 1073741824. I'd recommend 1024 MB (1 GB) for busy clusters.
5. Click OK and close regedit.
6. Stop the cluster service: Stop-Service -Name ClusSvc -Force
7. Delete the old log file: Remove-Item "$env:SystemRoot\Cluster\ClusSvc.log" -Force
8. Start the cluster service: Start-Service -Name ClusSvc
9. Verify the node is up with Get-ClusterNode.

What to check if it still fails

If the error persists after both fixes, here's what's likely wrong:

• Disk space: The %WINDIR%\Cluster drive might have less than 100 MB free. The cluster service needs room to write the log and a temporary working file. Free up space or move the cluster log location (advanced, not covered here).
• Permissions: The %WINDIR%\Cluster folder must have write permissions for the SYSTEM account. Right-click the folder, go to Security, and verify SYSTEM has Full Control. If not, add it.
• Antivirus locking the log: Some antivirus software holds file handles open on cluster logs. Exclude %WINDIR%\Cluster\ClusSvc.log and the entire %WINDIR%\Cluster folder from real-time scanning.
• Existing corruption: If the log file is bigger than 2 GB, it's probably corrupted from a previous crash. Delete it manually as in Fix 1, even if the service is running — but you must stop the service first.

One last tip: if you're running Windows Server 2022, there's a known bug where the log size registry key is ignored if you set it via PowerShell. Always use regedit directly for that OS version. I've seen people chase this for hours thinking the change took effect when it didn't.