Fix Cluster Log Corrupt 0x000013A5 Fast

Seeing ERROR_CLUSTERLOG_CORRUPT (0X000013A5) on your Windows Server Failover Cluster? It's annoying, I know. The cluster service won't start, and you're probably in the middle of something important. Let's fix it directly.

The Quick Fix: Reset the Cluster Log

What's actually happening here is the cluster log file at %SystemRoot%\Cluster\cluster.log got corrupted. The cluster service reads this file on startup, and if it can't parse it, it bails with this error. The most reliable fix is to delete or rename the log file, then let the cluster rebuild it.

Open PowerShell as Administrator. Not as a regular user — the cluster service runs as SYSTEM, so you need admin rights.
Stop the cluster service:
```
Stop-Service -Name ClusSvc
```
Rename the corrupt log file (don't delete it yet — you might need it for debugging later):
```
Rename-Item -Path "$env:SystemRoot\Cluster\cluster.log" -NewName "cluster.log.bak"
```

Optionally, also clear the quarantine folder. This is less common but worth doing:

Remove-Item -Path "$env:SystemRoot\Cluster\Quarantine\*" -Recurse -Force -ErrorAction SilentlyContinue

Start the cluster service back up:
```
Start-Service -Name ClusSvc
```
Check if the cluster comes online:
```
Get-ClusterNode -Verbose
```

If the cluster starts, you're good. The service creates a fresh cluster.log automatically. If it doesn't, move to the next section.

Why This Works

The cluster log is a plain text file, but it's written in a specific binary format with a checksum at the end. The reason step 3 works is that the cluster service checks the log's integrity when it starts. A corrupt checksum or a garbled line makes the service think the whole cluster database is toast. By renaming the file, you remove the trigger for that check. The service then creates a new empty log file and starts normally.

This isn't a bug — it's by design. The cluster service is paranoid about data integrity. If the log looks bad, it assumes the worst. Renaming the log is like clearing the error state without losing the actual cluster database (which is in the registry or a separate file).

Less Common Variations of This Issue

Sometimes the log file isn't the only thing corrupt. Here are other possibilities:

1. Corrupt Cluster Database (CLUSTER$)

If renaming the log doesn't work, the cluster database itself might be corrupt. This lives in the registry under HKLM\Cluster\Cluster. To check it:

Get-ClusterResource | Format-List -Property *

If you see errors here, you'll need to restore from backup or force a cluster rebuild. A quick test: try running Start-ClusterNode -ForceQuorum. This bypasses the normal quorum check and might get you online long enough to evacuate roles.

2. Antivirus Locking the Log File

I've seen this on Server 2016 with McAfee. The antivirus holds a handle on cluster.log, and when the cluster service tries to write to it, it fails silently. The next time the service starts, the log is inconsistent. Check your antivirus exclusions — add %SystemRoot%\Cluster\*.log to the exclusion list.

3. Disk Space Full on the System Drive

Cluster logs can grow large if verbose logging is enabled. If the drive is full, the cluster service can't write the log cleanly. Check space with:

Get-PSDrive -PSProvider FileSystem | Where-Object {$_.Used -gt 0}

If the system drive has less than 100MB free, that's your culprit.

Prevention

To stop this from happening again:

Set a log size limit. By default, the cluster log can grow indefinitely. Use this command to cap it at 50MB:
```
Set-ClusterLog -Size 50
```
Add cluster folder to antivirus exclusions. Seriously. Do it now.
Monitor system drive space. Set an alert for less than 500MB free.
Schedule weekly cluster validation. Run Test-Cluster in a scheduled task. Catches issues early.

That's it. Your cluster should be back up. If not, you're dealing with a deeper hardware or storage problem — check the system event log for disk errors.