Hi,
Please check the failover cluster events which you can find in the system event log and more detail in the failover cluster logs. You may find that there are temporary network or server conditions that have caused the failover.
A common scenario is failover due to a snapshot of a virtual mailbox server that is required by some backup applications e.g. Veeam or vRanger. Other scenarios may include memory issues, servers becoming unresponsive or transient network issues.
If the cause cannot be resolved but is transient (up to 30s or so), you can increase the time required before failover occurs by configuring the cluster delay and threshold. The threshold is the number of heartbeats that need to be lost before failover and
the delay is the time between heartbeats. There are delay and threshold settings for cross subnet clusters and same subnet clusters.
Commands are below:
cluster /cluster:<ClusterName> /prop SameSubnetDelay=<value>
cluster /cluster:<ClusterName> /prop SameSubnetThreshold=<value>
cluster /cluster:<ClusterName> /prop CrossSubnetDelay=<value>
cluster /cluster:<ClusterName> /prop CrossSubnetThreshold=<value>
Maximums (milliseconds) for Server 2008/2008 R2:
Same subnet:
cluster /prop SameSubnetDelay=2000:DWORD
cluster /prop SameSubnetThreshold=10:DWORD
Cross subnet:
cluster /prop CrossSubnetDelay=4000:DWORD
cluster /prop CrossSubnetThreshold=10:DWORD
Server 2012 has higher thresholds that can be set.
Let me know if this answers your question.
Thanks.