BadUsernameSessionEvent

[connelp]

I have two ESXi hosts and for the past week VEEAM One has generated (on a daily basis) the following error message on just one host:

Cannot login @IP address of VEEAM B+R Server

There don't seem to be any problems with my backups or ESXi hosts so it's quite strange. This problem seems to have started happening since I put the host into maintenance mode and rebooted it.

Has anyone come across this, or is it worth raising a case with support?

[Vitaliy S.]

Hello,

Can you please check the corresponding error events on the vCenter Server itself? Have you recently changed any credentials on the backup server machine?

Thank you!

[connelp]

Hi Vitaliy

No credentials have recently been changed on the backup server.

Unfortunately I have a 'chatty' Eaton UPS VM and it has filled my event log so my limit of 1000 does not go back to the time when the last badusernamesessionevent occurred.

As I said though, everything appears to be working as it should.

[Vitaliy S.]

You can search for specific event via search tab in Veeam ONE Monitor Client or the vCenter Server. What I'm trying to say here is that this alarm is triggered by the event, so you definitely should have it in the event log. If you don't see this event, then I would recommend opening a support case for further investigation.

[connelp]

I can see the error in the Veeam ONE Monitor Client but not through mySphere Client as my event log on there doesn't go back that far (limited to 1000).

All it says is what I have put in my first post. There is nothing immediately (within 10 seconds) before it (if I pick one of these occurrences at random).

[Vitaliy S.]

Hmm...in this case can you please navigate to Events & Tasks tab and select the time period via Monitor Client when this alarm was triggered, you can do it using "Events from" filter. This will allow you to review all events generated by the vCenter Server.

[connelp]

I have done that, but it isn't any clearer unfortunately.

Three of these events occurred at yesterday around 0300

Before the first event the Monitor reports a snapshot removal task had completed.

Before the second event the Monitor reports I/O latency has increased on a datastore.

Before the third event the Monitor reports successful completion of a backup job.

[Vitaliy S.]

So all events have been triggered during backup job run...I wonder if it has something to do with the number of simultaneous connection to the vCenter Server. BTW, was this a vCenter Server backup job by any chance?

[connelp]

Yes, the events occur while backup jobs are running.

They aren't always the same backup job though.

[Vitaliy S.]

Do you see the account name that cannot login to the host? Can you please right-click on that ESXi host in the backup console and check if you have any credentials specified there? Just want to check that everything is empty there, since you're using vCenter Server connection, right?

[connelp]

It does not mention the account name that cannot login to the host. The only message is the one I put in my first post.

If I open B+R, go into Backup Infrastructure and navigate through the tree until I reach my two hosts I can right-click on the host that is generating the error message, select properties and it rescans it and says it was successfully modified.

This is the first time I've done this. Last time I rescanned the cluster.

[Vitaliy S.]

Ok, given all this I'm stuck on finding more ideas about possible reason for this event on the vCenter Server. Try to monitor your backup jobs and see if there is any dependency on the backup mode/VM/datastore that is used in the job, might shed some light.

[connelp]

OK. I'll see if any errors are generated tonight.

[foggy]

Might be a bad shot, but do you probably have any post-job activity task that needs to authorize on vCenter server?

[connelp]

Might be a bad shot, but do you probably have any post-job activity task that needs to authorize on vCenter server?

Not that would have altered since last week.

As I said, these errors are all happening on just one of my two hosts, and have only started happening since the host reboot.

I haven't tried rebooting the server with VEEAM One on. Perhaps that's worth a try?

[Vitaliy S.]

Try to restart ESXi management agents. Restarting Veeam ONE server will not do any difference since the original event is generated on the ESXi host.

[connelp]

Ok. I'll see if any errors are generated tonight (as I've rescanned the host) and try restarting the management agents tomorrow if there are.

[connelp]

The errors happened again last night. I will try restarting the management agents.

Unfortunately my ESXi host log is full of logon\logoff events from a VM I have that controls my Eaton UPS. I will investigate removing these entries from the logs today so I can examine further if the management agent reboot doesn't fix it tomorrow morning.

[Vitaliy S.]

Thanks for the update, let's see how management agents restart can help.

[connelp]

I restarted the management agents and, unfortunately, the problem has not been resolved. There were 9 events recorded last night.

However, I think the problem might like with B+R rather than Veeam ONE as, when I check my VSphere logs, I can see 9 entries of cannot login @IP address of B+R server occurring during my backup window.

Shall I raise a call with support?

[veremin]

The thorough log investigation seems to be required, as we have run out of the ideas. So, please, open a ticket with our support team. Once opened, please provide the ticked number here, so that, we can track the case. Thanks.

[connelp]

Thank you all for your help so far.

A case has been opened. Reference 00559387

[Vitaliy S.]

One more thing to try is to re-enter all credentials, not sure it can help though....