Monitoring and reporting for Veeam Data Platform
brichardson1991_obk
Expert
Posts: 114 Liked: 8 times
Joined: Aug 20, 2015 2:20 pm
Full Name: Ben Richardson
Contact:
Post
by brichardson1991_obk » Sep 24, 2015 2:15 pm
this post
Hi guys,
I'm getting the following alerts from veeam one.
Could someone identify what the actual issue is
I'm unsure if it is vcentre logging into 192.168.250.52 as root or 192.168.250.52 trying to login to vcentre as root.
Object:sprite-vcentre
Object Type:vCenter Server
Location:sprite-vcentre
Host:sprite-vcentre
Status:Warning
Alarm:Bad vCenter Server username logon attempt
Time:24/09/2015 15:02:07
Details:Fired by event: BadUsernameSessionEvent
Event description: Cannot login root@192.168.250.52
Initiated by: root
Object:sprite-esx02.sprite.local
Object Type:Host
Location:sprite-vcentre / Elstead / Servers
Host:sprite-esx02.sprite.local
Status:Warning
Alarm:Bad Host username logon attempt
Time:24/09/2015 15:05:07
Details:Fired by event: BadUsernameSessionEvent
Event description: Cannot login root@192.168.250.52
Initiated by: root
Kind regards
PTide
Product Manager
Posts: 6551 Liked: 765 times
Joined: May 19, 2015 1:46 pm
Contact:
Post
by PTide » Sep 24, 2015 3:04 pm
this post
Hi,
it seems that the attempt to login from 192.168.250.52 to $Object as root failed. What machine is it, *.*.250.52 ?
brichardson1991_obk
Expert
Posts: 114 Liked: 8 times
Joined: Aug 20, 2015 2:20 pm
Full Name: Ben Richardson
Contact:
Post
by brichardson1991_obk » Sep 24, 2015 3:05 pm
this post
192.168.250.52 is our veeam one monitor running windows server 2008 r2
PTide
Product Manager
Posts: 6551 Liked: 765 times
Joined: May 19, 2015 1:46 pm
Contact:
Post
by PTide » Sep 24, 2015 3:47 pm
this post
192.168.250.52 is our veeam one monitor running windows server 2008 r2
Is it a VM? Is it included in any backup jobs?
brichardson1991_obk
Expert
Posts: 114 Liked: 8 times
Joined: Aug 20, 2015 2:20 pm
Full Name: Ben Richardson
Contact:
Post
by brichardson1991_obk » Sep 24, 2015 3:51 pm
this post
Yes VeeamOne is a VM and not included in backups.
PTide
Product Manager
Posts: 6551 Liked: 765 times
Joined: May 19, 2015 1:46 pm
Contact:
Post
by PTide » Sep 24, 2015 5:52 pm
this post
Have you checked Event Log on sprite-vcentre and sprite-esx02.sprite.local? Those errors are not generated by VO, but come from hosts and vCenter.
brichardson1991_obk
Expert
Posts: 114 Liked: 8 times
Joined: Aug 20, 2015 2:20 pm
Full Name: Ben Richardson
Contact:
Post
by brichardson1991_obk » Sep 28, 2015 8:24 am
this post
Vcentre logs show 6 audit failures, one success then a further 6 failures.
The ESX SAN shows no logs for logins at the time of alarms
Vitaliy S.
VP, Product Management
Posts: 27377 Liked: 2800 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:
Post
by Vitaliy S. » Sep 28, 2015 11:48 am
this post
Do you have any Monitor Client with opened processes tab for ESXi host? Root account is only used when you either directly connect to the host or open processes tab. Do you have any alarms in the configuration balloon on the top of the screen?
brichardson1991_obk
Expert
Posts: 114 Liked: 8 times
Joined: Aug 20, 2015 2:20 pm
Full Name: Ben Richardson
Contact:
Post
by brichardson1991_obk » Sep 28, 2015 12:30 pm
this post
No we only have one monitor client open permanently, i open mine when i need to clear other alarms. We just react to email messages.
Vitaliy S.
VP, Product Management
Posts: 27377 Liked: 2800 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:
Post
by Vitaliy S. » Sep 28, 2015 12:57 pm
this post
Try to restart management agents on this ESXi host - sprite-esx02.sprite.local. Also there is an
existing topic that might help in resolving this issue. If nothing helps, then quick WebEx session will be required.
brichardson1991_obk
Expert
Posts: 114 Liked: 8 times
Joined: Aug 20, 2015 2:20 pm
Full Name: Ben Richardson
Contact:
Post
by brichardson1991_obk » Sep 28, 2015 4:10 pm
this post
esx02 is no longer a host. I will see if this error occurs again. And update you.
Vitaliy S.
VP, Product Management
Posts: 27377 Liked: 2800 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:
Post
by Vitaliy S. » Sep 28, 2015 5:25 pm
this post
Maybe that's the issue. Did you remove this host completely from the infrastructure?
brichardson1991_obk
Expert
Posts: 114 Liked: 8 times
Joined: Aug 20, 2015 2:20 pm
Full Name: Ben Richardson
Contact:
Post
by brichardson1991_obk » Sep 29, 2015 1:38 pm
this post
Yes it has been completely removed from our production environment, it will be moved and used in a test environment however
Vitaliy S.
VP, Product Management
Posts: 27377 Liked: 2800 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:
Post
by Vitaliy S. » Sep 29, 2015 1:40 pm
this post
Check out Veeam ONE Reporter collection sessions details. Do you still see this host being collected by Veeam ONE?
brichardson1991_obk
Expert
Posts: 114 Liked: 8 times
Joined: Aug 20, 2015 2:20 pm
Full Name: Ben Richardson
Contact:
Post
by brichardson1991_obk » Sep 30, 2015 10:01 am
this post
Just had this occur guys
Object:sprite-esx03.sprite.local
Object Type:Host
Location:sprite-vcentre / Elstead / Servers
Host:sprite-esx03.sprite.local
Status:Warning
Alarm:Bad Host username logon attempt
Time:30/09/2015 10:56:24
Details:Fired by event: BadUsernameSessionEvent
Event description: Cannot login root@192.168.250.12
Initiated by: root
Vitaliy S.
VP, Product Management
Posts: 27377 Liked: 2800 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:
Post
by Vitaliy S. » Sep 30, 2015 11:28 am
this post
What about the question above? Do see this host in the Reporter data collection session?
Vitaliy S.
VP, Product Management
Posts: 27377 Liked: 2800 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:
Post
by Vitaliy S. » Sep 30, 2015 11:36 am
this post
brichardson1991_obk
Expert
Posts: 114 Liked: 8 times
Joined: Aug 20, 2015 2:20 pm
Full Name: Ben Richardson
Contact:
Post
by brichardson1991_obk » Sep 30, 2015 11:36 am
this post
Under configuration>servers
Sprite-Backup last status failed
Sprite-vcentre last status success
Vitaliy S.
VP, Product Management
Posts: 27377 Liked: 2800 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:
Post
by Vitaliy S. » Sep 30, 2015 11:39 am
this post
So you don't see any collection jobs for that ESXi host in the sessions tab?
brichardson1991_obk
Expert
Posts: 114 Liked: 8 times
Joined: Aug 20, 2015 2:20 pm
Full Name: Ben Richardson
Contact:
Post
by brichardson1991_obk » Sep 30, 2015 11:40 am
this post
No i see the following under sessions:
sprite-vcentre
sprite-backup
data administration
Vitaliy S.
VP, Product Management
Posts: 27377 Liked: 2800 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:
Post
by Vitaliy S. » Sep 30, 2015 11:47 am
this post
Ok, in this case I would suggest letting our support team taking a look at your configuration via quick WebEx session to find out the reason why this host is still being collected by the job (according to the events you have).
brichardson1991_obk
Expert
Posts: 114 Liked: 8 times
Joined: Aug 20, 2015 2:20 pm
Full Name: Ben Richardson
Contact:
Post
by brichardson1991_obk » Sep 30, 2015 11:55 am
this post
Ok shall i raise a ticket for this ?
Vitaliy S.
VP, Product Management
Posts: 27377 Liked: 2800 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:
Post
by Vitaliy S. » Sep 30, 2015 11:57 am
this post
Yes, please and let me know your case ID, so that I could take a look a this as well.
brichardson1991_obk
Expert
Posts: 114 Liked: 8 times
Joined: Aug 20, 2015 2:20 pm
Full Name: Ben Richardson
Contact:
Post
by brichardson1991_obk » Sep 30, 2015 2:07 pm
1 person likes this post
open under 01071460
Users browsing this forum: No registered users and 4 guests