Monitoring and reporting for Veeam Data Platform
Post Reply
brichardson1991_obk
Expert
Posts: 114
Liked: 8 times
Joined: Aug 20, 2015 2:20 pm
Full Name: Ben Richardson
Contact:

Login error

Post by brichardson1991_obk »

Hi guys,

I'm getting the following alerts from veeam one.

Could someone identify what the actual issue is

I'm unsure if it is vcentre logging into 192.168.250.52 as root or 192.168.250.52 trying to login to vcentre as root.
Object:sprite-vcentre
Object Type:vCenter Server
Location:sprite-vcentre
Host:sprite-vcentre
Status:Warning
Alarm:Bad vCenter Server username logon attempt
Time:24/09/2015 15:02:07
Details:Fired by event: BadUsernameSessionEvent
Event description: Cannot login root@192.168.250.52
Initiated by: root
Object:sprite-esx02.sprite.local
Object Type:Host
Location:sprite-vcentre / Elstead / Servers
Host:sprite-esx02.sprite.local
Status:Warning
Alarm:Bad Host username logon attempt
Time:24/09/2015 15:05:07
Details:Fired by event: BadUsernameSessionEvent
Event description: Cannot login root@192.168.250.52
Initiated by: root
Kind regards
PTide
Product Manager
Posts: 6408
Liked: 724 times
Joined: May 19, 2015 1:46 pm
Contact:

Re: Login error

Post by PTide »

Hi,

it seems that the attempt to login from 192.168.250.52 to $Object as root failed. What machine is it, *.*.250.52 ?
brichardson1991_obk
Expert
Posts: 114
Liked: 8 times
Joined: Aug 20, 2015 2:20 pm
Full Name: Ben Richardson
Contact:

Re: Login error

Post by brichardson1991_obk »

192.168.250.52 is our veeam one monitor running windows server 2008 r2
PTide
Product Manager
Posts: 6408
Liked: 724 times
Joined: May 19, 2015 1:46 pm
Contact:

Re: Login error

Post by PTide »

192.168.250.52 is our veeam one monitor running windows server 2008 r2
Is it a VM? Is it included in any backup jobs?
brichardson1991_obk
Expert
Posts: 114
Liked: 8 times
Joined: Aug 20, 2015 2:20 pm
Full Name: Ben Richardson
Contact:

Re: Login error

Post by brichardson1991_obk »

Yes VeeamOne is a VM and not included in backups.
PTide
Product Manager
Posts: 6408
Liked: 724 times
Joined: May 19, 2015 1:46 pm
Contact:

Re: Login error

Post by PTide »

Have you checked Event Log on sprite-vcentre and sprite-esx02.sprite.local? Those errors are not generated by VO, but come from hosts and vCenter.
brichardson1991_obk
Expert
Posts: 114
Liked: 8 times
Joined: Aug 20, 2015 2:20 pm
Full Name: Ben Richardson
Contact:

Re: Login error

Post by brichardson1991_obk »

Vcentre logs show 6 audit failures, one success then a further 6 failures.

The ESX SAN shows no logs for logins at the time of alarms
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Login error

Post by Vitaliy S. »

Do you have any Monitor Client with opened processes tab for ESXi host? Root account is only used when you either directly connect to the host or open processes tab. Do you have any alarms in the configuration balloon on the top of the screen?
brichardson1991_obk
Expert
Posts: 114
Liked: 8 times
Joined: Aug 20, 2015 2:20 pm
Full Name: Ben Richardson
Contact:

Re: Login error

Post by brichardson1991_obk »

No we only have one monitor client open permanently, i open mine when i need to clear other alarms. We just react to email messages.
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Login error

Post by Vitaliy S. »

Try to restart management agents on this ESXi host - sprite-esx02.sprite.local. Also there is an existing topic that might help in resolving this issue. If nothing helps, then quick WebEx session will be required.
brichardson1991_obk
Expert
Posts: 114
Liked: 8 times
Joined: Aug 20, 2015 2:20 pm
Full Name: Ben Richardson
Contact:

Re: Login error

Post by brichardson1991_obk »

esx02 is no longer a host. I will see if this error occurs again. And update you.
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Login error

Post by Vitaliy S. »

Maybe that's the issue. Did you remove this host completely from the infrastructure?
brichardson1991_obk
Expert
Posts: 114
Liked: 8 times
Joined: Aug 20, 2015 2:20 pm
Full Name: Ben Richardson
Contact:

Re: Login error

Post by brichardson1991_obk »

Yes it has been completely removed from our production environment, it will be moved and used in a test environment however
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Login error

Post by Vitaliy S. »

Check out Veeam ONE Reporter collection sessions details. Do you still see this host being collected by Veeam ONE?
brichardson1991_obk
Expert
Posts: 114
Liked: 8 times
Joined: Aug 20, 2015 2:20 pm
Full Name: Ben Richardson
Contact:

Re: Login error

Post by brichardson1991_obk »

Just had this occur guys

Object:sprite-esx03.sprite.local
Object Type:Host
Location:sprite-vcentre / Elstead / Servers
Host:sprite-esx03.sprite.local
Status:Warning
Alarm:Bad Host username logon attempt
Time:30/09/2015 10:56:24
Details:Fired by event: BadUsernameSessionEvent
Event description: Cannot login root@192.168.250.12
Initiated by: root
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Login error

Post by Vitaliy S. »

What about the question above? Do see this host in the Reporter data collection session?
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Login error

Post by Vitaliy S. »

brichardson1991_obk
Expert
Posts: 114
Liked: 8 times
Joined: Aug 20, 2015 2:20 pm
Full Name: Ben Richardson
Contact:

Re: Login error

Post by brichardson1991_obk »

Under configuration>servers

Sprite-Backup last status failed
Sprite-vcentre last status success
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Login error

Post by Vitaliy S. »

So you don't see any collection jobs for that ESXi host in the sessions tab?
brichardson1991_obk
Expert
Posts: 114
Liked: 8 times
Joined: Aug 20, 2015 2:20 pm
Full Name: Ben Richardson
Contact:

Re: Login error

Post by brichardson1991_obk »

No i see the following under sessions:

sprite-vcentre
sprite-backup
data administration
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Login error

Post by Vitaliy S. »

Ok, in this case I would suggest letting our support team taking a look at your configuration via quick WebEx session to find out the reason why this host is still being collected by the job (according to the events you have).
brichardson1991_obk
Expert
Posts: 114
Liked: 8 times
Joined: Aug 20, 2015 2:20 pm
Full Name: Ben Richardson
Contact:

Re: Login error

Post by brichardson1991_obk »

Ok shall i raise a ticket for this ?
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Login error

Post by Vitaliy S. »

Yes, please and let me know your case ID, so that I could take a look a this as well.
brichardson1991_obk
Expert
Posts: 114
Liked: 8 times
Joined: Aug 20, 2015 2:20 pm
Full Name: Ben Richardson
Contact:

Re: Login error

Post by brichardson1991_obk » 1 person likes this post

open under 01071460
Post Reply

Who is online

Users browsing this forum: No registered users and 5 guests