LsaSrv event 6037 - target name HOST/.

Unleash the power of System Center for vSphere and Hyper-V | Veeam Task Manager for Hyper-V

LsaSrv event 6037 - target name HOST/.

Veeam Logoby jofuc » Thu Jan 19, 2012 4:15 pm

Hello,

we recently implemented nworks MP 5.7 and everything works fine. We only have one issue - after installation of the MP into SCOM 2007 R2 following events started to appear in the system log of all hosts with SCOM agents installed (W2K8R2), not limited only to nworks Collector:

"The program svchost.exe, with the assigned process ID 1234, could not authenticate locally by using the target name HOST/.. The target name used is not valid. A traget name should refer to one of the local computer names, for example, the DNS host name.

Try a different target name.

Source: LsaSrv
EventID: 6037
Level: Warning
..."

The warnings appear regularly about every 4 hours. When uninstalling the nworks MP the events disappear. We checked SPNs and found nothing unusual. How to prevent this?
jofuc
Lurker
 
Posts: 2
Liked: never
Joined: Fri Dec 02, 2011 8:06 am
Full Name: Josef Fucik

Re: LsaSrv event 6037 - target name HOST/.

Veeam Logoby Eag1E » Tue Jan 31, 2012 2:09 pm

I have also seen exactly the same issue in previous versions as well.

I originally logged a call with MS but they traced it to one of the nworks discoveries.

Doesnt seem to have any impact other then flaging this error constantly.
Eag1E
Novice
 
Posts: 5
Liked: never
Joined: Fri Sep 24, 2010 8:19 am
Full Name: Mark Edwards

Re: LsaSrv event 6037 - target name HOST/.

Veeam Logoby Alec King » Thu Feb 09, 2012 6:48 am

Hi Guys,

We have not seen this here.

We do have a new discovery in nworks 5.7 that runs in all SCOM Agents; this is checking whether each Agent is actually running inside a VMware VM (by looking in the registry for VMware BIOS details). If the agent is running in VMware, we create an object 'VMware Virtual Machine' that we use for a further discovery target, to create the relationship between the VM and the Agent running inside.

Are you running those discoveries? Are they successful? (first discovery is enabled by default; second is disabled by default)
For full details see Operations Guide starting page 13 'VM and Ops Mgr Agent integration'

Regarding the error, we have not seen this in QA. Possibly an issue with the Action Account permissions when trying to read the registry?
Alec King
Veeam Software
 
Posts: 700
Liked: 116 times
Joined: Sun Jan 01, 2006 1:01 am

Re: LsaSrv event 6037 - target name HOST/.

Veeam Logoby Eag1E » Mon Feb 13, 2012 9:48 am

Hi Alec

Im running 5.6 and see this error.

It only occurs on Windows 2008 R2 servers.

There are 2 discoveries targetted at all Windows Servers - 'Discover nworks Enterprise Manager Server' and 'Discover nworks Collectors' these run every 4 hours and that coincides with the error seen.

When speaking to MS they seemed to indicate the issue was with using a dot in the discovery <ComputerName>.</ComputerName> rather than <ComputerName>$Target/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

This is reflected in the Lsasrv error seen on the 2008 R2 servers regarding 'HOST/.'

Not sure if that helps ?
Eag1E
Novice
 
Posts: 5
Liked: never
Joined: Fri Sep 24, 2010 8:19 am
Full Name: Mark Edwards

Re: LsaSrv event 6037 - target name HOST/.

Veeam Logoby steveburkett » Mon Feb 13, 2012 11:03 am

We're seeing this on our Windows 2008 R2 VM's being monitored with an evaluation version of nWorks 5.7 MP, we've got both discoveries enabled. Will have a go with ProcMon if I get time to try and figure out if its a Registry perms issue.
steveburkett
Novice
 
Posts: 8
Liked: never
Joined: Fri Dec 23, 2011 12:53 pm
Full Name: Steve Burkett

Re: LsaSrv event 6037 - target name HOST/.

Veeam Logoby Alec King » Mon Feb 13, 2012 9:49 pm

Thanks all,

OK, we will try to repro here. The use of '.' instead of full path to NetworkName$ should be supported by SCOM agent, '.' should resolve to 'local computer'. However possibly new security in Win2008 R2 has some objection - or maybe action account permissons to the registry....is the agent Action Account a FULL administrator of the server?

Thanks,
Alec
Alec King
Veeam Software
 
Posts: 700
Liked: 116 times
Joined: Sun Jan 01, 2006 1:01 am

Re: LsaSrv event 6037 - target name HOST/.

Veeam Logoby jofuc » Tue Feb 14, 2012 1:55 pm

Hi Alec,

the action account run as Local System.
jofuc
Lurker
 
Posts: 2
Liked: never
Joined: Fri Dec 02, 2011 8:06 am
Full Name: Josef Fucik

Re: LsaSrv event 6037 - target name HOST/.

Veeam Logoby steveburkett » Wed Feb 15, 2012 2:05 pm

Local System here as well.
steveburkett
Novice
 
Posts: 8
Liked: never
Joined: Fri Dec 23, 2011 12:53 pm
Full Name: Steve Burkett

Re: LsaSrv event 6037 - target name HOST/.

Veeam Logoby Eag1E » Thu Mar 29, 2012 8:51 am

Hi Alec, any luck reproducing the issue ?
Eag1E
Novice
 
Posts: 5
Liked: never
Joined: Fri Sep 24, 2010 8:19 am
Full Name: Mark Edwards

Re: LsaSrv event 6037 - target name HOST/.

Veeam Logoby Alec King » Thu Mar 29, 2012 9:05 am

Hi Mark, and all,

we can (occasionally) reproduce this issue, yes. After deeper analysis, and input from Microsoft, we've established that this error is informational only - there is no actual failure (our discovery still works fine). This error is just from some interaction of SCOM agent processes with the windows subsystem.

So, we will look to address this in a future update (we can modify our discovery so the error is not generated) - however this error does not indicate any problem in the current MP, and can be safely ignored.

Cheers
Alec
Alec King
Veeam Software
 
Posts: 700
Liked: 116 times
Joined: Sun Jan 01, 2006 1:01 am


Return to Veeam Management Pack for Microsoft System Center



Who is online

Users browsing this forum: No registered users and 2 guests