Login error

Monitoring and reporting for Veeam Backup & Replication, VMware vSphere and Microsoft Hyper-V

Login error

Veeam Logoby brichardson1991_obk » Thu Sep 24, 2015 2:15 pm

Hi guys,

I'm getting the following alerts from veeam one.

Could someone identify what the actual issue is

I'm unsure if it is vcentre logging into 192.168.250.52 as root or 192.168.250.52 trying to login to vcentre as root.

Object:sprite-vcentre
Object Type:vCenter Server
Location:sprite-vcentre
Host:sprite-vcentre
Status:Warning
Alarm:Bad vCenter Server username logon attempt
Time:24/09/2015 15:02:07
Details:Fired by event: BadUsernameSessionEvent
Event description: Cannot login root@192.168.250.52
Initiated by: root


Object:sprite-esx02.sprite.local
Object Type:Host
Location:sprite-vcentre / Elstead / Servers
Host:sprite-esx02.sprite.local
Status:Warning
Alarm:Bad Host username logon attempt
Time:24/09/2015 15:05:07
Details:Fired by event: BadUsernameSessionEvent
Event description: Cannot login root@192.168.250.52
Initiated by: root


Kind regards
brichardson1991_obk
Expert
 
Posts: 112
Liked: 8 times
Joined: Thu Aug 20, 2015 2:20 pm
Full Name: Ben Richardson

Re: Login error

Veeam Logoby PTide » Thu Sep 24, 2015 3:04 pm

Hi,

it seems that the attempt to login from 192.168.250.52 to $Object as root failed. What machine is it, *.*.250.52 ?
PTide
Veeam Software
 
Posts: 3017
Liked: 245 times
Joined: Tue May 19, 2015 1:46 pm

Re: Login error

Veeam Logoby brichardson1991_obk » Thu Sep 24, 2015 3:05 pm

192.168.250.52 is our veeam one monitor running windows server 2008 r2
brichardson1991_obk
Expert
 
Posts: 112
Liked: 8 times
Joined: Thu Aug 20, 2015 2:20 pm
Full Name: Ben Richardson

Re: Login error

Veeam Logoby PTide » Thu Sep 24, 2015 3:47 pm

192.168.250.52 is our veeam one monitor running windows server 2008 r2
Is it a VM? Is it included in any backup jobs?
PTide
Veeam Software
 
Posts: 3017
Liked: 245 times
Joined: Tue May 19, 2015 1:46 pm

Re: Login error

Veeam Logoby brichardson1991_obk » Thu Sep 24, 2015 3:51 pm

Yes VeeamOne is a VM and not included in backups.
brichardson1991_obk
Expert
 
Posts: 112
Liked: 8 times
Joined: Thu Aug 20, 2015 2:20 pm
Full Name: Ben Richardson

Re: Login error

Veeam Logoby PTide » Thu Sep 24, 2015 5:52 pm

Have you checked Event Log on sprite-vcentre and sprite-esx02.sprite.local? Those errors are not generated by VO, but come from hosts and vCenter.
PTide
Veeam Software
 
Posts: 3017
Liked: 245 times
Joined: Tue May 19, 2015 1:46 pm

Re: Login error

Veeam Logoby brichardson1991_obk » Mon Sep 28, 2015 8:24 am

Vcentre logs show 6 audit failures, one success then a further 6 failures.

The ESX SAN shows no logs for logins at the time of alarms
brichardson1991_obk
Expert
 
Posts: 112
Liked: 8 times
Joined: Thu Aug 20, 2015 2:20 pm
Full Name: Ben Richardson

Re: Login error

Veeam Logoby Vitaliy S. » Mon Sep 28, 2015 11:48 am

Do you have any Monitor Client with opened processes tab for ESXi host? Root account is only used when you either directly connect to the host or open processes tab. Do you have any alarms in the configuration balloon on the top of the screen?
Vitaliy S.
Veeam Software
 
Posts: 19539
Liked: 1097 times
Joined: Mon Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov

Re: Login error

Veeam Logoby brichardson1991_obk » Mon Sep 28, 2015 12:30 pm

No we only have one monitor client open permanently, i open mine when i need to clear other alarms. We just react to email messages.
brichardson1991_obk
Expert
 
Posts: 112
Liked: 8 times
Joined: Thu Aug 20, 2015 2:20 pm
Full Name: Ben Richardson

Re: Login error

Veeam Logoby Vitaliy S. » Mon Sep 28, 2015 12:57 pm

Try to restart management agents on this ESXi host - sprite-esx02.sprite.local. Also there is an existing topic that might help in resolving this issue. If nothing helps, then quick WebEx session will be required.
Vitaliy S.
Veeam Software
 
Posts: 19539
Liked: 1097 times
Joined: Mon Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov

Re: Login error

Veeam Logoby brichardson1991_obk » Mon Sep 28, 2015 4:10 pm

esx02 is no longer a host. I will see if this error occurs again. And update you.
brichardson1991_obk
Expert
 
Posts: 112
Liked: 8 times
Joined: Thu Aug 20, 2015 2:20 pm
Full Name: Ben Richardson

Re: Login error

Veeam Logoby Vitaliy S. » Mon Sep 28, 2015 5:25 pm

Maybe that's the issue. Did you remove this host completely from the infrastructure?
Vitaliy S.
Veeam Software
 
Posts: 19539
Liked: 1097 times
Joined: Mon Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov

Re: Login error

Veeam Logoby brichardson1991_obk » Tue Sep 29, 2015 1:38 pm

Yes it has been completely removed from our production environment, it will be moved and used in a test environment however
brichardson1991_obk
Expert
 
Posts: 112
Liked: 8 times
Joined: Thu Aug 20, 2015 2:20 pm
Full Name: Ben Richardson

Re: Login error

Veeam Logoby Vitaliy S. » Tue Sep 29, 2015 1:40 pm

Check out Veeam ONE Reporter collection sessions details. Do you still see this host being collected by Veeam ONE?
Vitaliy S.
Veeam Software
 
Posts: 19539
Liked: 1097 times
Joined: Mon Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov

Re: Login error

Veeam Logoby brichardson1991_obk » Wed Sep 30, 2015 10:01 am

Just had this occur guys


Object:sprite-esx03.sprite.local
Object Type:Host
Location:sprite-vcentre / Elstead / Servers
Host:sprite-esx03.sprite.local
Status:Warning
Alarm:Bad Host username logon attempt
Time:30/09/2015 10:56:24
Details:Fired by event: BadUsernameSessionEvent
Event description: Cannot login root@192.168.250.12
Initiated by: root
brichardson1991_obk
Expert
 
Posts: 112
Liked: 8 times
Joined: Thu Aug 20, 2015 2:20 pm
Full Name: Ben Richardson

Next

Return to Veeam ONE



Who is online

Users browsing this forum: No registered users and 5 guests