SMB Repo - Login Attempts from ComputerName$

[J1mbo]

9.5 deployed with SMB repo provided by a NAS.

The NAS is showing 13 failed login attempts from [computername]$ each time a backup runs, which looks to occur when processing VIB and VBK files. Initial TMP and and VBM file access uses the configured account directly. The 14th attempt is made using the correct account and therefore succeeds. However, we are unable to implement e.g. fail2ban filtering currently because of the incorrect account being used.

Any help with this would be much appreciated.

[foggy]

Hi James, job debug logs need to be reviewed here, since they contain information about used logins and related failures.

[J1mbo]

OK I've looked at this a little more. Looking at task.[vm-name]-[moid].log near the start of the job I see these:

Code: Select all

[22.05.2017 13:06:12] <20> Info     [backup-server-fqdn] [FC] Checking whether file or folder \\[smb-server]\[reponame] exists.
[22.05.2017 13:06:12] <20> Info     [backup-server-fqdn] [FC] Checking whether file or folder \\[smb-server]\[reponame]\[Job-name] exists.
[22.05.2017 13:06:12] <20> Info     Initializing shared repository client for repository '[reponame]'.
[22.05.2017 13:06:12] <20> Info         Starting target agent ( sharing mode: 'SharedAgent', host: 'on repository'.).
[22.05.2017 13:06:12] <80> Info     Invoker strategy: DefaultStrategy
[22.05.2017 13:06:12] <20> Info     [CProxyRpcInvoker] RpcInvoker HashCode:56200296 was disposed
[22.05.2017 13:06:12] <20> Info     [backup-server-fqdn] Identity for impersonation is not specified.

(bunch of logs about strategy follow)

Identity not specified?? Not till later do we see the credentials being determined:

Code: Select all

[22.05.2017 13:06:13] <20> Info     Creds user name: Datastore-Username
[22.05.2017 13:06:13] <20> Info     Setting share creds to [\\[smb-server]\[reponame]]. CredsId: [4bbb1533-d725-4670-ae90-3741ef70e1ff]
[22.05.2017 13:06:13] <20> Info     Setting share creds to [\\[smb-server]\[reponame]]. Domain: [.], User: [Datastore-Username]
[22.05.2017 13:06:13] <20> Info             [AP] (53f5) command: 'Invoke: System.SetShareCredentials\n{\n  (EString) Path = \\[smb-server]\[reponame]\n}\n'
[22.05.2017 13:06:13] <11> Info                   [AP] (53f5) output: <VCPCommandResult result="true" exception="" />
[22.05.2017 13:06:13] <11> Info                   [AP] (53f5) output: <VCPCommandArgs />
[22.05.2017 13:06:13] <11> Info                   [AP] (53f5) output: >
[22.05.2017 13:06:13] <20> Info             [AP] (53f5) command: 'isFileExists\n\\[smb-server]\[reponame]\[Job-Name]\[Job-Name]D2017-05-22T130603.vib\n'
[22.05.2017 13:06:13] <12> Info                   [AP] (53f5) output: 0
[22.05.2017 13:06:13] <12> Info                   [AP] (53f5) output: >
[22.05.2017 13:06:13] <20> Info     Preparing storage '[Job-Name]D2017-05-22T130603.vib' for write. Is optimized for de-duplication media 'False'.
[22.05.2017 13:06:13] <20> Info             [AP] (53f5) command: 'prepStorageForWriteEx\n\\[smb-server]\[reponame]\[Job-Name]\[Job-Name]D2017-05-22T130603.vib\n1024\n0\n'
[22.05.2017 13:06:29] <11> Info                   [AP] (53f5) output: >
[22.05.2017 13:06:29] <20> Info     [StorageLock] Locking storage(s) for write increment

The account was locked by the storage server at 13:06:29 in this case, as usual after 13 failed attempts.

[foggy]

Please contact our technical team for logs analysis.

[J1mbo]

For the benefit of the search - apparently a known issue in 9.5, fixed in 9.5u2.