Getting 'authentication error' for a device which is not in OME

Question

Hello,

I'm really stuck here. We have more than 15000 "Authentication Failures" for a device which is not listed in the "Devices" section. Therefore I'm unable to remove that device. The alert is shown with the ip address which points to a live device (Equallogic member).

Here is what I did so far:

When I try to "ignore this device only" I get an error saying that there is no device for that alert. When looking in the database table the deviceID is shown as -1

The aim is to have the Equallogic reporting into OME and when I add both the group and the member (which is using that ip address) the device adds ok. But the alerts continue to occur (this time showing the correct DNS name).

I then removed the devices from the discovery range but the alerts continue to come in (again with just the ip address).

So to me it looks like that device got stuck somewhere in OME and is accessed although no device exists. But I'm failing to see where it is coming from. Those alerts are just a pain and I need to find a way to get rid of it.

Please can anybody shed some light into this strange behaviour. We are on OME 1.2.0.3441

Thanks

Thorsten

DELL-Rob C · Accepted Answer

Hi Thorsten,

Well then I may be confused or missing some subtle detail here.

When it comes to SNMP alerts, OME doesn't contact the target, the target device sends an alert to OME. So if OME is getting a rogue alert in the Alert/Event console, it is because the device is pointing at the OME ip address for sending traps.

Did you review the SNMP settings of the target device itself?

Thx

Rob

(sorry if I'm being dense and missing your point)

DELL-Rob C · Answer

Hi Thorsten,

Is this anything like the authentication error that is talked about in FAQ 10.2? Take a look and let me know if you think it might be related. FAQ is on www.delltechcenter.com/ome.

Thanks,

Rob

Thorsten_S · Answer

Hi Rob,

no, that does not apply.

I don't have a device nor a discovery range for that alert. When I try to ignore alerts for that device I get an error saying "unable to associate the device for this alert",

I did check in the database tables and found the device to be listed as -1 in the Alerts table. So that seems to be an orphan but I don't know how to get rid of it.

Thorsten_S · Answer

Hi Rob,

as said, I did discover that device and then the shown ip changed to the DNS name of the Equallogic storage. But the alerts continued to come in !! Even though the storage device is listed ok.

When deleting that device the alerts get removed as well. BUT: they start to come in again for that ip address.

I don't want to suppress that alert. That would be doing the wrong thing here. I want to know why OME tries to get in touch with that device which is not listed. Somewhere in the depth of the database it need to have a reference to it. I did check a couple of tables but were unable to find anything.

Please help me in finding that orphaned device. Thanks

Thorsten

DELL-Rob C · Answer

Ok. You  can do a 'blanket filter' (ignore action) for all devices for this alert, or will need to discover the device (even if just unknown) to select this one specifically. We don’t have an option to filter out (certain) devices we have not discovered.  I can pass this idea along for consideration. Thanks, Rob

Thorsten_S · Answer

Hi Rob,

thanks for pointing me in the right direction. We have three Equallogic devices and I received the errors only for one of them. All three were configured the same.

I finally found the incorrect configuration. When we installed the first EQL we also installed SanHQ to monitor the device. However, a wrong community string was used there and there the EQL did complain about SanHQ trying to access it !

Thanks a lot for your help, Much appreciated

Thorsten

DELL-Rob C · Answer

Hey that's great news....thanks for taking the time to post an update.  Best regards, Rob

Dell OpenManage Essentials

Getting "authentication error" for a device which is not in OME

Was this post helpful?