UNSOLVED
dn_alm 798 - - Node.1-Unit.1:PRI
Guys,
I have a Dell S4148F-ON switch and it is generating several logs of dn_alm 798 - - Node.1-Unit.1:PRI and I can't solve it, could you help me?
<165>1 2023-11-24T14:05:07.325023-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.100.101.1
<165>1 2023-11-24T14:05:08.574728-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_tally2(sshd:auth): pam_get_uid; no such user
<165>1 2023-11-24T14:05:08.576121-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_unix(sshd:auth): check pass; user unknown
<165>1 2023-11-24T14:05:08.576425-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.100.101.1
<165>1 2023-11-24T14:05:11.324450-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_tally2(sshd:auth): user admin (1003) tally 323, deny 3
<165>1 2023-11-24T14:05:12.573829-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_tally2(sshd:auth): user admin (1003) tally 324, deny 3
<165>1 2023-11-24T14:05:14.824269-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.100.101.1 user=admin
<165>1 2023-11-24T14:05:16.323861-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.100.101.1 user=admin
<165>1 2023-11-24T14:05:19.823692-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.100.101.1 user=root
<165>1 2023-11-24T14:05:23.823860-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_tally2(sshd:auth): user admin (1003) tally 325, deny 3
<165>1 2023-11-24T14:05:24.261221-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.100.101.1 user=root
<165>1 2023-11-24T14:05:26.573776-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.100.101.1 user=admin
<165>1 2023-11-24T14:05:28.323552-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_tally2(sshd:auth): user admin (1003) tally 326, deny 3
<165>1 2023-11-24T14:05:31.055659-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_tally2(sshd:auth): user admin (1003) tally 327, deny 3
<165>1 2023-11-24T14:05:31.056428-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.100.101.1 user=admin
<165>1 2023-11-24T14:05:34.074124-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.100.101.1 user=admin
<165>1 2023-11-24T14:05:35.573598-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_tally2(sshd:auth): user admin (1003) tally 328, deny 3
<165>1 2023-11-24T14:05:38.303530-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_tally2(sshd:auth): pam_get_uid; no such user
<165>1 2023-11-24T14:05:38.304308-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_unix(sshd:auth): check pass; user unknown
<165>1 2023-11-24T14:05:38.304615-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.100.101.1
<165>1 2023-11-24T14:05:38.574843-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.100.101.1 user=admin
<165>1 2023-11-24T14:05:41.323632-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.100.101.1 user=root
<165>1 2023-11-24T14:05:42.823805-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_tally2(sshd:auth): pam_get_uid; no such user
<165>1 2023-11-24T14:05:42.824582-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_unix(sshd:auth): check pass; user unknown
<165>1 2023-11-24T14:05:42.824743-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.100.101.1
<165>1 2023-11-24T14:05:45.075449-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_tally2(sshd:auth): pam_get_uid; no such user
<165>1 2023-11-24T14:05:45.076789-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_unix(sshd:auth): check pass; user unknown
<165>1 2023-11-24T14:05:45.077056-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.100.101.1
<165>1 2023-11-24T14:05:45.401707-03:00 g-br-sp-spo-ctp-esoc-swa-03L dn_alm 798 - - Node.1-Unit.1:PRI [event], Dell EMC (OS10) %ALM_AUTH_EVENT: Authentication event was raised MESSAGE=pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.100.101.1 user=root
DELL-Chris H
7 Practitioner
•
9682 Posts
•
48046 Points
0
0
Posted February 8th, 2024 17:38
Nillbryan,
Based on the logs you shared it would appear someone is trying to hack into the switch. So I would consider configuring the switch with ACL and access-class in order to protect the switch.
Let me know if this helps.;
DELL-Chris H
Social Media and Communities Professional
Dell Technologies | Enterprise Support Services
#IWork4Dell
Did I answer your query? Please click on ‘Mark as Accepted Answer’. ‘Thumbs up’ the posts you like!BobbyPetrov
1 Rookie
•
2 Posts
•
2 Points
0
0
Posted May 14th, 2024 08:51
More likely this is a PowerScale/Isilon backend switch and the default password has been changed, so the PowerScale cannnot now talk to it correctly.
BobbyPetrov
1 Rookie
•
2 Posts
•
2 Points
0
0
Posted May 14th, 2024 10:26
If you are using custom credentials you can follow the below article to update the BackEnd switch password on the PowerScale/Isilon switch:
https://www.dell.com/support/kbdoc/en-uk/000223506Command, in case you don't have Dell account:
isi_config_be_credYou will be asked to enter the new username (admin) and the custom password. Make sure that all backend switches have the same password.
Good luck!
nillbryan
1 Rookie
•
2 Posts
0
0
Posted February 8th, 2024 13:09
OS Version: 10.5.3.0
Build Version: 10.5.3.0.44
Build Time: 2021-10-06T23:03:55+0000
System Type: S4148F-ON
Architecture: x86_64