OneView: Integrated Lights-Out detected more than 3 unauthorized login attempts.

[IvH]

Hi!

Recently I've started receiving those messages via OV (version 4.00.07.02-0334467) at nighttime.

Every night since May 1st. 01:00 - 01:30. Mainly the same group of servers (varies a little bit - ab same 25 servers every night.)  No common atributes of servers (G8, G9, BL, DL - different FW- SPPs)

I have 76 servers monitored/manged by OV.

I beleive the problem is related to my OV, because there are no indications of failed logins in ILO Event log..

Anybody able to help?

-Ivar  :^)

[whiteatwork]

Hi Ivar,

Do you have any other mointoring applications installed such as HPE Systems Insight Manager?  I have seen this before and it was SIM doing the unauthorsied logins.

You probably don't see the events in the iLO log as they are overwritten by the OneView polls which happen every 20 minutes.

[IvH]

Hi whiteatwork,

You're right about SIM - I'm still using that.

After clearing ILO Event Log (IEL..) on all involved servers some days ago, it stopped complaining about unauthirized login attempts.  Last night 3 servers complained again, and if I see in the IEL, two of them has 1 unauthorized attempt (from SIM-server), and the other has 2..

If you're right about overwriting, that would explain why I don't see enough entries in the IEL that should trigger the alarm..

On top of that; I've deleted the servers from SIM a few days ago. I have the Onboard Administrator still in the SIM device list, though. Maybe SIM picks the servers IEL from there.

Anyway, I'm about to get to the bottom of this :)

Thanks,

Regards

Ivar