HP SIM 5.3

[ezh]

first of all - sorry for my bad English :(
I'v got a strange error trying to set "Subscribe to WBEM Events"


On managed system:
i enable access to wmi to non administrative account
enableRWMI.exe -a:domain\user

on CMS:
I Discover System then identify it.
In Product Description > Management Protocols i see - WBEM:1.0

then i Subscribe my managed system to WBEM Events:

Create Subscriptions for:
fqdn_hostname
Indication subscription successfully created.

everything looks fine, but when i try to send test event (using "C:\Program Files\HPWBEM\Tools\HPWbemTestEvent.exe"). This event does not appear in Events tab of system.

and if on cms i run:

c:\Program Files (x86)\HP\Systems Insight Manager\bin>mxwbemsub.exe -l -n hostname

Filter instances of Subscriptions for:

hostname

Filter Name: HPSIM_hpsim_1
Query: select * from HP_ThresholdIndication
Destination: https://0.0.0.0:50004/fqdn_hostname?wbemip=0.0.0.0

Filter Name: HPSIM_hpsim_0
Query: select * from HP_AlertIndication
Destination: https://0.0.0.0:50004/fqdn_hostname?wbemip=0.0.0.0

Filter Name: HPSIM_hpsim_1
Query: select * from HP_ThresholdIndication
Destination: https://0.0.0.0:50004/fqdn_hostname?wbemip=0.0.0.0

Filter Name: HPSIM_hpsim_0
Query: select * from HP_AlertIndication
Destination: https://0.0.0.0:50004/fqdn_hostname?wbemip=0.0.0.0

i think that destination field must contain ip of my cms server, not 0:0:0:0 ?!

Options > Protocol Settings > WMI Mapper Proxy
is set correctly.

[ezh]

also many of my servers got this error:

Create Subscriptions for:
bcp-ts01.deltacredit.ru
FAILED to create indication subscription.


I double check everything, still no luck :(

wmi mapper is co-hosted on the HP SIM CMS.
and 2 services is started:
pegasus wmi mapper
pegasus wmi indications service


also i check this:

Troubleshooting WBEM Indications in HP SIM
If a subscription fails:
1. Make sure WBEM is a discovered protocol on the managed node (Systems Page > Product Description table > Management Protocols).
2. Make sure the node is accessible (Properties link on the Systems Page or Options-> Identify).
3. Make sure the WMI Mapper has both services created and running.
If no indications display in HP SIM:
1. Select Options-> Events-> Event Filter Settings.
2. Select Accept unregistered events. This is not selected by default.

need help.

[ezh]

maybe there is any log which can give more information, about mxwbemsub.exe error ?

[ezh]

when i try to subscribe, on target system i receive error in win security log:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 17.03.2009
Time: 10:26:11
User: NT AUTHORITY\SYSTEM
Computer: hostname
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name:
Domain:
Logon Type: 3
Logon Process: Authz
Authentication Package: Kerberos
Workstation Name: hostname
Caller User Name: hostname$
Caller Domain: DELTACREDIT
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 808
Transited Services: -
Source Network Address: -
Source Port: -
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


but username and password is correct, and i can identify this server with this credentials