SIM, SNMP and Spectrum

[Jason Cote]

We use Spectrum to monitor our network. In recent days, we've started to expand to add many servers to our monitoring functions. Most are HP servers that are running SIM agents.

What we are discovering is that the Spectrum box continuously (every 3 seconds) receives an Auth Failure trap. We've put a sniffer on the box, verified that there are no outside forces involved...just our Spectrum box and the server.

We have verified community names. We have gone from allowing the Spectrum community name READ ONLY to READ CREATE to see if that would help. We've turned off access to all other boxes, that has not helped.

Recently, we have discovered that if we:
(1) turn off Send Auth Trap in windows SNMP, that the problem stops (makes sense, as it wouldn't send the trap even if the event occurred). The problem with this solution is that we really would like to know if someone other than who belongs there is trying to access the box.

(2) turn off the HP Insight Foundation Agent service. This seems to stop the errors, but I'm not sure to what end.

Has anyone seen this happen before and know the right way to make the problem stop?

[Rob Buxton]

Is the Spectrum box polling those Servers on the http/https 2301/2381 ports?
It may be initiating the login, which the HP Agent then reports.

I've had the reverse where HPSIM triggered a login failure when it tried to interrogate our UPS which has a web interface.