Cisco Ucs Login Failure Rule

Cisco.Ucs.Library.Ucsm.LoginFailure.Rule (Rule)

Knowledge Base article:

Summary

UCS Manager Login Failure

Cause

This fault indicates that the UCS Manager is either not reachable or authentication has failed.

Resolution

If you see this fault, make sure that the UCS Manager is reachable from the machine running the UCS Management Service and the corresponding Run As Account has valid credentials to login into UCS Manager.
If the UCS Manager is configured for domain authentication, make sure that the username is in the format username@domainname where domainname is the authentication domain configured in UCS Manager.

If the above actions did not resolve the issue, contact Cisco Technical Support

Management Pack Information

Cisco UCS Manager Management Pack

Element properties:

Target

Cisco.Ucs.Proxy

Category

None

Enabled

True

Alert Generate

True

Alert Severity

Error

Alert Priority

High

Remotable

True

Alert Message

Cisco UCSM Login Failure

[Instance Name:{1}; Url:{2}]
Description: {0}

Event Log

Cisco UCS Monitoring Service

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventProvider	Default
WA	WriteAction	System.Health.GenerateAlert	Default

Source Code:

<Rule ID="Cisco.Ucs.Library.Ucsm.LoginFailure.Rule" Target="Cisco.Ucs.Proxy" Enabled="true" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>None</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Property[Type="Cisco.Ucs.Object"]/MonitoringServer$</ComputerName>

      <LogName>Cisco UCS Monitoring Service</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">17101</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">LoginStatus</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">Params/Param[2]</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">$Target/Property[Type="Cisco.Ucs.Object"]/TypeId$</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">Params/Param[6]</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">AlertGenerated</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WA" TypeID="Health!System.Health.GenerateAlert">

      <Priority>2</Priority>

      <Severity>2</Severity>

      <AlertMessageId>$MPElement[Name="Cisco.Ucs.Server.LoginFailure.Rule.StringResource"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/Params/Param[1]$</AlertParameter1>

        <AlertParameter2>$Data/Params/Param[3]$</AlertParameter2>

        <AlertParameter3>$Data/Params/Param[4]$</AlertParameter3>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/Params/Param[2]$</SuppressionValue>

        <SuppressionValue>$Data/Params/Param[3]$</SuppressionValue>

      </Suppression>

      <Custom1>$Data/Params/Param[2]$</Custom1>

      <Custom2>new</Custom2>

      <Custom3>$Data/Params/Param[4]$</Custom3>

      <Custom4>$Data/Params/Param[5]$</Custom4>

      <Custom5>$Data/Params/Param[3]$</Custom5>

      <Custom7>$Data/Params/Param[3]$</Custom7>

    </WriteAction>

  </WriteActions>

</Rule>