Dell OM : User Tracking warning.

Dell.ManagedServer.Alert.8490 (Rule)

Event Description: {0}

Knowledge Base article:

Summary

User Tracking warning.

Causes

The Dell iDRAC generated a User Tracking trap alert. Probable causes and corresponding resolutions for this condition are:

Cause	Resolutions
Login attempt alert for <username> from <IP Address> using <interface name> , IP will be blocked for <seconds> seconds..	Contact the iDRAC administrator and make sure the username and password credentials used are correct. Check the Lifecycle Controller Log (LC Log) to see if more unauthorized iDRAC access attempts are occurring than would be expected due to forgotten account names or passwords.
The Front Panel USB Port Over Current is detected for the attached device on Disk.USBFront. <port number>.	Reinsert the USB device in the Front Panel USB Port and retry the operation. If the issue persists, use a different USB device.

Resolutions

Additional information on this issue may be available. Launch the iDRAC Console to debug further.

Element properties:

Target

Dell.ManagedServer

Category

Alert

Enabled

True

Event_ID

8490

Event Source

LifeCycle Controller Log

Alert Generate

True

Alert Severity

Warning

Alert Priority

Normal

Remotable

True

Alert Message

Dell OM : User Tracking warning.

Event Description: {0}

Event Log

System

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventProvider	Default
Alert	WriteAction	System.Health.GenerateAlert	Default
WriteToDW	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default

Source Code:

<Rule ID="Dell.ManagedServer.Alert.8490" Enabled="true" Target="DellManagedServer!Dell.ManagedServer" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>Alert</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Property[Type="DellManagedServer!Dell.ManagedServer"]/HostName$</ComputerName>

      <LogName>System</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">8490</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">LifeCycle Controller Log</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertMessageId>$MPElement[Name="Dell.ManagedServer.Alert.8490.Rule"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>

        <SuppressionValue>$Data/Channel$</SuppressionValue>

        <SuppressionValue>$Data/PublisherName$</SuppressionValue>

        <SuppressionValue>$Data/LoggingComputer$</SuppressionValue>

        <SuppressionValue>$Data/EventCategory$</SuppressionValue>

        <SuppressionValue>$Data/EventLevel$</SuppressionValue>

        <SuppressionValue>$Data/UserName$</SuppressionValue>

        <SuppressionValue>$Data/EventNumber$</SuppressionValue>

        <SuppressionValue>$Data/EventDescription$</SuppressionValue>

      </Suppression>

      <Custom1/>

      <Custom2/>

      <Custom3/>

      <Custom4/>

      <Custom5/>

      <Custom6/>

      <Custom7/>

      <Custom8/>

      <Custom9/>

      <Custom10/>

    </WriteAction>

    <WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>