Home
  •  

iSCSI initiator failed to login (initiator not defined)

Microsoft.Windows.FileServer.Service.iSCSITarget.2008R2.FailedLogin.InitiatorNotDefined (Rule)

Knowledge Base article:

Summary

This rule monitors failed logins to iSCSI target by iSCSI initiators, which is caused by iSCSI initiators not being configured for access.

An alert will be generated for every unique combination of iSCSI initiator and iSCSI target that causes this issue. The alert description will contain details of the iSCSI initiator and target

Causes

An iSCSI initiator can only access an iSCSI target once the iSCSI target has been configured with the iSCSI initiator address. If an undefined iSCSI initiator tries to access an iSCSI target, the iSCSI target will reject the connection and log an event that generates this error.

Resolutions

If the iSCSI initiator is valid for this iSCSI target, the iSCSI target configuration should be updated to allow the iSCSI initiator. This can be done using the following steps:

If the iSCSI initiator should not be accessing a particular iSCSI target, configure the iSCSI initiator on that computer by removing the iSCSI target so it does not keep trying to connect.

You must manually resolve the alert once the problem has been resolved.

Element properties:

TargetMicrosoft.Windows.FileServer.Service.iSCSITarget.2008R2
CategoryAvailabilityHealth
EnabledTrue
Event_ID38
Event SourceWinTarget
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
RemotableTrue
Alert Message
An iSCSI initiator failed to login
The iSCSI initiator '{0}' does not have access to the iSCSI target server '{1}'
Event LogApplication

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
GenerateAlert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="Microsoft.Windows.FileServer.Service.iSCSITarget.2008R2.FailedLogin.InitiatorNotDefined" Target="Microsoft.Windows.FileServer.Service.iSCSITarget.2008R2" Enabled="true" Remotable="true" ConfirmDelivery="true">

  <Category>AvailabilityHealth</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">WinTarget</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">38</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>2</Severity>

      <AlertMessageId>$MPElement[Name="Microsoft.Windows.FileServer.Service.iSCSITarget.2008R2.FailedLogin.InitiatorNotDefined.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/Params/Param[1]$</AlertParameter1>

        <AlertParameter2>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</AlertParameter2>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/Params/Param[1]$</SuppressionValue>

      </Suppression>

    </WriteAction>

  </WriteActions>

</Rule>