Home
  •  

iSCSI initiator failed to login (invalid iSCSI target)

Microsoft.Windows.FileServices.Service.iSCSITarget.10.0.FailedLogin.InvalidTarget (Rule)

Knowledge Base article:

Summary

This rule monitors failed logins to an iSCSI Target server by an iSCSI initiator, which is caused by an invalid iSCSI target being requested.

An alert will be generated for every unique combination of iSCSI initiator and iSCSI target that causes this issue. The alert description will contain details of the iSCSI initiator and target.

Causes

An iSCSI initiator tried to access an iSCSI target on this server that is not valid.

Resolutions

Verify that the iSCSI initiator configuration is correct and the iSCSI target server is the correct server that should be accessed. If this is correct, follow these steps:

You must manually resolve the alert once the problem has been resolved.

Element properties:

TargetMicrosoft.Windows.FileServices.Service.iSCSITarget.10.0
CategoryAvailabilityHealth
EnabledTrue
Event_ID22
Event SourceMicrosoft-Windows-iSCSITarget-Service
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
RemotableTrue
Alert Message
An iSCSI initiator failed to login - Invalid Target
The iSCSI initiator '{0}' requested an invalid target: '{1}' on computer '{2}'. The login request was rejected.
Event LogMicrosoft-Windows-iSCSITarget-Service/Admin

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
GenerateAlert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="Microsoft.Windows.FileServices.Service.iSCSITarget.10.0.FailedLogin.InvalidTarget" Target="Microsoft.Windows.FileServices.Service.iSCSITarget.10.0" Enabled="true" Remotable="true" ConfirmDelivery="true">

  <Category>AvailabilityHealth</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Microsoft-Windows-iSCSITarget-Service/Admin</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">Microsoft-Windows-iSCSITarget-Service</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">22</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>2</Severity>

      <AlertMessageId>$MPElement[Name="Microsoft.Windows.FileServices.Service.iSCSITarget.10.0.FailedLogin.InvalidTarget.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/Params/Param[1]$</AlertParameter1>

        <AlertParameter2>$Data/Params/Param[2]$</AlertParameter2>

        <AlertParameter3>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</AlertParameter3>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/Params/Param[1]$</SuppressionValue>

        <SuppressionValue>$Data/Params/Param[2]$</SuppressionValue>

      </Suppression>

    </WriteAction>

  </WriteActions>

</Rule>