Home
  •  

iSCSI initiator failed to login (iSCSI target disabled)

Microsoft.Windows.FileServices.Service.iSCSITarget.10.0.FailedLogin.TargetDisabled (Rule)

Knowledge Base article:

Summary

This rule monitors failed logins to an iSCSI Target by an iSCSI initiator due to the iSCSI target being disabled.

An alert will be generated for every unique combination of iSCSI initiator and iSCSI target that causes this issue. The alert description will contain details of the iSCSI initiator and target.

Causes

An iSCSI initiator has attempted to access an iSCSI target that is currently disabled. The iSCSI initiator will not be able to access the iSCSI target until the iSCSI target is enabled. The iSCSI target may have been disabled by an administrator.

Resolutions

The iSCSI target must be enabled on the Windows Server computer hosting the iSCSI target. This can be done using the following steps:

Verify that the iSCSI initiator can now access the iSCSI target. From the iSCSI initiator computer, manually initiate the connection to ensure it is successful.

You must manually resolve the alert once the problem has been resolved.

Element properties:

TargetMicrosoft.Windows.FileServices.Service.iSCSITarget.10.0
CategoryAvailabilityHealth
EnabledTrue
Event_ID39
Event SourceMicrosoft-Windows-iSCSITarget-Service
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
RemotableTrue
Alert Message
An iSCSI initiator failed to login - Target Disabled
The iSCSI initiator '{1}' requested a target '{0}' on computer '{2}' that is disabled and was rejected
Event LogMicrosoft-Windows-iSCSITarget-Service/Admin

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
GenerateAlert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="Microsoft.Windows.FileServices.Service.iSCSITarget.10.0.FailedLogin.TargetDisabled" Target="Microsoft.Windows.FileServices.Service.iSCSITarget.10.0" Enabled="true" Remotable="true" ConfirmDelivery="true">

  <Category>AvailabilityHealth</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Microsoft-Windows-iSCSITarget-Service/Admin</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">Microsoft-Windows-iSCSITarget-Service</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">39</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>2</Severity>

      <AlertMessageId>$MPElement[Name="Microsoft.Windows.FileServices.Service.iSCSITarget.10.0.FailedLogin.TargetDisabled.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/Params/Param[1]$</AlertParameter1>

        <AlertParameter2>$Data/Params/Param[2]$</AlertParameter2>

        <AlertParameter3>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</AlertParameter3>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/Params/Param[1]$</SuppressionValue>

        <SuppressionValue>$Data/Params/Param[2]$</SuppressionValue>

      </Suppression>

    </WriteAction>

  </WriteActions>

</Rule>