This rule monitors failed logins to an iSCSI Target by an iSCSI initiator due to the iSCSI target being disabled.
An alert will be generated for every unique combination of iSCSI initiator and iSCSI target that causes this issue. The alert description will contain details of the iSCSI initiator and target.
An iSCSI initiator has attempted to access an iSCSI target that is currently disabled. The iSCSI initiator will not be able to access the iSCSI target until the iSCSI target is enabled. The iSCSI target may have been disabled by an administrator.
The iSCSI target must be enabled on the Windows Server computer hosting the iSCSI target. This can be done using the following steps:
On the iSCSI target server, open the Microsoft iSCSI Software Target MMC snap-in
In the left pane, expand the iSCSI Targets folder
Locate the applicable iSCSI target identified in the alert
Right-click the iSCSI target and then click Enable
Verify that the iSCSI initiator can now access the iSCSI target. From the iSCSI initiator computer, manually initiate the connection to ensure it is successful.
You must manually resolve the alert once the problem has been resolved.
Target | Microsoft.Windows.FileServices.Service.iSCSITarget.10.0 | ||
Category | AvailabilityHealth | ||
Enabled | True | ||
Event_ID | 39 | ||
Event Source | Microsoft-Windows-iSCSITarget-Service | ||
Alert Generate | True | ||
Alert Severity | Error | ||
Alert Priority | Normal | ||
Remotable | True | ||
Alert Message |
| ||
Event Log | Microsoft-Windows-iSCSITarget-Service/Admin |
ID | Module Type | TypeId | RunAs |
---|---|---|---|
DS | DataSource | Microsoft.Windows.EventProvider | Default |
GenerateAlert | WriteAction | System.Health.GenerateAlert | Default |
<Rule ID="Microsoft.Windows.FileServices.Service.iSCSITarget.10.0.FailedLogin.TargetDisabled" Target="Microsoft.Windows.FileServices.Service.iSCSITarget.10.0" Enabled="true" Remotable="true" ConfirmDelivery="true">
<Category>AvailabilityHealth</Category>
<DataSources>
<DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>Microsoft-Windows-iSCSITarget-Service/Admin</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">Microsoft-Windows-iSCSITarget-Service</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">39</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">
<Priority>1</Priority>
<Severity>2</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.FileServices.Service.iSCSITarget.10.0.FailedLogin.TargetDisabled.AlertMessage"]$</AlertMessageId>
<AlertParameters>
<AlertParameter1>$Data/Params/Param[1]$</AlertParameter1>
<AlertParameter2>$Data/Params/Param[2]$</AlertParameter2>
<AlertParameter3>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</AlertParameter3>
</AlertParameters>
<Suppression>
<SuppressionValue>$Data/Params/Param[1]$</SuppressionValue>
<SuppressionValue>$Data/Params/Param[2]$</SuppressionValue>
</Suppression>
</WriteAction>
</WriteActions>
</Rule>