This rule monitors failed logins to iSCSI target by iSCSI initiators, which is caused by iSCSI initiators not being configured for access.
An alert will be generated for every unique combination of iSCSI initiator and iSCSI target that causes this issue. The alert description will contain details of the iSCSI initiator and target
An iSCSI initiator can only access an iSCSI target once the iSCSI target has been configured with the iSCSI initiator address. If an undefined iSCSI initiator tries to access an iSCSI target, the iSCSI target will reject the connection and log an event that generates this error.
If the iSCSI initiator is valid for this iSCSI target, the iSCSI target configuration should be updated to allow the iSCSI initiator. This can be done using the following steps:
On the iSCSI target server, open the Microsoft iSCSI Software Target MMC snap-in
In the left pane, locate the applicable iSCSI target under iSCSI Targets
Right click the target and click Properties
On the iSCSI initiators tab make required changes to the initiators, and then click Save.
If the iSCSI initiator should not be accessing a particular iSCSI target, configure the iSCSI initiator on that computer by removing the iSCSI target so it does not keep trying to connect.
You must manually resolve the alert once the problem has been resolved.
Target | Microsoft.Windows.FileServices.Service.iSCSITarget.6.2 | ||
Category | AvailabilityHealth | ||
Enabled | True | ||
Event_ID | 38 | ||
Event Source | Microsoft-Windows-iSCSITarget-Service | ||
Alert Generate | True | ||
Alert Severity | Error | ||
Alert Priority | Normal | ||
Remotable | True | ||
Alert Message |
| ||
Event Log | Microsoft-Windows-iSCSITarget-Service/Admin |
ID | Module Type | TypeId | RunAs |
---|---|---|---|
DS | DataSource | Microsoft.Windows.EventProvider | Default |
GenerateAlert | WriteAction | System.Health.GenerateAlert | Default |
<Rule ID="Microsoft.Windows.FileServices.Service.iSCSITarget.6.2.FailedLogin.InitiatorNotDefined" Target="Microsoft.Windows.FileServices.Service.iSCSITarget.6.2" Enabled="true" Remotable="true" ConfirmDelivery="true">
<Category>AvailabilityHealth</Category>
<DataSources>
<DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>Microsoft-Windows-iSCSITarget-Service/Admin</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">Microsoft-Windows-iSCSITarget-Service</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">38</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">
<Priority>1</Priority>
<Severity>2</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.FileServices.Service.iSCSITarget.6.2.FailedLogin.InitiatorNotDefined.AlertMessage"]$</AlertMessageId>
<AlertParameters>
<AlertParameter1>$Data/Params/Param[1]$</AlertParameter1>
<AlertParameter2>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</AlertParameter2>
</AlertParameters>
<Suppression>
<SuppressionValue>$Data/Params/Param[1]$</SuppressionValue>
</Suppression>
</WriteAction>
</WriteActions>
</Rule>