Event messages are displayed every 10 minutes in vCenter with hyperflex 4.5a distributed through cisco intersight. Do you know why?

[HyunJun Lee]

Event messages are displayed every 10 minutes in vCenter with hyperflex 4.5a distributed through cisco intersight. Do you know why?

 

 

[Kirk J]

The 'admin' account is not used by hyperflex for any polling, so if you are getting 10 min cycle of 'admin' login attempts then that sounds like some sort of remote monitoring solution, that has incorrect password.

The /var/log/auth.log file on the esxi hosts will contain more details about the IP the attempts are coming from, and should point you in the direction of what device is attempting the logins.

Kirk...

[HyunJun Lee]

/var/log/auth.log 

You have entered a command.

It's coming out like this.

What kind of things do I have to check?

[Kirk J]

If you login to hx connect gui, using the 'admin' local account, that alert gets generated inside hyperflex events, which in turn are passed through to vcenter.

If you don't want to see those alerts, just use administrator@vcenter.local (or what ever your SSO domain is) account.

Kirk..