Authorization failure log

[mkareemashraf]

Hello ,

In our company we are using Ciscoworks LMS3.0.( DFM 3.0.1, RME 4.1.1.)

In DFM, every day at 8:00 PM we recevie alarm authorization failure on Core switch ( source is cisco works server IP).

All credentials of Core switches are ok .

I have checked all the schedule Jobs in RME and DFM , but there are no jobs ceated on this time.

Strange thing is that cisoworks automatically clear the alram after 10 mins.

Please can anyone  help me how to trobleshoot & solve this issue

Your help is highly appreciated.

with regards,

kareem

[Joe Clarke]

The best way to troubleshoot this is with a sniffer trace on the LMS server.  This should be easy to do since you know when the polling will occur.  The community string and objects being requested should help identify the problem within LMS.  DFM will automatically clear such events since there is no clear "clear" event that is generated for an authFail.

[mkareemashraf]

Dear clarke,

Thanks for prompt response.

i have small query ,since the credentials of core switches are ok on Common servers . why there is authorization failure?

Is there any other way wher i can  find all the all porcess running at 8:00 pm and delete that process.

[Joe Clarke]

You can comb through each application's job browser to see what jobs are running at 8:00 pm, but the sniffer trace filtering on udp/161 traffic to the device in question would be much easier and quicker.  While credentials do come from DCR, it is possible for something like DFM or Campus Manager UT to be polling with an incorrect string.  DFM may have some old data in its Smarts database, and UT (or Campus Manager Data Collection) may be trying to poll a VLAN that does not exist or is not active on the switch.

[mkareemashraf]

Dear clark,

Thanks for your support.

I have find out the JOB ID in ciscoworks which runs at 8:00 pm.

JOB ID: 1510 – Device discovery

I have exlcuded many devices which are not needed in device discovery filter setting.

how to troubleshooting for authentication alarm .

thanks in advance,

[Joe Clarke · Accepted solution]

Chances are you're using multiple SNMP credentials to discover your network.  Go to Common Services > Device and Credentials > Device Discovery, and edit your settings.  Look at your SNMP Settings.  If you have multiple *.*.*.* (or any wildcard) targets, try to adjust them so you're matching the correct credentials to the correct devices.

[mkareemashraf]

Thanks clarke for your support.