Network Management

I have a problem with IMC 5.1 using all A-series switches.  There is a recurring alert with the following information:

Name  Authentication Failure  

Level   Minor  

OID  1.3.6.1.6.3.1.1.5.4.0  

Alarm at  2012-04-27 09:40:47  

Alarm Source  H3C_Core More Alarms...  

Type    Trap  

Alarm Category  Other Device Alarms  

Recovery Status    Unrecovered  Acknowledgement Status    Unacknowledged  

Description  Device receives an SNMP message with an erroneous community string  

Alarm Cause  SNMP agent receives an SNMP message with an erroneous community string.  

Remediation Suggestion  Check if: 1. There are hacker attacks on the network. 2. The SNMP community string is inconsistent with that in the NMS.

This is driving me nuts because I can't find any information about what MAC address this is, what VLAN it is on, or any information about the request.  I have checked and double checked the community strings on the core switch.  What can I look for?  I do have a considerable number of outside APs near my APs, but I can't isolate what is making the request if in fact that is the reason.  This alarm happens hundreds of times per day.

Unfortunately, I'm only going to be saying, "Me Too!!!"  My 7510 core switch has been doing this for over a month (every hour) now and I can't determine if it's the 7510 sending the wrong community or if the monitoring server actually has a wrong community listed that's triggering the error.  I cannot find any more information in any of the logs to point me in the right direction and no where at HP to go for this type of help.

This trap means that someone is trying to use an incorrect snmp community string to access the trap sending device.
Do the following:
1. Restart IMC.
2. If the problem persists, execute the following commands on the trap sending device to find who is trying to access the device with a wrong community string:

 undo debug all
 terminal debug
 terminal monitor
 debug snmp agent packet receive

Hope this helps.

Hello There.

"

Yah it does!

Perfect.

Thanks.

Restarting IMC is not neccessary if it is another NMS.

Cheers

Is there a way to send to IMC the IP address from the server sending the wrong community string?

We have this logs happening during weekend nights and I could not do a remote access to debug this.

Hi,

looks like you are using other monitoring of theese switches with bad snmp comunity name?

Hi,

switch is getting SNMP packet with wrong community - that can be any other monitoring tool in your network. I suggest to use debug as recommended by others here.

There is one thing that might cause it by iMC - if you leave write community empty iMC does not turn off occasional write SNMP request during polling and will use empty string (as of iMC 5.1). If you can please set correct write community, if cannot you can only filter this message... If this is major issue for you please submit support case.

Tomas

I have the same issue.  it is sporadic, across many switches.  the requests are NOT coming from iMC.  Those requests are valid and work fine.  It's trying to find out what device on the network is running some rogue SNMP Software.  You would hope that if iMC can log an invalid SNMP attempt, one of the pieces of data to capture would be either the IP or MAC address of who is the "offender".