Description of the problem

A bureau has reported SECU_ALM alarms at 00:00 every day from July 4, 00:00 for all network elements in the whole network.

Alarm information

SECU_ALM

Processing

1, through the sm-get-seculog-new view security logs, found that the SECU_ALM alarm for all network elements, every day from 00:00, non-gateway gateway elements are through the 9-1012 gateway elements to log in, login terminal type: tm, szhw account 4 consecutive failed to log in to lead to the lock of the szhw, to continue to log in, the SECU_ALM alarm is reported. SECU_ALM alarm is reported.

2, through the sm-get-seculog-new view gateway network element security logs, found in the same time to log in the gateway network element for the 129.9.0.122 IP, this IP is the IP of the U2000 network management server, through the exhaustive examination of the U2000 network management server Navigator bin log directory logs, did not find that in the 00:00 every day there is a record. I checked the logs in the binlog directory of Navigator on the U2000 network management server, and found no record of login at 00:00 every day. At the same time, it is confirmed that there is no inspection or DC collection of network element data.

3, check the system log of U2000 network management found that there is a "network element software management" function, "backup to the server" operation in the July 3 before the operation was successful, from July 4 onwards, a large number of operations every night failed.

6, in the system - network element software management - network element backup policy management to confirm that this operation for the network element database timed backup policy is enabled, while the backup time for the daily 00:00. to confirm that the network element database backup policy to log network element failed to cause.

7, check the operation log found on July 3, set the U2000 network administrator of the DC login account password is wrong, resulting in the network elements of the database backup failed to log in SECU_ALM alarm.

8, in the system - network element security - network element login management - DC login user management to switch back to set the DC account, the problem is solved.

Root cause

Setting the wrong user name and password for the DC login account causes the logon failure of the network element database timed backup task, which is reported to SECU_ALM alarm.

Solution

Confirm the DC login user name and password settings, and the problem is solved.

Suggestion and summary

sm-get-seculog-new query the login log of the network element, RESC indicates the name of the accessed resource, TEITYPE login terminal types include: tm, ems, lct, web four, tm represents the command way to log in; ems indicates the network management way to log in: including the U2000, T2000, NES network management; lct indicates the U2000 lct login, web indicates the web way to log in. U2000 lct login, web means using webpage to login. The last line RESULT indicates the result of the operation: F means login failure, S means login success.

This chapter of related technical information and SDH equipment troubleshooting process is provided by Shenzhen Optical Transmission Network Technology Company Limited (www.opticaltrans.com), reproduced please retain! Huawei SDH Optical Transmission Equipment, SDH Transmission Equipment Sales