nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
- SolarWinds Academy
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Failed login from polling engine

wes.reneau

Infosec is hitting me up b/c of failed logins from the polling engines.

Polling engine is in INTERNALPRODUCTION domain. The event below is from a server in our DMZPRODUCTION domain. The polling engine is attempting to login to a server in the DMZ using the systemname (POLLINGENGINENAME$ and the INTERNALPRODUCTION domain. I captured the error log below and obscured the server and domain name The logon type is 3 which tells me its a network share type of attempt, at least that's what I've come to believe after reading the login types.

I successfully poll the DMZ server using a service account that authenticates in the DMZ domain successfully, confirmed this by editing the node and testing the credentials. I've removed applications templates to eliminate any oddities and I'm only polling the usual, disk, cpu, memory. When I unmanage the node, the failed logins cease.

So, I'm at a loss as to where these failed logins are coming from. Anybody experience this before?

I'm on 2017.3.4, waiting on the upgraded SQL cluster before I upgrade to 2018.