authentication failure, after i changed SNMP string

Question

hi

i change the SNMP strings on our devices, (security reasons).

since then, we are getting lots of syslog messages saying "authentication failure for SNMP from x.x.xx."

now the x.x.x.x is our solarwinds npm/ncm box and all that server does is solarwinds npm/ncm

it's only happening on 4 6513 cisco cores

if i unmanage the 4 devices on npm the messages stop

so, my thinking was,  is it an old install of NTA or IPAM (both trials) that is still in the database?

or has the change of snmp string not fully update itself  within NPM?

any ideas would be great

i have raised a ticket to delete all IPAM and NETFLOW from the database, but not had a response yet

FormerMember · Answer

One thought: did you make the SNMP changes in NCM also?

Spiky · Answer

on the wireshark,

would you have anyidea what i secificaly should be looking for

and i see lots od get-requests, then followed by a get-response

it dont show and failures

Spiky · Answer

i have run mib walk, and it's comeback with over 120000 responses,

can see any that failed, but i was only quickly scanning, the fact it have come back with that amount, is surely confirmation that access is fine :)

what i dont understand is when an uninstall is done, why isn't it cleaning up the database.

thus possibly (if it is the cause) causing this greif