This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Ansible SolarWinds Collection with OrionSDK- Authentication issue

I really wish there was an official SolarWinds Ansible collection that was covered under support, but I have been using this Ansible collection to manage my SolarWinds nodes: jeisenbath/ansible-collection-solarwinds-orion: An Ansible collection for managing nodes in Solarwinds Orion (github.com). It has been working pretty well to add snmpv3 nodes as well as manage custom properties. However I am having an issue I would like to get resolved. SolarWinds support referred me to THWACK for help with this issue.

Here is an example Ansible playbook task and debug output from my Ansible server:

- name: Set Project custom property
solarwinds.orion.orion_custom_property:
<<: *solarwinds_info
name: "{{ inventory_hostname }}"
state: present
property_name: Project
property_value: lab
delegate_to: localhost

changed: [RT-01 -> localhost] => {
    "changed": true,
    "invocation": {
        "module_args": {
            "hostname": "x.x.x.x",
            "ip_address": null,
            "name": "RT-01",
            "node_id": null,
            "password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
            "property_name": "Project",
            "property_value": "lab",
            "state": "present",
            "username": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER"
        }
    },
    "orion_node": {
        "caption": "RT-01",
        "ipaddress": "10.x.x.x",
        "netobjectid": "N:1061",
        "nodeid": 1061,
        "objectsubtype": "SNMP",
        "status": 1,
        "statusdescription": "Node status is Up.",
        "unmanaged": false,
        "unmanagefrom": "2023-07-14T00:48:30.677000+00:00",
        "unmanageuntil": "2023-07-14T00:55:01.117000+00:00",
        "uri": "swis://x.x.x.x.automation.lab/Orion/Orion.Nodes/NodeID=1061"
    }
}

However, when I am running an ansible playbook and interacting with SolarWinds like shown above (add custom property/add node/add interface etc.) I get the below audit logs in Solarwinds. When I run a playbook on a large number of nodes, it spews tons of these logs into the audit log. It appears to happen multiple times for every thing it does. For example I got the following logs for updating one custom property on one node. The playbook tasks runs successfully and gives no indication of errors from an Ansible perspective.

Any idea what is causing this and if it can be resolved? I am seeing this on both my lab and production environments.

8/18/2023 7:30:20 AM Audit Event User admin changed custom property 'Project' to 'lab' on node RT-01. RT-01 10.x.x.x
8/18/2023 7:30:20 AM Audit Event User AUTOMATION\admin made an unsuccessful attempt to login from a SolarWinds Information Service endpoint.	 	 
8/18/2023 7:30:19 AM Audit Event User AUTOMATION\admin made an unsuccessful attempt to login from a SolarWinds Information Service endpoint.	 	 
8/18/2023 7:30:18 AM Audit Event User AUTOMATION\admin made an unsuccessful attempt to login from a SolarWinds Information Service endpoint.	 	 
8/18/2023 7:30:17 AM Audit Event User AUTOMATION\admin made an unsuccessful attempt to login from a SolarWinds Information Service endpoint.

Also here are some entries from ApolloWebApi.log with UserLoginUnsuccessful that correlate with the above audit logs.

2023-08-18 07:30:16,443 [432] DEBUG SolarWinds.Orion.Common.SqlHelper - SQL:
SELECT TOP 1 ServerName FROM Engines WITH(NOLOCK) WHERE Engines.ServerType = 'Primary' ORDER BY KeepAlive DESC
2023-08-18 07:30:16,443 [432] DEBUG SolarWinds.Orion.Swis.PubSub.MessageBus.MessageBusTopologyProvider - No message bus host change detected.
2023-08-18 07:30:17,802 [432] DEBUG SolarWinds.MessageBus.RabbitMQ.EasyNetQLogger - Message delivered to consumer 89e0879b-f63a-46f2-b8bc-25cda63049da with deliveryTag 107
2023-08-18 07:30:17,802 [432] DEBUG SolarWinds.MessageBus.RabbitMQ.EasyNetQLogger - Received message with receivedInfo=[ConsumerTag=89e0879b-f63a-46f2-b8bc-25cda63049da, DeliveryTag=107, Redelivered=False, Exchange=, RoutingKey=ApolloWebsite.AccountChangeIndicationSubscriber.Orion.UserLoginUnsuccessful.Engine@Engine_1/w3wp_LM/W3SVC/1/ROOT/api2_, Queue=ApolloWebsite.AccountChangeIndicationSubscriber.Orion.UserLoginUnsuccessful.Engine@Engine_1/w3wp_LM/W3SVC/1/ROOT/api2_]
2023-08-18 07:30:17,802 [432] DEBUG SolarWinds.MessageBus.RabbitMQ.EasyNetQueue - Received message on ApolloWebsite.AccountChangeIndicationSubscriber.Orion.UserLoginUnsuccessful.Engine@Engine_1/w3wp_LM/W3SVC/1/ROOT/api2_ for subscription ApolloWebsite.AccountChangeIndicationSubscriber.Orion.UserLoginUnsuccessful.Engine@Engine_1/w3wp_LM/W3SVC/1/ROOT/api2_
2023-08-18 07:30:17,802 [432] DEBUG SolarWinds.Orion.Identity.AccountChangeIndicationSubscriber - Received Account Change indication 'Orion.UserLoginUnsuccessful'.
2023-08-18 07:30:17,802 [432] DEBUG SolarWinds.Orion.Identity.AccountChangeIndicationSubscriber - Indication Properties: IndicationId: 7d5af392-32ea-47ce-a789-bf0f9aeff0b4
IndicationTime: 8/18/2023 2:30:17 PM
SequenceNumber: 291
AccountId: AUTOMATION\admin
IPAddress: a SolarWinds Information Service endpoint

I opened an issue on the github collection, User made an unsuccessful attempt to login from a SolarWinds Information Service endpoint. · Issue #6 · jeisenbath/ansible-collection-solarwinds-orion (github.com), but I was hoping someone on here might have some information that could help resolve this issue?

Parents Reply Children