Every night at 2 AM I'm getting an error on my Dell switches: %STKUNIT1-M:CP %SNMP-3-SNMP_AUTH_FAIL: SNMP Authentication failure for SNMP request from host x.x.x.x-Error:Snmp Unknown community
I only get this from my Dell switches, my 2 Cisco switches are not logging it in my syslogs. I am not using "Public/Private" as my community string.
I have found that when I add a node I can replicate it. Watching via wireshark I see 3 attempts between the Define Node and Choose Resources node. Each of these attempts adds an "@1" to the end of the community string, which the switches then do not authenticate. It is sending the poll to get 220.127.116.11.18.104.22.168.22.214.171.124.2. I see the rest of the SNMP traffic has my normal community string, and it replies fine. It looks like all the SNMP queries to my Cisco switches include the @1. I'm not worried about it during adding a node, but every night at 2 am for all of my switches is annoying (it did even poll IP's than hadn't been added to Orion yet). Anyone have any ideas what would be causing it, or what I can do?
Orion 2017.3.4 SP4, UDT 3.3.0, NPM 12.2, VMAN 8.1.0, NetPath 1.1.2, QoE 2.4, CloudMonitoring 1.1.0, NTA 4.2.3
This installation has had Engineers web toolset, and trials of NCM and IPAM previously installed. Unfortunately I don't recall if this started after installing one of them. I thought it may be the SNMP tools from the Desktop Engineers Toolset, first changed all the default communities, then completely uninstalled it as well.
I am really not sure what's wrong but when it comes to time pattern which you mentioned -> 2AM everyday, now that's interesting.
The only thing that I could think of when you say that, is SolarWinds Orion does a DB archive at that time, you would see this under Database Settings -> Default Archive Time is set to 2:15 AM , which is the time of the day when Orion runs a DB Maintenance on the background, probably your Orion Server is heavy during that time (performance issues), check for your Orion Server stats during that period.
Hope it helps.
SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 150,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process. Learn more today by joining now.