"Unable to authenticate on manager: TriGeo"

So, just want to make sure I have it right -

• You're trying to access your original SIM appliance, which was working fine yesterday (or are you accessing the new LEM system that you are migrating to?)
• You can connect to the web console (or are you using desktop/AIR/installed console?)
• When you type in your credentials (or use saved credentials) and hit log in, you get the "unable to authenticate on manager" error

Does the error occur for all users? Have you tried from another system other than your own?

Your SIM appliance is still under maintenance through the end of the month so I'm not sure why support would give you grief on this one. They ARE under two different SWIDs, though, which might make things complicated. I don't see a case for either one at a glance but I can check with support and see what happened if you have a case #. (That is, if I can't help )

Thanx for your response.

Yes, you correctly understand the situation, except that support has already expired (end of January - I may have misstated that).

Yes, I can get to the login page on a browser, and on SIM I see the list of appliances, but the lower right indicator says "disconnected". In fact, I can navigate to the various screens in SIM, but they all say "Event data not available".

I have tried multiple accounts, both AD-based & local.

The case number they gave me was 580382.

Anything else I can provide?

I thought I'd put this in a separate reply, rather than add to the last from a few minutes ago, to draw attention to it.

I just had the idea to run a report to see if data is still being collected. It is.

So, this looks like just an authentication issue, then.

Thanx

Of course. It's February.   I'll look into the support side. In the interest of moving your SIM appliance to LEM we'll have to solve this problem anyway, or you'll likely just have it in two places.

Can you check the appliance's manager log to see if there are more informative errors when you attempt to log in? Either from a debug or using 'watchlog' from the CMC should work.

Just wanted to follow up, I did talk to support and they may also be following up with you directly.

Excellent. Thanx. Here's the watchlog. It didn't seem to me to give any helpful information.

(Thu Feb 13 17:56:45 EST 2014) EE:ERR [RawDataServer v25600] {pool-13-thread-1:244} nDepth ManagerOutput remote socket connect failure to 10.254.10.14 Connection refused host=10.254.10.14 port=10102 proto=TCP;

(Thu Feb 13 17:57:48 EST 2014) EE:ERR [RawDataServer v25600] {pool-13-thread-1:244} nDepth ManagerOutput remote socket connect failure to 10.254.10.14 Connection refused host=10.254.10.14 port=10102 proto=TCP;

(Thu Feb 13 17:58:51 EST 2014) EE:ERR [RawDataServer v25600] {pool-13-thread-1:244} nDepth ManagerOutput remote socket connect failure to 10.254.10.14 Connection refused host=10.254.10.14 port=10102 proto=TCP;

(Thu Feb 13 17:59:22 EST 2014) II:INFO [ComModuleManager] {Timer-2:32} Sending heartbeat to all active Agents;

(Thu Feb 13 17:59:27 EST 2014) II:NOTICE [NioComNetworkChild v25600] {NioExitQueueHandler:42} Reporting canceled key: ConnectionsKey:543 Unable to register the online agent: ;

(Thu Feb 13 17:59:54 EST 2014) EE:ERR [RawDataServer v25600] {pool-13-thread-1:244} nDepth ManagerOutput remote socket connect failure to 10.254.10.14 Connection refused host=10.254.10.14 port=10102 proto=TCP;

(Thu Feb 13 18:00:56 EST 2014) EE:ERR [RawDataServer v25600] {pool-13-thread-1:244} nDepth ManagerOutput remote socket connect failure to 10.254.10.14 Connection refused host=10.254.10.14 port=10102 proto=TCP;

(Thu Feb 13 18:01:58 EST 2014) EE:ERR [RawDataServer v25600] {pool-13-thread-1:244} nDepth ManagerOutput remote socket connect failure to 10.254.10.14 Connection refused host=10.254.10.14 port=10102 proto=TCP;

(Thu Feb 13 18:03:01 EST 2014) EE:ERR [RawDataServer v25600] {pool-13-thread-1:244} nDepth ManagerOutput remote socket connect failure to 10.254.10.14 Connection refused host=10.254.10.14 port=10102 proto=TCP;

(Thu Feb 13 18:03:17 EST 2014) II:INFO [SolrMaintenanceReporting] {SolrCore Reporting-1:16} Updating Solr Maintenance Report Tables.;

(Thu Feb 13 18:04:04 EST 2014) EE:ERR [RawDataServer v25600] {pool-13-thread-1:244} nDepth ManagerOutput remote socket connect failure to 10.254.10.14 Connection refused host=10.254.10.14 port=10102 proto=TCP;

(Thu Feb 13 18:04:05 EST 2014) II:INFO [SessionListener v25376] {http-8443-5:221} sessionCreated;

(Thu Feb 13 18:04:05 EST 2014) EE:ERR [NewUserLibrary v25600] {http-8443-5:221} Exception during authentication: admin[Subject:, 10.151.195.27] - com.trigeo.core.users.TriGeoLoginException: Invalid username/password.;

(Thu Feb 13 18:04:05 EST 2014) II:INFO [SessionListener v25376] {http-8443-5:221} A TriGeoUser doesn't exist for that user: unknown;

(Thu Feb 13 18:04:05 EST 2014) II:INFO [SessionListener v25376] {http-8443-5:221} sessionDestroyed, user= unknown;

(Thu Feb 13 18:04:19 EST 2014) II:INFO [SessionListener v25376] {http-8443-5:221} sessionCreated;

(Thu Feb 13 18:04:19 EST 2014) II:INFO [SessionListener v25376] {http-8443-3:219} sessionCreated;

(Thu Feb 13 18:04:19 EST 2014) II:INFO [SessionListener v25376] {http-8443-3:219} A TriGeoUser doesn't exist for that user: unknown;

(Thu Feb 13 18:04:19 EST 2014) II:INFO [SessionListener v25376] {http-8443-3:219} sessionDestroyed, user= unknown;

(Thu Feb 13 18:04:19 EST 2014) II:INFO [SessionListener v25376] {http-8443-3:219} A TriGeoUser doesn't exist for that user: unknown;

(Thu Feb 13 18:04:19 EST 2014) II:INFO [SessionListener v25376] {http-8443-3:219} sessionDestroyed, user= unknown;

(Thu Feb 13 18:04:19 EST 2014) II:INFO [SessionListener v25376] {http-8443-3:219} sessionCreated;

(Thu Feb 13 18:04:22 EST 2014) II:INFO [ComModuleManager] {Timer-2:32} Sending heartbeat to all active Agents;

Have you by chance tried the default admin/password? It's kind of a long shot.

We've also seen wonky behavior like this when your browser has a cached copy of an older version console, but you tried multiple browsers so that wouldn't make much sense. Otherwise there might be something happening further up the chain that's triggering a failure in logins later on.

Is your SIM an L4 with separate database and manager?  I notice the 10.254.10.14 address, which is one end of the internal link between manager and database.  If you don't have a separate appliance for the database, that seems odd.  If you do, something isn't happy.  It looks like the manager is trying to send raw message logs to the database, and getting denied.  Do you have connectors set to collect ndepth and alert data?  If not, we should try disabling that to reduce those errors and isolate the ones related to this issue.

It recognized the admin user on one attempt, but not the password.  In SSH under the MANAGER shell, there's the RESETADMIN command.  This resets the default admin web console user back to the default password.  Have you tried that command?