<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.6000.16890" name=GENERATOR></HEAD>
<BODY>
<DIV dir=ltr align=left><FONT face=Arial size=2></FONT> </DIV>
<DIV dir=ltr align=left><FONT face=Arial size=2></FONT> </DIV>
<DIV dir=ltr align=left><FONT face=Arial size=2></FONT> </DIV>
<DIV dir=ltr align=left>Number of AuthenticationFailed events exceeds 1 within 1
minutes. The alert is generated on Tue Sep 29 11:11:27 EDT 2009 on cluster
CM1-Cluster. </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV align=left><FONT face=Arial size=2></FONT> </DIV>
<DIV align=left><SPAN class=771255318-29092009><FONT face=Arial size=2>Does
anyone know where a Cisco document is on how to use traces to find
that?</FONT></SPAN></DIV>
<DIV align=left><SPAN class=771255318-29092009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV align=left><SPAN class=771255318-29092009><FONT face=Arial size=2>I've
looked in various trace lots in RTMT, but I cannot figure out the right trace
(callmanager, system, SDI, etc) to be looking for.</FONT></SPAN></DIV>
<DIV align=left><SPAN class=771255318-29092009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV align=left><SPAN class=771255318-29092009><FONT face=Arial size=2>I can
find plenty of references telling me that it's an authentication
failure</FONT></SPAN></DIV>
<DIV align=left><FONT face=Arial size=2><SPAN class=771255318-29092009>( eg <A
href="http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/service/7_0_1/rtmt_master/rtalsys.html">http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/service/7_0_1/rtmt_master/rtalsys.html</A>)</SPAN></FONT></DIV>
<DIV align=left><FONT face=Arial size=2><SPAN
class=771255318-29092009></SPAN></FONT> </DIV>
<DIV align=left><FONT face=Arial size=2><SPAN class=771255318-29092009>But that
document provides -no- assistance in learning how to track down more details
about what's going on.</SPAN></FONT></DIV>
<DIV align=left><FONT face=Arial size=2></FONT> </DIV>
<DIV align=left><FONT face=Arial size=2><SPAN class=771255318-29092009>This
really doesn't tell me what to DO about it.</SPAN></FONT></DIV>
<DIV align=left><FONT face=Arial size=2><SPAN class=771255318-29092009>
<H2 class=p_H_Head1>AuthenticationFailed </H2><A name=wp1013664></A>
<P class=pB1_Body1>Authentication validates the user ID and password that are
submitted during log in. An alarm gets raised when an invalid user ID and/or the
password gets used. </P><A name=wp1013665></A>
<P class=pBl_BlockLabel>Default Configuration </P><A name=wp1013666></A>
<P class=pB1_Body1></P>
<DIV align=left>
<TABLE id=wp1014574table1014572 borderColor=#808080 cellSpacing=0 cellPadding=3
width="80%" border=1>
<CAPTION><A name=wp1014574></A>
<P class=pTC_TableCap>Table D-1 Default Configuration for the
AuthenticationFailed RTMT Alert </P></CAPTION>
<TBODY>
<TR vAlign=bottom align=left>
<TH scope=col><A name=wp1014578></A>
<DIV class=pCH1_CellHead1>Value </DIV></TH>
<TH scope=col><A name=wp1014580></A>
<DIV class=pCH1_CellHead1>Default Configuration </DIV></TH></TR>
<TR vAlign=top align=left>
<TD><A name=wp1014582></A>
<P class=pB1_Body1>Enable Alert </P></TD>
<TD><A name=wp1014584></A>
<P class=pB1_Body1>Selected </P></TD></TR>
<TR vAlign=top align=left>
<TD><A name=wp1014586></A>
<P class=pB1_Body1>Severity </P></TD>
<TD><A name=wp1014588></A>
<P class=pB1_Body1>Critical </P></TD></TR>
<TR vAlign=top align=left>
<TD><A name=wp1024208></A>
<P class=pB1_Body1>Enable/Disable this alert on the following servers
</P></TD>
<TD><A name=wp1024210></A>
<P class=pB1_Body1>Enabled on listed servers </P></TD></TR>
<TR vAlign=top align=left>
<TD><A name=wp1014590></A>
<P class=pB1_Body1>Threshold </P></TD>
<TD><A name=wp1014592></A>
<P class=pB1_Body1>Number of AuthenticationFailed events exceeds: </P><A
name=wp1014763></A>
<P class=pB2_Body2>1 time in the last 1 minute </P></TD></TR>
<TR vAlign=top align=left>
<TD><A name=wp1014594></A>
<P class=pB1_Body1>Duration </P></TD>
<TD><A name=wp1014596></A>
<P class=pB1_Body1>Trigger alert immediately </P></TD></TR>
<TR vAlign=top align=left>
<TD><A name=wp1014598></A>
<P class=pB1_Body1>Frequency </P></TD>
<TD><A name=wp1014600></A>
<P class=pB1_Body1>Trigger alert on every poll </P></TD></TR>
<TR vAlign=top align=left>
<TD><A name=wp1014602></A>
<P class=pB1_Body1>Schedule </P></TD>
<TD><A name=wp1014604></A>
<P class=pB1_Body1>24 hours daily </P></TD></TR>
<TR vAlign=top align=left>
<TD><A name=wp1014606></A>
<P class=pB1_Body1>Enable Email </P></TD>
<TD><A name=wp1014608></A>
<P class=pB1_Body1>Selected </P></TD></TR>
<TR vAlign=top align=left>
<TD><A name=wp1025267></A>
<P class=pB1_Body1>Trigger Alert Action </P></TD>
<TD><A name=wp1025269></A>
<P class=pB1_Body1>Default
</P></TD></TR></TBODY></TABLE></DIV></SPAN></FONT></DIV>
<DIV align=left><FONT face=Arial size=2></FONT> </DIV>
<DIV align=left><FONT face=Arial size=2>Tim Reimers</FONT></DIV>
<DIV align=left><FONT face=Arial size=2>Systems Analyst II</FONT></DIV>
<DIV align=left><FONT face=Arial size=2>Information Technology
Services</FONT></DIV>
<DIV align=left><FONT face=Arial size=2>City of Asheville</FONT></DIV>
<DIV align=left><FONT face=Arial size=2>70 Court Plaza</FONT></DIV>
<DIV align=left><FONT face=Arial size=2>Asheville, NC 28801</FONT></DIV>
<DIV align=left><FONT face=Arial size=2>phone - 828-259-5512</FONT></DIV>
<DIV align=left><FONT face=Arial size=2><A
href="mailto:timreimers@ashevillenc.gov">treimers@ashevillenc.gov</A></FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV></BODY></HTML>