由于维护帐户锁定，AIQUM 无法将警报转发到 Splunk

最后更新
另存为PDF

Views:: 6

Visibility:: Public

Votes:: 0

Category:: active-iq-unified-manager

Specialty:: om

Last Updated:

适用于

Active IQ Unified Manager (AIQUM) 9.X+
配置为运行外部脚本的 AIQUM
所有 OS 平台

问题

AIQUM 间歇性地无法将警报转发到 Splunk 服务器，导致错过关键通知。
AIQUM 捕获事件，但不按预期转发它们。
重新启动 AIQUM 实例可暂时解决此问题，但该问题会在运行几天后再次发生。
即使 AIQUM 将事件显示为活动状态，Splunk 也未收到警报。
维护帐户被锁定。

日志中可能出现的消息：

WARN [ScriptExecutor-7] c.n.u.s.s.AuthenticationUtils(AuthenticationUtils.java:65) - Exception while sending a login request. 500 Internal Server Error: "ActiveIQ Unified Manager|Error Error 500 - Internal Server Error Please go back to the homepage and try again.". UM commands in the script file might fail to execute.INFO [ScriptExecutor-4] c.n.u.s.s.AlertScriptService(AlertScriptService.java:79) - Executing the script file with a null session idINFO [ScriptExecutor-4] c.n.u.s.s.AlertScriptService(AlertScriptService.java:108) - Script execution of file: netapp_splunk_forwarder.sh for EventID:208559 in progress..

RbacUserManager: Account locked due to too many failed authentication attempts