I have been looking for a bad login issue for a while now and think I have traced it back to a vCOPs weekly report.
Basically, we use Veeam ONE and it alerts every Monday at 8:00 AM about a bad login attempt. It reports the bad login as coming from our vCOPs UI VM.
Based on the schedule I assumed it was a scheduled task of some sort. I ended up searching the ciq.log for the bad login account and found it;
[pool-3-thread-1] INFO com.vmware.cm.reportschedule.manager.impl.ReportScheduledExecutionManagerImpl 2013-07-22 08:00:00,295-0400 - Submitted scheduled report.
reportScheduleId: 1
reportId: 41
inventoryObjectReference: IOR - uid = 0 aliveId = 8 moid = group-d0 type = WORLD
reportSettingId: 7
userIdentity: UserIdentity [username=domain\user]
[pool-2-thread-1] ERROR com.vmware.cm.report.manager.runner.ReportRunner 2013-07-22 08:00:07,619-0400 - run: ReportRunInfo [inventoryObjectReference=IOR - uid = 0 aliveId = 8 moid = group-d0 type = WORLD, reportId=41, reportSettingId=7, userIdentity=UserIdentity [username=domain\user]]
got an exception while generating reports = org.springframework.security.BadCredentialsException: Invalid user: domain\user
exception backtrace = org.springframework.security.BadCredentialsException: Invalid user: domain\user
com.vmware.vcops.api.security.VCOpsSpringAuthenticationProvider.authenticate(VCOpsSpringAuthenticationProvider.java:59)
com.vmware.cm.core.manager.impl.WebSessionImpersonator.createUserSession(WebSessionImpersonator.java:64)
com.vmware.cm.report.manager.runner.ReportRunner.login(ReportRunner.java:284)
com.vmware.cm.report.manager.runner.ReportRunner.initRequestAttributes(ReportRunner.java:247)
com.vmware.cm.report.manager.runner.ReportRunner.run(ReportRunner.java:135)
I also used this website to search for all sched reports;
http://www.jume.nl/entry/vcops-show-all-scheduled-reports
It found one report scheduled with the same user cred.
The problem is I can't seem to find the report when I go into vCOPs. I have also reset the password for the invalid account, logged in with that account and still can't see the report.
How do I find and delete this scheduled report.
BTW, I am running vCOPs 5.6.0