We upgraded our Call Manager from 4.1(3) to 4.2(3) a couple of weeks ago. The Event Logs for both the subscriber and publisher filled up with the following messages and kept repeating constantly:
Event Type: Information
Event Source: Cisco Multi-Level Administration
Event Category: None
Event ID: 1
Date: 11/29/2007
Time: 2:40:46 PM
User: N/A
Computer: CALLMANAGER02
Description:
Information: MLAUserLoginFailed - Failed login attempt for MLA user account.
IP Address/Hostname of host attempting to login: 192.168.1.123
Date and Time when the failed login is attempted: Thu Nov 29 14:40:46 2007
User ID that experienced a failed login attempt: administrator
App ID: Cisco Multi-Level Administration
Cluster ID:
Node ID: CALLMANAGER02
Explanation: Failed login attempt for MLA account is detected.
Recommended Action: If this event happens repeatedly, investigate the source of the failed login attempts.
The IP address of the machine attempting this login is our primary PIM ICM server and has CAD. This ICM server had it's Event log filled up with the following message:
Event Type: Error
Event Source: Cisco VoIP Monitor Service
Event Category: None
Event ID: 4
Date: 11/29/2007
Time: 3:37:16 PM
User: N/A
Computer: PIMICM03
Description:
FCVMS0001 Could not get the MAC address for extension [6328] from the
CallManager database.
I managed to stop all these "events" on all three servers by creating a user account in the Call Manager called "administrator" and matched the password with the local administrator account of the Call Manager server.
Has anyone else experienced this? Is this the right solution? I don't recall seeing anything in the installation/upgrade documentation that requires creating a user account in the LDAP called "administrator".
