Active IQ Unified Manager (AIQUM) EMS Subscription not Working

Last updated
Save as PDF
Share
1. Share
2. Tweet
3. Share

Views:: 302

Visibility:: Public

Votes:: 0

Category:: active-iq-unified-manager

Specialty:: om

Last Updated:

Applies to

Active IQ Unified Manager (AIQUM)
ONTAP 9

Issue

The EMS (Event Management System) subscription feature in Active IQ Unified Manager (AIQUM) is not functioning as expected. The cluster operational state is shown as failed in AIQUM on an OVA deployment.

AIQUM--> ocum-error.log :

2025-05-29 10:22:01,923 ERROR [t1user] [default task-2318] [service.ems.SubscribeEmsDataAccessService|validateAndSave] [c.n.d.o.o.s.z.OntapEmsZapiService] EMS Configuration Check failed with error Authentication to Storage System ClusterB.mycompany.com.cn as user null failed.  Response code: 403

2025-05-29 10:24:03,864 ERROR [t1user] [default task-2317] [service.ems.SubscribeEmsDataAccessService|validateAndSave] [c.n.dfm.impl.ems.EMSConfigureUtil] Failed to Configure EMS for Cluster ClusterB

2025-05-29 12:00:54,033 ERROR [oncommand] [collection-completion-sync-3] [c.n.d.o.o.s.z.OntapEmsZapiService] EMS Configuration Check failed with error Authentication to Storage System ClusterB.mycompany.com.cn as user null failed.  Response code: 403

2025-05-29 12:00:54,045 ERROR [oncommand] [collection-completion-sync-3] [c.n.dfm.impl.ems.EMSConfigureUtil] Failed to Configure EMS for Cluster ClusterB

AIQUM--> zapi-outbound.log :

2025-05-29 10:38:20,936 DEBUG [default task-2335] [service.ems.SubscribeEmsDataAccessService|validateAndSave] apiFamily should be specified when using TargetType.FILER - invoking ZAPIs with @scope tags will fail

2025-05-29 10:38:20,944 DEBUG [default task-2335] [service.ems.SubscribeEmsDataAccessService|validateAndSave] Executing ZAPI request ems-destination-get to ClusterB.mycompany.com.cn:

<?xml version='1.0' encoding='UTF-8'?><!DOCTYPE netapp SYSTEM 'file:/etc/netapp_filer.dtd'><netapp xmlns="http://www.netapp.com/filer/admin" version="1.0" originator_id="AIQ_UM:t1user"><ems-destination-get><name>aiq.mycompany.com.cn</name></ems-destination-get></netapp>

2025-05-29 10:45:54,005 DEBUG [collection-completion-sync-0] apiFamily should be specified when using TargetType.FILER - invoking ZAPIs with @scope tags will fail

ONTAP--> AUDIT-MLOG-TXT.GZ :

00000017.0017d75c 01893289 Thu May 29 2025 10:38:20 +08:00 [kern_audit:info:10802] 8503e80000011dea :: ClusterB:ontapi :: 1.1.1.2:50380 :: ClusterB:aiquser :: POST /servlets/netapp.servlets.admin.XMLrequest_filer HTTP/1.1 :: Error: 403 Forbidden

Cause

The issue is caused by insufficient user permissions.

The "t1user" account used for EMS subscription lacked the required cluster administrative privileges and without ontapi application to authenticate with the storage system.

ONTAP Cluster B-->USERPROFILE.XML :

Vserver User Name or Group Name Application Authentication Method Role Name Whether Ns-switch Group Second Authentication Method LDAP Fastbind Authentication

ClusterB admin amqp password admin no none no

ClusterB admin console password admin no none no

ClusterB admin  http password admin no none no

ClusterB admin ontapi password admin no none no

ClusterB admin service-processor password admin no none no

ClusterB admin ssh password admin no none no

ClusterB aiquser console password readonly no none no

ClusterB aiquser  http password admin no none no

ClusterB aiquser ontapi password admin no none no

ClusterB aiquser ssh password admin no none no

ClusterB autosupport console password autosupport no none no

ClusterB clus-agent-0hnc  http password readonly no none no

vs1 t1user ssh password itsc_admin no totp no

vs1 vsadmin  http password vsadmin no none no

vs1 vsadmin ontapi password vsadmin no none no

vs1 vsadmin ssh password vsadmin no none no

vs2 vsadmin  http password vsadmin no none no

vs2 vsadmin ontapi password vsadmin no none no

vs2 vsadmin ssh password vsadmin no none no

vs3 vsadmin  http password vsadmin no none no

vs3 vsadmin ontapi password vsadmin no none no

vs3 vsadmin ssh password vsadmin no none no

vs4 t1user ssh password itsc-admin no totp no

vs4 vsadmin  http password vsadmin no none no

vs4 vsadmin ontapi password vsadmin no none no

vs4 vsadmin ssh password vsadmin no none no

Solution

Edit the cluster in Cluster Setup using the steps from the ActiveIQ Unified Manager documentation: Edit clusters
As outlined in the Add Cluster documentation this user account must have the admin role with Application access set to ontapi, console, and http.

Partner Notes

partnerNotes_text

Additional Information

additionalInformation_text

Internal Notes

internalNotes_text