Detected an unauthorized user attempting to access the SNMP interface from 172.xxx.xxx.xxx

[mtsoukalas]

Hi, we recently bought two (2) APC SRT5000 UPS devices. The two devices have NMC on them. For two hours now, the one UPS sends me loads of emails with (false I guess) warnings that say "Detected an unauthorized user attempting to access the SNMP interface from 172.xxx.xxx.xxx - various IPs -"

The IPs are from user's PCs and Im sure that nobody tried to log in to the Management Card of this UPS. 

Can you please help me figure out what is going on? The computers on our company, are Windows 10 machines. Maybe is the Network Discovery Service? 

Thank you, I'll appreciate any help from you. I receive loads of emails (!) 

Thank you.

[BillP]

@mtsoukalas 

What firmware is on the network card and what model is the card?

[mtsoukalas]

Hi @BillP !

The firmware revision is "UPS 04.0 (ID1013)". The UPS model is  Smart-UPS SRT 5000 (SKU : SRT5KXLI).

[BillP]

@mtsoukalas 

That is the UPS firmware. What firmware is on the network card and what model is it? 

You will find that information by login into the network card, go to About, Network 

[mtsoukalas]

oh sorry, my bad.

Model Number: AP9537SUM

Application Module : Version: v6.2.0

APC Boot Monitor : Version: v1.0.8

[BillP]

@mtsoukalas 

Log into the card and go to Configuration, Notification, Event Actions, By Event, Security. Click on Detected an unauthorized user attempting to access the SNMP interface, and remove e-mail recipients. You can also deselect log if you do not want the events logged.

[mtsoukalas]

Thank you, thank you, thank you. 

That did the trick!

Thanks. 👍