ESXi host disconnects from vCenter Server with Dell iDRAC Event USR0034 due to OMEVV lockout

Products

• VMware vSphere ESXi 8.0
• VMware vSphere ESXi

Issue/Introduction

An ESXi host becomes entirely unresponsive and disconnects from VMware vCenter Server following a credential modification in the Dell OpenManage Enterprise Integration for VMware vCenter (OMEVV) plugin.

The vCenter Event logs display hardware-level alerts from the host's Dell iDRAC indicating a brute-force protection lockout triggered by invalid Redfish API logins: Dell - MessageId: USR0034. Message: Description: Login attempt alert for <EMAIL_REDACTED> from <IP_REDACTED> using RED FISH, IP will be blocked for 60 seconds. - System Display Name: iDRAC - System Service Tag: <SERVICE_TAG_REDACTED> - FQDN: <HOSTNAME_REDACTED>

Environment

 

• VMware ESXi 8.x,9.x

• Dell OpenManage Enterprise Integration for VMware vCenter (OMEVV)

 

Cause

The credential update within the OMEVV plugin utilized an incorrect or locked password for the service account (<EMAIL_REDACTED>). Because OMEVV continuously polls the hardware inventory, it floods the ESXi host's iDRAC with invalid Redfish API authentication requests. The iDRAC responds by triggering its security protocols (Event USR0034), blocking the OMEVV appliance IP (<IP_REDACTED>).

As local ESXi hardware providers (such as PTAgent and iSM) and the management agents attempt to query the now-locked/unresponsive iDRAC, the polling queries time out. This continuous loop of timeouts rapidly exhausts the ESXi host's hostd worker threads. Once the hostd thread pool is starved, the host becomes unresponsive and disconnects from vCenter.

Resolution

1. Navigate to the OMEVV Plugin in vCenter and update the configuration with the correct, validated password for the <EMAIL_REDACTED> service account.

2. Wait a minimum of 60 seconds for the iDRAC brute-force IP block timer to automatically expire.

3. Connect to the affected ESXi host via SSH or the DCUI and restart all management services to forcefully clear the hung worker threads:

   services.sh restart
   

 

Additional Information

Dell documentation states that the USR0034 error code indicates login attempt failures: "The account identified in the message is temporarily disabled because of consecutive unsuccessful Login attempts to iDRAC from the IP address identified in the message."

Reference: Dell iDRAC9 Security Configuration Guide - Security events lifecycle log

If further support is required for this service account or the iDRAC behavior, contact Dell Support.