topic Re: VServer: security.invalid.login [ALERT] in ONTAP Discussions

VServer: security.invalid.login [ALERT]

sroy — Wed, 04 Jun 2025 11:11:26 GMT

Hello,

I just recently upgraded from 8.3.2 to 9.1P20 and started to see these alert messages being sent.

Message: security.invalid.login: Failed to authenticate login attempt to Vserver: <Name>, username: admin, application: ontapi.

Description: This message occurs when an attempt is made to access the appliance by using invalid authentication credentials.

I'm sure there was a change in the upgrade, however how do I narrow down what's causing this issue?

Re: VServer: security.invalid.login [ALERT]

Ontapforrum — Thu, 30 Apr 2020 09:37:02 GMT

Hi,

This is a very generic error which simply means 'An attempt is made to access the appliance by using invalid authentication credentials'.

1) Could be someone is attempting to access cluster using wrong credentials.
2) Could be someone changed the Cluster password, and/or someone or any NetApp/third-party Plug-in is still trying to access using old credentials. As you said, filer are upgraded (switched cluster?, is ontapi trying to access anything) so possibilities could be a lot.

Try '-instance' switch, see if it gives any further info:
::> event log show -message-name *security* -instance

Check the pattern (event time), is it doing at certain hour/minute or it's random.

If event log does not give much in-roads, then go to cluster logs:

https:<clust_mgmt_LIF>/spi/<node>/etc/log/mlog/

look for "mgwd" logs, open the log for the corresponding date/time since it's been generating. Go to specific date/time event and see why is it complaining. Once you get a clue, you can work accordingly.

Thanks!

Re: VServer: security.invalid.login [ALERT]

paul_stejskal — Thu, 30 Apr 2020 14:48:02 GMT

The output should have the source IP if I recall correctly.

Re: VServer: security.invalid.login [ALERT]

sroy — Thu, 30 Apr 2020 18:38:59 GMT

I found the host responsible for the event alerts.

Thanks for pointing me in the right direction.

Re: VServer: security.invalid.login [ALERT]

RickVR — Tue, 01 Mar 2022 20:39:32 GMT

How do I see the offending client?

Re: VServer: security.invalid.login [ALERT]

paul_stejskal — Tue, 01 Mar 2022 20:48:21 GMT

If you really need to, get a tcpdump then look to see when the issue is captured. https://kb.netapp.com/Advice_and_Troubleshooting/Data_Storage_Software/ONTAP_OS/How_to_capture_packet_traces_(tcpdump)_on_ONTAP_9.2__systems