ONTAP Discussions

VServer: security.invalid.login [ALERT]

sroy
10,665 Views

Hello, 

 

I just recently upgraded from 8.3.2 to 9.1P20 and started to see these alert messages being sent. 

 

Message: security.invalid.login: Failed to authenticate login attempt to Vserver: <Name>, username: admin, application: ontapi.

 

Description: This message occurs when an attempt is made to access the appliance by using invalid authentication credentials.


I'm sure there was a change in the upgrade, however how do I narrow down what's causing this issue? 

1 ACCEPTED SOLUTION

Ontapforrum
10,633 Views

Hi,

 

This is a very generic error which simply means 'An attempt is made to access the appliance by using invalid authentication credentials'.

 

1) Could be someone is attempting to access cluster using wrong credentials.
2) Could be someone changed the Cluster password, and/or someone or any NetApp/third-party Plug-in is still trying to access using old credentials. As you said, filer are upgraded (switched cluster?, is ontapi trying to access anything) so possibilities could be a lot.

 

Try '-instance' switch, see if it gives any further info:
::> event log show -message-name *security* -instance

Check the pattern (event time), is it doing at certain hour/minute or it's random.


If event log does not give much in-roads, then go to cluster logs:

https:<clust_mgmt_LIF>/spi/<node>/etc/log/mlog/

 

look for "mgwd" logs, open the log for the corresponding date/time since it's been generating. Go to specific date/time event and see why is it complaining. Once you get a clue, you can work accordingly.

 

Thanks!

View solution in original post

5 REPLIES 5

Ontapforrum
10,634 Views

Hi,

 

This is a very generic error which simply means 'An attempt is made to access the appliance by using invalid authentication credentials'.

 

1) Could be someone is attempting to access cluster using wrong credentials.
2) Could be someone changed the Cluster password, and/or someone or any NetApp/third-party Plug-in is still trying to access using old credentials. As you said, filer are upgraded (switched cluster?, is ontapi trying to access anything) so possibilities could be a lot.

 

Try '-instance' switch, see if it gives any further info:
::> event log show -message-name *security* -instance

Check the pattern (event time), is it doing at certain hour/minute or it's random.


If event log does not give much in-roads, then go to cluster logs:

https:<clust_mgmt_LIF>/spi/<node>/etc/log/mlog/

 

look for "mgwd" logs, open the log for the corresponding date/time since it's been generating. Go to specific date/time event and see why is it complaining. Once you get a clue, you can work accordingly.

 

Thanks!

paul_stejskal
10,615 Views

The output should have the source IP if I recall correctly.

sroy
10,587 Views

I found the host responsible for the event alerts. 

 

Thanks for pointing me in the right direction. 

RickVR
7,203 Views

How do I see the offending client?

paul_stejskal
7,200 Views
Public