ALERT! The community will be read-only starting on April 19, 8am Pacific as the migration begins. Read more for important details.
ALERT! The community will be read-only starting on April 19, 8am Pacific as the migration begins.Read more for important details.
Absent Member.
Absent Member.
1309 views

How to find Password Authentication Errors in the log files

I have gwmonitor configured using the xml file and I invariably get notification on gwiapop3BadPassword after a couple of weeks.

I login to the gwia and see that the Password Authentication Errors in POP3 is huge.

I am sure it is just a couple of users that have wrong passwords and would like to follow up, but I can't find the corresponding info in the log files.
Labels (1)
0 Likes
6 Replies
Micro Focus Expert
Micro Focus Expert

Hi,

Have you set your GWIA logs to verbose?

Cheers,
Laura Buckley

Views/comments expressed here are entirely my own.
If you find this post helpful, please show your appreciation and click on "Like" below...
0 Likes
Absent Member.
Absent Member.

laurabuckley;2456449 wrote:
Hi,

Have you set your GWIA logs to verbose?

Cheers,


Yes they are on verbose.
The question is what do I put in the log file filter that will bring up the records that cause the monitor to report Password authentication issues?

On my GWIA status screen, I have

Password Authentication Errors 3025
When I rolled the log yesterday it was 2993 so there should be 32 lines in the log file referring to this error.

I have tried to filter on password, error, authent, deny, none of these bring up anything.
0 Likes
Micro Focus Expert
Micro Focus Expert

Hi,

Okay, so I've tested this and can confirm that even with the log level set to Diagnostic on both the GWIA and POA I'm not seeing errors when entering the incorrect password on POP3 attempts.

The fact that the number of failed attempts is so high, in my humble opinion, could be indicative of a brute force hack attempt to guess passwords. It could be as simple as a "saved password" that has not been changed when the user in question did indeed change their password.

What you could do is enable intruder detection on your POP3 service on your GWIA and see who complains.

Please let us know how it goes.

Cheers,
Laura Buckley

Views/comments expressed here are entirely my own.
If you find this post helpful, please show your appreciation and click on "Like" below...
0 Likes
Micro Focus Expert
Micro Focus Expert

Hi,

Just FYI... I'm making some enquiries as to whether or not the failed login attempts should appear in the log files.

Cheers,
Laura Buckley

Views/comments expressed here are entirely my own.
If you find this post helpful, please show your appreciation and click on "Like" below...
0 Likes
Absent Member.
Absent Member.

laurabuckley;2456651 wrote:
Hi,

Just FYI... I'm making some enquiries as to whether or not the failed login attempts should appear in the log files.

Cheers,


Thanks, I will wait to hear from you before opening an SR
0 Likes
Micro Focus Expert
Micro Focus Expert

Hi,

A defect has been logged for this - Bug 1037728. Micro Focus engineers are now aware of this and can work on resolving it.

Cheers,
Laura Buckley

Views/comments expressed here are entirely my own.
If you find this post helpful, please show your appreciation and click on "Like" below...
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.