Highlighted
Absent Member.
Absent Member.
1144 views

Interpreting Monitor alerts

I have my monitor setup with several thresholds.

And I am getting
gwiapop3BadPassword
gwiapop3UnknownUsers

notifications.

I would like to followup and see further details about these MIB captures but I can't find anything relating to them in the log files.

Where do I go what do I filter on.

Thanks
Labels (2)
0 Likes
3 Replies
Highlighted
Micro Focus Expert
Micro Focus Expert

Re: Interpreting Monitor alerts

Hi,

Are your GWIA logs set to verbose?

Cheers,
Laura Buckley

Views/comments expressed here are entirely my own.
If you find this post helpful, please show your appreciation and click on "Like" below...
0 Likes
Highlighted
Absent Member.
Absent Member.

Re: Interpreting Monitor alerts

Thanks for the quick response.

Yes they are set to verbose.

I think I found the user narrowing it down by time, but it would be better if I knew for sure, what the alert was referring to.
Also I can't figure out how to turn off the notices without increasing the threshold for these items.
0 Likes
Highlighted
Micro Focus Expert
Micro Focus Expert

Re: Interpreting Monitor alerts

Hi,

From what I understand...

gwiapop3BadPassword - count of incorrect passwords entered for a pop3 account being accessed via your GWIA

gwiapop3UnknownUsers - count of unknown usernames being used to login to a pop3 account being accessed via your GWIA

Now, there are two possibilites... either you have users who don't know their username/password, or something more sinister like an external person trying to guess usernames and passwords against your system! Using your GWIA verbose logs you should be able to figure out which one it is.

Let us know how it goes.

Cheers,
Laura Buckley

Views/comments expressed here are entirely my own.
If you find this post helpful, please show your appreciation and click on "Like" below...
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.