Keep getting a warning in Server log says "Failed to log in"

We have managed to get rid of the error...finally by removing the data store from the host ags server and re-installing the data store on the server and then re-adding it to the host server. All of the errors are now gone.

Data Store shouldn't store the PSA credentials as Server supports those credentials changing. It should establish a trust between itself and the Server. I think it's best to reach out to Support and describe the behavior to see if they can reproduce it.

EricPeña

Same here... I turned off the ArcGIS Data Store service for a while just to confirm, and sure enough the login errors stopped. I started it back up and Relational and Tile Cache Data Stores validated in Server Manager just fine, but the login errors came back with original PSA enabled. Everything else seems to be working, so this may be an error that I'll just have to ignore for now.

ClintonBallandis1

Hi all,

I'm still getting a failed login every 5 mins. I decided to change the ArcGIS Server PSA account in Server Manager to a new user name and password. However I'm still getting log in attempts on the old PSA account username. By chance I tried to validate my datastores they all validated successfully in server manager returning green ticks. However when I checked my server logs I have 2 failed login attempts at the same time. The first is an attempt by the datastore to generate a token using the server machine name url on port 6443 not the webadaptor domain. The second is the standard login failure I'm getting. Jonathan Quinn could the issue be with the datastore trying to use the ArcGIS Server PSA account (I used this as the administrator account when I configured the datastore) Seems like everything was ok when the PSA account was enabled because the datastore could use the credentials to login ?

Thanks,

Clinton

EricPeña

I get this error every 5 minutes. I suspect this is coming from Web Adaptor's regular polling of the server site (see here at 2nd paragraph). I tried several things to no avail. Changing Primary Site Admin account credentials, enabling Web Adaptor admin access, and re-configuring Web Adaptor didn't fix the login error. This may be a bug in 10.6.1.

Following our production upgrade issue, I set up an identical environment to prod on dev and modify etc/hosts entries to be able to restore webgisdr backup made before this upgrade as webgisdr was failing on production after the upgrade issue. I performed the upgrade to 10.7 on this dev environment and exported another 10.7 webgisdr backup. I then recreated all our production machines, installed directly 10.7, and import the webgisdr 10.7 backup. It worked ! What a relief !

For another reason I recreated dev environement and the errors were gone right after (I checked the manager logs). So these requests must have come from the dev environment. Thinking about it afterward, I think I may had reverted to the original etc/hosts file on dev without updating the portal urls (webContextUrl, private portal url). I am not 100% sure as the file was gone but I think it would make sense, wouldn't it ?

I created a new dev environment to match that of our Prod and then used the backup from server to do a ‘restore’ one the new machine. I had not done any edits to the ‘etc\hosts’

The test server is now gone but the error is still occurring. It looks like it started before this event at any rate.

Diane E. McGuerty

Applications Analyst - GIS

Information Technology

How can IT help you today?

NOTE: EMAIL ADDRESS HAS CHANGED

3299 Tamiami Trail East	Suite 600	Naples, FL 34112-5749
Phone: 239.252.6014	Cell: 239-315-1576	Fax: 239.252.6304

image001.jpg

Can you expand on this a bit? So you had your prod environment and you then set up another machine, edited the etc\hosts file to match the prod URLs, installed and configured the software. Then you took a backup from prod and restored it to dev, then the error started appearing in prod? Once you deleted the dev environment, the errors went away?

Thanks I’ll check it out. I had done a restore from backup to a new dev environment using the utilities on server. The dev site has been removed now.

Diane E. McGuerty

Applications Analyst - GIS

Information Technology

How can IT help you today?

NOTE: EMAIL ADDRESS HAS CHANGED

3299 Tamiami Trail East	Suite 600	Naples, FL 34112-5749
Phone: 239.252.6014	Cell: 239-315-1576	Fax: 239.252.6304

image001.jpg

https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/migrate-to-a-new-machine-in-arcgis-enterprise-two/

Do you have by any chance a second ArcGIS Enterprise deployment on which you have played with the etc/hosts file a bit like it is described on this article ?:

I believe it was my issue : I had played with this file to import production data in dev environment. After destroying my dev deployment, these errors disappeared.

We are having the exact same error on AGS 10.6.1 This was a fresh install and not an upgrade from 10.5

7716

CRITICAL

Failed to log in. Invalid username 'acdb7674-26a6-4b53-8213-6aeae1c193ed' or password specified.

I do note the error code as '7716' - JMX-RMI port?

7716	Could not start RMI connector. An instance of Node Agent may be running or the JMX-RMI port is in use by another process.

ClintonBallandis1

Hi,

I have a similar issue, I am getting a failed login attempt ever 5 mins using the Primary Site Account on Server 10.6.1 These failed login attempt seem to have started since we upgraded to from Enterprise 10.5 to 10.6.1 when I subsequently disabled the PSA account as per the security the recommendations. I've checked the IIS logs as suggested by Jonathan Quinn and can't see anything that corresponds to the time these requests are taking place making me think that they aren't external?

I'm assuming that these requests are therefore an internal arcgis server process however I'm not sure how I track this down to resolve

Did anyone Nicolas GIS manage resolve these failed login or workout where they are originating from?

Thanks,

Clinton

https://community.esri.com/ideas/16794-include-client-ip-or-x-forwarded-for-ip-in-arcgis-server-logs

Thanks for the reply Jonathan Quinn‌.

I just created the idea:

Unfortunately, I never managed to make wireshark works with HTTPS...

First, I suggest you log an idea on the Ideas site to include Client IP or X-Forwarded-For IP within the queryable columns:

That way, you can determine who is making requests to your Server via supported means.

The only other approach is to use Wireshark or configure access logs within Server's tomcat, which is unsupported.

Hello Jonathan Quinn‌,

I have the same issue with my hosting ArcGIS Server : every 5 minutes the same error is logged. I am pretty sure it is neither a script nor a user. Everything else is working fine... I can validate the hosting ArcGIS Server from Portal for ArcGIS without any issue.

Any idea from which component it could come from ? The requests are not made through the webadaptor so nothing is logged on IIS.

ArcGIS Server Manager logging error

Cheers

Anonymous User

One thing we've found is that some of our users think they can script and will write a python script with a never-ending try/for/while loop that uses bad / unnecessary credentials. Depending on your scripts and your users, this might be something to check out too!