topic Re: Keep getting a warning in Server log says "Failed to log in" in ArcGIS Enterprise Questions

Keep getting a warning in Server log says "Failed to log in"

QiranLiang — Fri, 18 May 2018 00:28:02 GMT

I keep getting this warning that said "Failed to log in. Invalid username or password specified." Although during that time nobody is trying to login at all.

This warning will appears every 5 seconds or so and it never stop. Anyone have any idea why it happens?

Re: Keep getting a warning in Server log says "Failed to log in"

JonathanQuinn — Fri, 18 May 2018 21:11:15 GMT

You'll need to do a bit of digging outside of the Server. Check the logs on whatever is in front of the Server, (web adaptor or reverse proxy). If you're using the web adaptor, the IIS logs will have the IP address of where the request originated. If it's an internal, then you have something/someone to check on. If it's external, you may have to block the IP address.

Re: Keep getting a warning in Server log says "Failed to log in"

Anonymous User — Thu, 07 Jun 2018 12:57:48 GMT

One thing we've found is that some of our users think they can script and will write a python script with a never-ending try/for/while loop that uses bad / unnecessary credentials. Depending on your scripts and your users, this might be something to check out too!

Re: Keep getting a warning in Server log says "Failed to log in"

NicolasGIS — Sun, 02 Jun 2019 08:55:35 GMT

Hello Jonathan Quinn‌,

I have the same issue with my hosting ArcGIS Server : every 5 minutes the same error is logged. I am pretty sure it is neither a script nor a user. Everything else is working fine... I can validate the hosting ArcGIS Server from Portal for ArcGIS without any issue.

Any idea from which component it could come from ? The requests are not made through the webadaptor so nothing is logged on IIS.

Cheers

Re: Keep getting a warning in Server log says "Failed to log in"

JonathanQuinn — Tue, 04 Jun 2019 18:04:36 GMT

First, I suggest you log an idea on the Ideas site to include Client IP or X-Forwarded-For IP within the queryable columns:

That way, you can determine who is making requests to your Server via supported means.

The only other approach is to use Wireshark or configure access logs within Server's tomcat, which is unsupported.

Re: Keep getting a warning in Server log says "Failed to log in"

NicolasGIS — Mon, 10 Jun 2019 06:53:55 GMT

Thanks for the reply Jonathan Quinn‌.

I just created the idea:

https://community.esri.com/ideas/16794-include-client-ip-or-x-forwarded-for-ip-in-arcgis-server-logs

Unfortunately, I never managed to make wireshark works with HTTPS...

Re: Keep getting a warning in Server log says "Failed to log in"

ClintonBallandis1 — Tue, 18 Jun 2019 01:44:26 GMT

Hi,

I have a similar issue, I am getting a failed login attempt ever 5 mins using the Primary Site Account on Server 10.6.1 These failed login attempt seem to have started since we upgraded to from Enterprise 10.5 to 10.6.1 when I subsequently disabled the PSA account as per the security the recommendations. I've checked the IIS logs as suggested by Jonathan Quinn and can't see anything that corresponds to the time these requests are taking place making me think that they aren't external?

I'm assuming that these requests are therefore an internal arcgis server process however I'm not sure how I track this down to resolve

Did anyone @ Nicolas GIS manage resolve these failed login or workout where they are originating from?

Thanks,

Clinton

Re: Keep getting a warning in Server log says "Failed to log in"

DianeMcGuerty1 — Thu, 20 Jun 2019 14:20:29 GMT

We are having the exact same error on AGS 10.6.1 This was a fresh install and not an upgrade from 10.5

7716

CRITICAL

Failed to log in. Invalid username 'acdb7674-26a6-4b53-8213-6aeae1c193ed' or password specified.

I do note the error code as '7716' - JMX-RMI port?

7716	Could not start RMI connector. An instance of Node Agent may be running or the JMX-RMI port is in use by another process.

Re: Keep getting a warning in Server log says "Failed to log in"

NicolasGIS — Thu, 20 Jun 2019 14:29:56 GMT

Do you have by any chance a second ArcGIS Enterprise deployment on which you have played with the etc/hosts file a bit like it is described on this article ?:

https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/migrate-to-a-new-machine-in-arcgis-enterprise-two/

I believe it was my issue : I had played with this file to import production data in dev environment. After destroying my dev deployment, these errors disappeared.

Re: Keep getting a warning in Server log says "Failed to log in"

DianeMcGuerty1 — Thu, 20 Jun 2019 14:35:20 GMT

Thanks I’ll check it out. I had done a restore from backup to a new dev environment using the utilities on server. The dev site has been removed now.

Diane E. McGuerty

Applications Analyst - GIS

Information Technology

How can IT help you today?

NOTE: EMAIL ADDRESS HAS CHANGED

3299 Tamiami Trail East	Suite 600	Naples, FL 34112-5749
Phone: 239.252.6014	Cell: 239-315-1576	Fax: 239.252.6304

Re: Keep getting a warning in Server log says "Failed to log in"

JonathanQuinn — Thu, 20 Jun 2019 18:05:37 GMT

Can you expand on this a bit? So you had your prod environment and you then set up another machine, edited the etc\hosts file to match the prod URLs, installed and configured the software. Then you took a backup from prod and restored it to dev, then the error started appearing in prod? Once you deleted the dev environment, the errors went away?

Re: Keep getting a warning in Server log says "Failed to log in"

DianeMcGuerty1 — Thu, 20 Jun 2019 18:21:33 GMT

I created a new dev environment to match that of our Prod and then used the backup from server to do a ‘restore’ one the new machine. I had not done any edits to the ‘etc\hosts’

The test server is now gone but the error is still occurring. It looks like it started before this event at any rate.

Diane E. McGuerty

Applications Analyst - GIS

Information Technology

How can IT help you today?

NOTE: EMAIL ADDRESS HAS CHANGED

3299 Tamiami Trail East	Suite 600	Naples, FL 34112-5749
Phone: 239.252.6014	Cell: 239-315-1576	Fax: 239.252.6304

Re: Keep getting a warning in Server log says "Failed to log in"

NicolasGIS — Thu, 20 Jun 2019 18:24:37 GMT

Following our production upgrade issue, I set up an identical environment to prod on dev and modify etc/hosts entries to be able to restore webgisdr backup made before this upgrade as webgisdr was failing on production after the upgrade issue. I performed the upgrade to 10.7 on this dev environment and exported another 10.7 webgisdr backup. I then recreated all our production machines, installed directly 10.7, and import the webgisdr 10.7 backup. It worked ! What a relief !

For another reason I recreated dev environement and the errors were gone right after (I checked the manager logs). So these requests must have come from the dev environment. Thinking about it afterward, I think I may had reverted to the original etc/hosts file on dev without updating the portal urls (webContextUrl, private portal url). I am not 100% sure as the file was gone but I think it would make sense, wouldn't it ?

Re: Keep getting a warning in Server log says "Failed to log in"

EricPeña — Fri, 21 Jun 2019 14:32:43 GMT

I get this error every 5 minutes. I suspect this is coming from Web Adaptor's regular polling of the server site (see here at 2nd paragraph). I tried several things to no avail. Changing Primary Site Admin account credentials, enabling Web Adaptor admin access, and re-configuring Web Adaptor didn't fix the login error. This may be a bug in 10.6.1.

Re: Keep getting a warning in Server log says "Failed to log in"

ClintonBallandis1 — Mon, 24 Jun 2019 01:08:20 GMT

Hi all,

I'm still getting a failed login every 5 mins. I decided to change the ArcGIS Server PSA account in Server Manager to a new user name and password. However I'm still getting log in attempts on the old PSA account username. By chance I tried to validate my datastores they all validated successfully in server manager returning green ticks. However when I checked my server logs I have 2 failed login attempts at the same time. The first is an attempt by the datastore to generate a token using the server machine name url on port 6443 not the webadaptor domain. The second is the standard login failure I'm getting. Jonathan Quinn could the issue be with the datastore trying to use the ArcGIS Server PSA account (I used this as the administrator account when I configured the datastore) Seems like everything was ok when the PSA account was enabled because the datastore could use the credentials to login ?

Thanks,

Clinton

Re: Keep getting a warning in Server log says "Failed to log in"

EricPeña — Tue, 25 Jun 2019 14:04:31 GMT

Same here... I turned off the ArcGIS Data Store service for a while just to confirm, and sure enough the login errors stopped. I started it back up and Relational and Tile Cache Data Stores validated in Server Manager just fine, but the login errors came back with original PSA enabled. Everything else seems to be working, so this may be an error that I'll just have to ignore for now.

Re: Keep getting a warning in Server log says "Failed to log in"

JonathanQuinn — Tue, 25 Jun 2019 16:21:15 GMT

Data Store shouldn't store the PSA credentials as Server supports those credentials changing. It should establish a trust between itself and the Server. I think it's best to reach out to Support and describe the behavior to see if they can reproduce it.

Re: Keep getting a warning in Server log says "Failed to log in"

DianeMcGuerty1 — Tue, 09 Jul 2019 16:26:42 GMT

We have managed to get rid of the error...finally by removing the data store from the host ags server and re-installing the data store on the server and then re-adding it to the host server. All of the errors are now gone.

Re: Keep getting a warning in Server log says "Failed to log in"

ClintonBallandis1 — Wed, 07 Aug 2019 22:57:47 GMT

Hi all,

I logged the repeated failed login attempts with ESRI support. We couldn't get a resolution on what was causing the issue.

I ended up unregistering the datastore from the Hosting ArcGIS Server. I then uninstalled and reinstalled datastore and subsequently re registered it. This seems to have resolved the issue as I no longer have any attempted login attempts.

Thanks,

Clinton

Re: Keep getting a warning in Server log says "Failed to log in"

BillLotz — Wed, 21 Jul 2021 18:49:02 GMT

We first started seeing this after the upgrade from 10.7.1 to 10.8.1