Hello,
So, on occasion when I go to log into one of my UAG servers I get a bad password error, and other times it lets me right in. Up to this point, I chalked it up as just UAG being buggy. I pulled the log bundle from the UAG and started poking around. I came across the audit.log file and my connection servers are trying to log into the UAGs and failing subsequently locking the admin account every 20 minutes. Is this normal behavior and if not how do I rectify this?
07/20 11:46:47,182 INFO: LOGIN_FAILED: SOURCE_IP_ADDR=xxx.xxx.xxx.xxx: USERNAME=admin: REASON=admin account is locked. Please try after 5 mins
07/20 12:01:47,446 INFO: LOGIN_FAILED: SOURCE_IP_ADDR=xxx.xxx.xxx.xxx: USERNAME=admin: REASON=Incorrect Password. 2 attempts are remaining.
07/20 12:01:49,561 INFO: LOGIN_FAILED: SOURCE_IP_ADDR=xxx.xxx.xxx.xxx: USERNAME=admin: REASON=Incorrect Password. 1 attempts are remaining.
07/20 12:06:34,137 INFO: LOGIN_FAILED: SOURCE_IP_ADDR=xxx.xxx.xxx.xxx: USERNAME=admin: REASON=Incorrect Password. 0 attempts are remaining.
07/20 12:10:19,197 INFO: LOGIN_FAILED: SOURCE_IP_ADDR=xxx.xxx.xxx.xxx: USERNAME=admin: REASON=admin account is locked. Please try after 5 mins
07/20 12:16:49,020 INFO: LOGIN_FAILED: SOURCE_IP_ADDR=xxx.xxx.xxx.xxx: USERNAME=admin: REASON=Incorrect Password. 2 attempts are remaining.
07/20 12:16:51,634 INFO: LOGIN_FAILED: SOURCE_IP_ADDR=xxx.xxx.xxx.xxx: USERNAME=admin: REASON=Incorrect Password. 1 attempts are remaining.
07/20 12:31:50,894 INFO: LOGIN_FAILED: SOURCE_IP_ADDR=xxx.xxx.xxx.xxx: USERNAME=admin: REASON=Incorrect Password. 0 attempts are remaining.
07/20 12:31:53,488 INFO: LOGIN_FAILED: SOURCE_IP_ADDR=xxx.xxx.xxx.xxx: USERNAME=admin: REASON=admin account is locked. Please try after 5 mins
Thanks
D
