Multiple daily logs: pam_aaa:Authentication failed from nginx

[sw-jeong]

Hello,

We are seeing repeated authentication failure logs on our Cisco Nexus N9K-C93180YC-FX3 device, and we're trying to understand what they mean.

Example log entries:

show accounting log

Tue Jul 22 13:53:02 2025:type=update:id=::PAM:user= Authentication failed from nginx

show logging

2025 Jul 22 05:36:29 ker hostname 221 %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authentication failed from nginx - process

We would like to understand the following:

What does “from nginx” mean in this log?

Why does this log appear so frequently?
We see multiple logs like this every day

Any insight or reference to Cisco documentation related to this behavior would be greatly appreciated.

[Mark Elsen · Accepted solution]

  - @sw-jeong     Nginx is a light weight web server ; it means that an authentication attempt via NX-API failed, and the request came through the Nginx server process.  Check if the device is under attack, make sure to configure proper shielding through firewalling to include access from allowed sources only (e.g.)

 M.

[sw-jeong]

Thank you for your support.

As you mentioned, we have confirmed that the message saying "from nginx" is related to NX-API.
After reviewing the relevant Cisco documentation, we now understand the root cause and believe we can take the appropriate actions to resolve the issue.

Thanks again!