This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.
I have a 1841 router and I'm trying to see the user name when he fails to login to the router; I have the following configuration and when I do a show log; I see the failed attempts but do not see the user who failed:
login block-for 60 attempts 3 within 60
login on-failure log every 3
login on-success log
1340818: .Apr 24 16:37:17.322 UTC: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: ] [Source: 220.127.116.11] [localport: 22] [Reason: Login Authentication Failed] at 16:37:17 UTC Fri Apr 24 2009
1340820: .Apr 24 16:37:25.325 UTC: %SEC_LOGIN-1-QUIET_MODE_ON: Still timeleft for watching failures is 5 secs, [user: ] [Source: 18.104.22.168] [localport: 22] [Reason: Login Authentication Failed] [ACL: sl_def_acl] at 16:37:25 UTC Fri Apr 24 2009
Has anybody experienced the same? I'm running IOS version 12.4(10a)
Thanks for any help.
This is a known issue:
CSCsd58148 Bug Details
%SEC_LOGIN-4-LOGIN_FAILED does not show username in [user: ]
Username of the user who fails to login is not shown in the
%SEC_LOGIN-4-LOGIN_FAILED: Login failed [user:] message.
Cisco 2821 running 12.4(3a)
I too am having the same issue, even after upgrading to 12.4(22)T. What I have found though is the user information is filled in on failed SSH attempts, but not for Telnet.
I'm curious how you made out with your situation.
You are hitting the bug id CSCsd58148. This bug is solved in IOS version 12.4(24)T1.
I did the lab recreation on my lab please see logs below.
*Aug 19 22:08:28.531: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: cisco] [Source: 192.168.250.24] [localport: 23] [Reason: Login Authentication Failed] at 22:08:28 UTC Wed Aug 19 2009
Cisco IOS Software, 2800 Software (C2800NM-ADVSECURITYK9-M), Version 12.4(24)T1, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Fri 19-Jun-09 15:13 by prod_rel_team
Please upgrade and if you still having the issue please let me know.