Source:Unknown received for an authentication failed log in Cisco Catalyst 3560-G24TS 12.2 (25)SEE4

[Nathaniel Horsch]

I can see the source:unknown recorded in for any authentication logs and i expect it to be source:IP address of the actual source. It is working fine on other switch versions, can any one of you confirm if this is expected and how to fix it?

[nspasov]

Hello Nathaniel-

Unknown can be seen if the authentication method was not over IP. For instance, your console port, Aux port, etc. 

Can you see in your logs what port and protocol was used for the failed authentications?

Thank you for rating helpful posts!