login on-failure log does not show username on 15.2.2e5 2960x

[samperks83]

Hi All,

i have tested this on several 2960x with IOS 15.2.2.E5 which is a recommended version of code. when auth fails it does not show the username and it is blank on the logs but when it succeeds it is fine. Has anyone encountered same thing? looks like a bug though.

Dec  8 04:29:51.218: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: ] [Source: 111.111.111.111] [localport: 22] [Reason: Login Authentication Failed] at 04:29:51 CST Thu Dec 8 2016

[samperks83]

anyone know about this?!

[Jean-Charles COTREL]

Hi Samperks,

I have the same trouble like you with last suggested Cisco iOS (15.2(2)E5).
When i try a SSH connection with real username and bad password or bad username, the user field is blank:
Dec 28 13:59:29: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: ] [Source: XXX.XXX.XXX.XXX] [localport: 22] [Reason: Login Authentication Failed] at 13:59:29 CET Wed Dec 28 2016

Else, with 15.0(2a)EX5, i also have an problem, when i add "login on-failure log" or "login on-success log", my 2960x restart immediatly after trying a SSH connection. (https://bst.cloudapps.cisco.com/bugsearch/bug/CSCud90069/?referring_site=bugquickviewredir)

I don't know which version i have to install to log correctly the login attempts ...

Regards,
Jean-Charles

[jimenamartinez]

I have the same problem in a Cisco 2600. 

Sep 27 08:58:05 10.0.0.1 002570: .Sep 27 10:58:05.172 ART: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: ] [Source: 10.0.0.161] [localport: 23] [Reason: Login Authentication Failed] at 10:58:05 ART Wed Sep 27 2017

Was anyone able to fix this? Any clues? Thanks!

[lash]

Same problem on 15.2(4)E5 on SM-X-ES3D-48-P switch modules in 2921 routers.

[elof]

Same problem on 15.2(6)E1 (running on a 2960x-switch).

On success, the username is logged fine but not on failure.

[andromeda]

Same issues on 6504 15 IOS, anyone has any idea how to fix this??

[dineshmohapatra.al]

I am having same issue in Cisco IOS Software, IOS-XE Software, Catalyst 4500 L3 Switch Software (cat4500es8-UNIVERSALK9-M), Version 03.08.05.E RELEASE SOFTWARE (fc2)

System image file is "bootflash:cat4500es8-universalk9.SPA.03.08.05.E.152-4.E5.bin"

%SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: ] [Source: XXX.XXX.XXX.XXX] [localport: 23] [Reason: Login Authentication Failed - BadUser] at 16:38:26 UTC Thu Oct 7 2021