RTMT Alert - Number of AuthenticationFailed || After upgrading-12.5SU4

[Jagadish2]

Hi,

We are seeing frequent RTMT alerts with respect to authentication failed, post upgrade to 12.5SU4

Alert:

Number of AuthenticationFailed events exceeds configured threshold during configured interval of time 1 within 3 minutes on cluster.There are 4 AuthenticationFailed events (up to 30) received during the monitoring interval.LoginFrom : 192.168.15.233 Interface : Cisco CallManager Administration UserID : administrator AppID : Cisco Tomcat ClusterID : NodeID : AXNCUCM02 TimeStamp : Mon Mar 14 10:38:03 IST 2022 TimeStamp : 3/14/22 10:38 AM LoginFrom : 192.168.15.236 Interface : Cisco CallManager Administration UserID : administrator AppID : Cisco Tomcat ClusterID : NodeID : AXNCUCM05 TimeStamp : Mon Mar 14 10:38:03 IST 2022 TimeStamp : 3/14/22 10:38 AM LoginFrom : 192.168.15.234 Interface : Cisco CallManager Administration UserID : administrator AppID : Cisco Tomcat ClusterID : NodeID : AXNCUCM03 TimeStamp : Mon Mar 14 10:38:03 IST 2022 TimeStamp : 3/14/22 10:38 AM LoginFrom : 192.168.15.235 Interface : Cisco CallManager Administration UserID : administrator AppID : Cisco Tomcat ClusterID : NodeID : AXNCUCM04 TimeStamp : Mon Mar 14 10:38:03 IST 2022 

Please suggest, if cucm is hit by any bug ..

Regards

Jagadish

[Oleksandr Yurchenko]

Hi,

Some services or users trying to login as administrator to CUCM.

Please check who use  next IP's 192.168.15.233 (234,235,236)  .

BR Oleksandr

[Jagadish2]

Hi,

Which is that service/user trying to login as administrator via Cisco callmanager Administration interface using tomcat service and its failing to authenticate. This error is throwing from all nodes (Pub and all SUB). That too, the interval is 3 mins. Also, via cli the show login unsuccessful doesn't show any thing.

Alert is continuously coming and not to able identify the issue. Please suggest.

Regards

Jagadish

[Roger Kallberg]

Only you can answer that question on who is doing the login. No one outside of your organization can give that detail.

[Jagadish2]

Yes true, but as per the RTMT Audit logs, we are seeing the client ip address who is trying to log in to CUCM PUB is its own IP address. When am trying to login to PUB, the client ip address shows my laptop ip address and the authentication is successful, as am able to login with administrator credentials.

Mean to say Pub ip is the client ip address who is trying to login PUB on its Cisco callmanager administration via Tomcat with administrator id and its failing. Same is happening on all SUB's also.

So, here CUCM's are trying authenticate itself and its failing.

Not sure exactly why this is happening.

Please suggest.

[aravindan.thambusamy@chep.com]

Did you get this resolved am also getting failed login attempts from Cisco CER to Cisco CUCM , because of that am unable to login CUCM GUI page and getting error " Account locked out"