Identity Awareness Failed Login Log generated on certain day and time

[#1]

Hi All,

Currently our Check Point having a weird issue. We found that on certain day specific time frame we will see a lot of user failed login logs based on the SmartConsole Logs. The smartconsole showing that the error description with "An error was detected while trying to authenticate against the AD server. It may be a problem of bad configuration or connectivity. Please refer to the troubleshooting guide for more help". We have checked all the settings we have no idea which one is not correct. From user perspective they are not experienced any login issue or connection issue, im not sure whether it because it recovers speedy without user awareness. 

We have checked there's no any CPU & memory spike during the time. It only happened around 5 minutes the logs keep spamming and with random users. 

Has anyone known why we seeing this failed login log is spamming during the certain time? How to avoid this logs generated? 

Best Regards,

K

[#2]

Hi All,

Currently our Check Point having a weird issue. We found that on certain day specific time frame we will see a lot of user failed login logs based on the SmartConsole Logs. The smartconsole showing that the error description with "An error was detected while trying to authenticate against the AD server. It may be a problem of bad configuration or connectivity. Please refer to the troubleshooting guide for more help". We have checked all the settings we have no idea which one is not correct. From user perspective they are not experienced any login issue or connection issue, im not sure whether it because it recovers speedy without user awareness. 

We have checked there's no any CPU & memory spike during the time. It only happened around 5 minutes the logs keep spamming and with random users. 

Has anyone known why we seeing this failed login log is spamming during the certain time? How to avoid this logs generated? 

Best Regards,

K

[#3]

Hi All,

Currently our Check Point having a weird issue. We found that on certain day specific time frame we will see a lot of user failed login logs based on the SmartConsole Logs. The smartconsole showing that the error description with "An error was detected while trying to authenticate against the AD server. It may be a problem of bad configuration or connectivity. Please refer to the troubleshooting guide for more help". We have checked all the settings we have no idea which one is not correct. From user perspective they are not experienced any login issue or connection issue, im not sure whether it because it recovers speedy without user awareness. 

We have checked there's no any CPU & memory spike during the time. It only happened around 5 minutes the logs keep spamming and with random users. 

Has anyone known why we seeing this failed login log is spamming during the certain time? How to avoid this logs generated? 

Best Regards,

K

[PhoneBoy]

If it happens only at a specific time, it suggests a temporary connectivity issue between your Identity Collector and your Active Directory services.

[PhoneBoy]

If it happens only at a specific time, it suggests a temporary connectivity issue between your Identity Collector and your Active Directory services.

[KeonNg]

Hi @PhoneBoy 

How do we verify the Identity Collector having connectivity issue with the AD as we never see any connection failure during the time in the IDC when the failed login logs generated?

[KeonNg]

Hi @PhoneBoy 

How do we verify the Identity Collector having connectivity issue with the AD as we never see any connection failure during the time in the IDC when the failed login logs generated?

[PhoneBoy]

Your best bet is to open a TAC case.

[PhoneBoy]

Your best bet is to open a TAC case.