Hi,
We need assistance in finding failed login attempts by IP address. This is because we received an alert for a failed login attempt for the "Admin" user.
Is there any way we can track the IP address from which it is accessed?
Thanks in advance.
If this is a Windows environment, you can access failed login events (EventCode=4625) and look into the "Source_Network_Address" field. The IP address the user attempted to login from will be listed there.
index=wineventlog EventCode=4625
Hi, but this is not windows environment.
Thanks.
Hi @splunker9999
Be sure to include all relevant information when you post your question. It's good to know it's not a Windows environment, but to save other users the trouble of assuming everything about your issue, can you please provide more details?