Authentication Exception

Elastic Stack Elasticsearch
1

Hi dears

I have 4nodes of Elasticsearch 7.16.2 and 1node with Kibana, apm-server and Metricbeat. There are 3 instances of Logstash running on Elasticsearch nodes (3 of 4 servers have both ES and Logstash)

My cluster works properly and there is no problem, and also, I didn't change anything but all my Elasticsearch logs is like:

root-elk-lnx101$:~$ tail -n 15 /var/log/elasticsearch/LogSummerize.log
[2022-04-12T10:43:51,902][INFO ][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:44:42,549][INFO ][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:45:33,339][INFO ][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:46:23,956][INFO ][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:47:14,695][INFO ][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:48:05,521][INFO ][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:48:56,205][INFO ][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:49:46,836][INFO ][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:50:37,572][INFO ][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:51:28,403][INFO ][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:52:19,275][INFO ][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:53:10,054][INFO ][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:54:00,812][INFO ][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:54:51,540][INFO ][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:55:42,292][INFO ][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]

Everything is working!!! Every application's log is OK!

Where is the problem?

Thanks

2

Something it try to authenticate to your ES node using the elastic user and an incorrect password.

Did you change the password for the elastic use recently? If so, it looks like something is using the old password.

2 Likes
3

Found it
One of the Logstash instances had wrong password in it keystore

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.