Failed to authenticate user [elastic]

Elastic Stack Elasticsearch
1

Running elasticsearch 7.5.2 & noticed that elastic service is continuously generating following info messages indicating elastic authentication failure in logs all the time. Everything works fine on the cluster but the info message still persist.

Would appreciate if someone can throw light as to what could be causing this behaviour & how to mitigate. Its frustrating that info logs are filled with these notifications even though everything OK.

Additional Information -

  1. Xpack management is configured and managed by a separate user (not elastic) which works fine.
  2. Authentication realms set up are Native (Order 0) and LDAP (Order 1). Both works well.
  3. Can query elasticsearch using elastic user & login to kibana works as well with the same user.
  4. Cluster health is green at all times & doesn't report any issues.
  5. There are NO ERROR/WARN notifications present in elasticsearch logs.

Info Messages -

[INFO ][o.e.x.s.a.AuthenticationService] [node1] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[INFO ][o.e.x.s.a.AuthenticationService] [node1] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]  
[INFO ][o.e.x.s.a.AuthenticationService] [node1] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[INFO ][o.e.x.s.a.AuthenticationService] [node1] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[INFO ][o.e.x.s.a.AuthenticationService] [node1] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[INFO ][o.e.x.s.a.AuthenticationService] [node1] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[INFO ][o.e.x.s.a.AuthenticationService] [node1] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
2

Some process is running that is trying to connect as the elastic user with an incorrect password.

This message is only generated if there is a failed authentication from outside the cluster.

3

Thanks Tim. Is there a way to identify such a process or find out the remote host address which is triggering the authentication to the cluster ?

4

If you have a paid or trial license, then you can turn on audit logging which will capture the IP address for all failed authentication attempts.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.