# Trace source of authentication failures from logs

**URL:** <https://discuss.elastic.co/t/trace-source-of-authentication-failures-from-logs/333005>\
**Category:** Elasticsearch\
**Created:** [May 9, 2023, 11:49pm UTC](https://discuss.elastic.co/t/trace-source-of-authentication-failures-from-logs/333005 "2023-05-09T23:49:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Russell\_Fulton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/russell_fulton/32/62888_2.png) [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\
**Post date:** [May 9, 2023, 11:49pm UTC](https://discuss.elastic.co/t/trace-source-of-authentication-failures-from-logs/333005/1 "2023-05-09T23:49:46Z")

</div>

I am seeing this log repeated twice a minute on one of my ES servers:

`[2023-05-10T00:11:33,186][WARN][o.e.x.s.a.RealmsAuthenticator] [secesprd02] Authentication to realm default_native failed - Password authentication failed for beat_setup`

The problem is that there is no indication of where the authentication attempt originated from.

How can I tell which host is causing this?

I have used netstat to check who is connecting to the server but there is nothing unexpected. I have looked for repeated short session but there aren't any.

Russell

---

<div class="post-metadata">

**Author:** ![Russell\_Fulton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/russell_fulton/32/62888_2.png) [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\
**Post date:** [May 10, 2023, 12:40am UTC](https://discuss.elastic.co/t/trace-source-of-authentication-failures-from-logs/333005/2 "2023-05-10T00:40:13Z")

</div>

OK, I found the xpack.audit setting but that does not work since I am using the basic licence.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 7, 2023, 12:40am UTC](https://discuss.elastic.co/t/trace-source-of-authentication-failures-from-logs/333005/3 "2023-06-07T00:40:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.