LOGIN.FAILED logs from IP

[hinrich_benitt]

Hello,

we are running on PI 7.11 which hosts the SLD and got access from a machine that should not access the PI system. In defaultTrace there is only the IP of the machine and the information LOGIN.FAILED. I checked the connections on the SAP system corresponding with the IP in transactions SM59 (LCRSAPRFC) and SLDAPICUST and there is nothing directing to the PI which shows the logs.

On the PI in the log we got this access from the IP every 15 minutes for 4 accesses. Every time a LOGIN.FAILED message. Unfortunately the logs don't show the real username which tries to connect. The log records says sap.com/com.sap.lcr as the Application, that afaik points to SLD.

Any idea where to look for to avoid this unwanted access ?

Kind regards, Hinrich

[former_member184681]

Hi Hinrich,

Check these threads, those problems look similar to yours:

Regards,

Greg

[hinrich_benitt]

Hello Greg,

the ERP system with the IP log entry accesses is connected to another PI / SLD and should not access the PI where we get the LOGIN.FAILED messages. The connection to the integration server of the PI of this ERP system is fully functional.

There is no reason accessing the PI / SLD where the logs take place and I was wondering where this communication comes from.

The threads you mentioned do unfortunately not fit to our issue.

Kind regards, Hinrich