LOGIN.FAILED in LogViewer

[nicola_martella2]

Hi to all.

I hope this is the correct place for my question.

I have an installation of PI 7.31 EHP1 SP5.

In logviewer I have this error that, I'm afraid, compromises the correct functioning. I say this because, periodically I have a popup like that attached to this post that says:

Unable to notify Integration Server affected by data changes

HTTP connection to

http;//N4N-NW73.n4n,eu:50000/sap/xi/cache?sap-client=001 returns status code '500' (Internal Server Error) in response.

The error in log is:

LOGIN.FAILED
User: sap*
IP Address: 192.168.2.51
Authentication Stack: sap.com/com.sap.lcr*sld
Authentication Stack Properties:
        template = ticket
        policy_domain = /sld
        password_change_error_page = /ChangePasswordSLD
        auth_method = basic
        password_change_login_page = /ChangePasswordSLD
        realm_name = SLD

Login Module                                                               Flag        Initialize  Login      Commit     Abort      Details
1. com.sap.security.core.server.jaas.EvaluateTicketLoginModule             SUFFICIENT  ok          false                 true      
2. com.sap.engine.services.security.server.jaas.BasicPasswordLoginModule   REQUISITE   ok          exception             true       Authentication did not succeed.
3. com.sap.security.core.server.jaas.CreateTicketLoginModule               OPTIONAL    ok                                true      
No logon policy was applied

Seems that the super user account sap* is used somewhere (in SLD?) with a wrong password.

Have someone ideas about the error or where can be used sap*?

Thanks a lot.

Nicola

[divyanshu_srivastava3]

May be you can check the INTEGRATION_DIRECTORY_HMI and other RFCs.

Check in which destination SAP* is used.

Also, share security logs and default trace.

[nicola_martella2]

Hi Divyanshu, thank oyu for your replay.

As you suggested, I checked the logon for each RFC destination but no one uses sap* for user.

I checked services in sicf too but nothing.

I attached the logs relevant (I hope). If you can have a look I appreciate a lot.

Ciao

Nicola

defaultTrace_00.18.trc.txt.zip

security_00.1.log.txt.zip

applications_00.1.log.txt.zip