https://community.splunk.com/t5/Security/Error-in-Splunkd-log-UserManagerPro-Failed-to-LDAP-user-for-a/m-p/124907#M3802 <P>In my splunkd.log, these messages repeat constantly (several times per minute). I turned on INFO-level logging to see if the extra information is useful. This user, "bnorthway", is an OS user (Linux), but not an LDAP user. There also used to be a Splunk (non-LDAP) user, but this account has been deleted. </P> <P>Why is Splunk trying to find this account on the LDAP server? How can I stop this?</P> <PRE><CODE>ERROR AuthenticationManagerLDAP - Could not find user="bnorthway" with strategy="&lt;domain&gt;" ERROR UserManagerPro - Failed to get LDAP user="bnorthway" from any configured servers INFO UserManagerPro - No user context available while checking capability=, auditInfo="" </CODE></PRE> Thu, 28 May 2015 15:39:49 GMT bnorthway 2015-05-28T15:39:49Z https://community.splunk.com/t5/Security/Error-in-Splunkd-log-UserManagerPro-Failed-to-LDAP-user-for-a/m-p/124907#M3802 <P>In my splunkd.log, these messages repeat constantly (several times per minute). I turned on INFO-level logging to see if the extra information is useful. This user, "bnorthway", is an OS user (Linux), but not an LDAP user. There also used to be a Splunk (non-LDAP) user, but this account has been deleted. </P> <P>Why is Splunk trying to find this account on the LDAP server? How can I stop this?</P> <PRE><CODE>ERROR AuthenticationManagerLDAP - Could not find user="bnorthway" with strategy="&lt;domain&gt;" ERROR UserManagerPro - Failed to get LDAP user="bnorthway" from any configured servers INFO UserManagerPro - No user context available while checking capability=, auditInfo="" </CODE></PRE> Thu, 28 May 2015 15:39:49 GMT https://community.splunk.com/t5/Security/Error-in-Splunkd-log-UserManagerPro-Failed-to-LDAP-user-for-a/m-p/124907#M3802 bnorthway 2015-05-28T15:39:49Z https://community.splunk.com/t5/Security/Error-in-Splunkd-log-UserManagerPro-Failed-to-LDAP-user-for-a/m-p/124908#M3803 <P>As per the documentation, Splunk will check against all configured access strategies. By default, it searches Splunk local users first and then any other strategy configured. <BR /> (Ref: <A href="http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureSplunkToUsePAMOrRADIUSAuthentication">http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureSplunkToUsePAMOrRADIUSAuthentication</A> )</P> Fri, 29 May 2015 00:50:19 GMT https://community.splunk.com/t5/Security/Error-in-Splunkd-log-UserManagerPro-Failed-to-LDAP-user-for-a/m-p/124908#M3803 sk314 2015-05-29T00:50:19Z https://community.splunk.com/t5/Security/Error-in-Splunkd-log-UserManagerPro-Failed-to-LDAP-user-for-a/m-p/124909#M3804 <P>Where would I find the configuration that is attempting to find this user?</P> Thu, 24 Sep 2015 14:58:40 GMT https://community.splunk.com/t5/Security/Error-in-Splunkd-log-UserManagerPro-Failed-to-LDAP-user-for-a/m-p/124909#M3804 bnorthway 2015-09-24T14:58:40Z https://community.splunk.com/t5/Security/Error-in-Splunkd-log-UserManagerPro-Failed-to-LDAP-user-for-a/m-p/124910#M3805 <P>If the user bnorthway owns/created any Splunk artifacts ( like scheduled searches, alerts, etc) , you can change the ownership from bnorthway to nobody.</P> <P>For example: To change the ownership for searches owned/created by bnorthway<BR /> Search for the user in <STRONG>local.meta</STRONG> under <STRONG>$SPLUNK_HOME/etc/apps/search/metadata/</STRONG> <BR /> replace all occurrences of <STRONG>owner = bnorthway</STRONG> to <STRONG>owner=nobody</STRONG></P> Tue, 09 Feb 2016 20:59:02 GMT https://community.splunk.com/t5/Security/Error-in-Splunkd-log-UserManagerPro-Failed-to-LDAP-user-for-a/m-p/124910#M3805 rajanala 2016-02-09T20:59:02Z