Deployment Architecture

How to resolve a non-existant LDAP account causing issues in splunkd?

a212830
Champion

Hi,

We are getting flooded with error messages from a non-existant LDAP account in our splunkd, and complaints from the siteminder support folks that we are hammering their server. The account does not exist on either search head, and i can't find any searches that are enabled with that user id. Any suggestions on where to look?

11-08-2016 09:49:41.564 -0500 ERROR AuthenticationManagerLDAP - Could not find user="a555740" with strategy="Offshore Power"
11-08-2016 09:49:41.627 -0500 ERROR AuthenticationManagerLDAP - Could not find user="a555740" with strategy="Offshore users"
11-08-2016 09:49:41.642 -0500 ERROR AuthenticationManagerLDAP - Could not find user="a555740" with strategy="azg_EZP-STS-MTS-USER"
11-08-2016 09:49:41.710 -0500 ERROR AuthenticationManagerLDAP - Could not find user="a555740" with strategy="azgEI_SCCM_Splunk_Users"
11-08-2016 09:49:41.713 -0500 ERROR AuthenticationManagerLDAP - Could not find user="a555740" with strategy="azg_EZP-DMT-USER"
11-08-2016 09:49:41.774 -0500 ERROR AuthenticationManagerLDAP - Could not find user="a555740" with strategy="azg_EZP-STS-MTS-USER"
0 Karma

cmerriman
Super Champion
0 Karma

sloshburch
Splunk Employee
Splunk Employee

Yea, you'll need to check for ANY knowledge objects owned by this user. Remember that they might have some stuff stashed as private that could be getting missed in your searching.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...