How to track users by IP address for failed login attempts?

[splunker9999]

Hi,

We need assistance in finding failed login attempts by IP address. This is because we received an alert for a failed login attempt for the "Admin" user.

Is there any way we can track the IP address from which it is accessed?

Thanks in advance.

[jpolcari]

If this is a Windows environment, you can access failed login events (EventCode=4625) and look into the "Source_Network_Address" field. The IP address the user attempted to login from will be listed there.

index=wineventlog EventCode=4625

[splunker9999]

Hi, but this is not windows environment.

Thanks.

[ppablo]

Hi @splunker9999

Be sure to include all relevant information when you post your question. It's good to know it's not a Windows environment, but to save other users the trouble of assuming everything about your issue, can you please provide more details?