Security
Highlighted

Why am I getting ldap messages about accounts that don't exist?

Champion

Hi,

I am getting messages in splunkd.log about accounts that do not exist in my splunk instances and that don't exist within my company.

07-30-2017 12:20:19.386 -0400 INFO AuthenticationManagerLDAP - Could not find user="auser" with strategy="zzgEISOMMSplunk_Users"

Why would I get these?

0 Karma
Highlighted

Re: Why am I getting ldap messages about accounts that don't exist?

SplunkTrust
SplunkTrust

Someone tried to login to Splunk as "auser" and the user doesn't exist in your LDAP.

Or perhaps you have an eventgen app installed that is generating the data.

Is your Splunk open to users on the internet?

0 Karma
Highlighted

Re: Why am I getting ldap messages about accounts that don't exist?

Ultra Champion

Some knowledge objects still exist under usernames that no longer exist in the environment. If they are search objects (most likely) then you can Reassign one or more shared knowledge objects to a new owner.

I've seen it a bazillion times. It's nothing to worry about but good to clean up.

0 Karma