SSH/5/SSH_USER_LOGIN_FAIL_SCHD

Message

SSH/5/SSH_USER_LOGIN_FAIL_SCHD: Failed to login through SSH [failed_count] time(s) in last [time_gap] minute(s).

In VS mode, this log is supported only by the admin VS.

Description

SSH user login failed multiple times within one minute.

Parameters

Parameter Name	Parameter Meaning
failed_count	Authentication failure count.
time_gap	Time gap in minutes.

Possible Causes

Cause 1: The SSH user does not exist.

Cause 2: RSA, DSA or ECC key does not exist.

Cause 3: The user name or password is incorrect.

Cause 4: Service is not enabled.

Cause 5: Maximum sessions are reached.

Cause 6: A deny rule is set for the IP address in ACL.

Procedure

1. Perform different procedures for different causes.

Cause 1: Run the display ssh user-information command to view the configuration of all the SSH users.

If the SSH user is not configured, run the ssh user command to create an SSH user.
If the SSH user is configured, go to other steps.

Cause 2: Run the display rsa local-key-pair public command to view the RSA public key in the local key pair. Run the display ecc local-key-pair public command to view the ECC public key in the local key pair. Run the display dsa local-key-pair public command to view the DSA public key in the local key pair.

If the RSA key is not configured, run the rsa local-key-pair create command to generate the local RSA host key pair and the server key pair.
If the ECC key is not configured, run the ecc local-key-pair create command to generate the local ECC key pair.
If the ECC key is not configured, run the dsa local-key-pair create command to generate the local DSA key pair.
If the RSA, DSA or ECC key is configured, go to other steps.

Cause 3: Ensure that the user name and password is correct.

Cause 4: Ensure that the services are enabled.

Cause 5: Ensure that the maximum sessions are not reached.

Cause 6: Run the display acl command to review ACL rules.

If the user IP address matches a rule with the behavior of deny, run the acl command to enter the ACL view and run the rule command to change the behavior from deny to permit.
If the user IP address does not match a rule with the behavior of deny, go to other steps.

2. Collect log information and configuration information, and then contact technical support personnel.