The Security Analytics appliance has been experiencing intermittent login issues which generate the following logs on user login failures:
"Authentication failed for example_username from 18.104.22.168 : Reason Code 2: Unknown User"
The passwords are correct on the majority of these login failures, and many failures occur before a login is successful.
Release : 8.2.4-55248
There was a timeout update problem with nscd.
The solution is to add two lines to a couple of configuration files.
Run the following commands to update the nscd and ldap configuration files and restart nscd.
echo "nss_connect_policy oneshot" >> /etc/ldap.conf
echo "reload-count 0" >> /etc/nscd.conf
systemctl restart nscd
This will be fixed in 8.2.5.