530 Login Incorrect error uploading access logs to Reporter from Edge SWG (ProxySG)

Products

• Reporter-VA
• Reporter-S500
• Reporter

Issue/Introduction

The Reporter product stopped receiving the access logs from the Edge SWG (ProxySG) devices, and the proxy event log reports a 530 Login Incorrect error when attempting to connect to the Reporter.

Cause

In the Edge SWG (ProxySG) event logs, we can find entries similar to the ones below, when searching for the connection steps to the Reporter:

"Access Log FTP (ssl): Connecting to primary ##.##.##.## server ##.##.##.##:21."  0 E0000:96  alog_ftp_client.cpp:153
"Access Log FTP (ssl): 220 Welcome to the Reporter FTP service."  0 E0000:96  alog_ftp_client.cpp:1745
"Access Log FTP (ssl): USER username"  0 E0000:96  alog_ftp_client.cpp:466
"Access Log FTP (ssl): 331 Please specify the password."  0 E0000:96  alog_ftp_client.cpp:1745
"Access Log FTP (ssl): PASS *****"  0 E0000:96  alog_ftp_client.cpp:613
"Access Log FTP (ssl): 530 Login incorrect."  0 E0000:96  alog_ftp_client.cpp:1745
"Access Log FTP (ssl): Error sending PASS m_CommandBuffer.  Client received 530 response. Closing connections."  20 E000A:1  alog_ftp_client.cpp:663
"Access Log FTP (ssl): QUIT"  0 E0000:96  alog_ftp_client.cpp:1633
"Access Log FTP (ssl): 221 Goodbye."  0 E0000:96  alog_ftp_client.cpp:1745
"Access Log (ssl): Unable to connect to remote server for log uploading"  0 E0008:1  alog_facility_impl.cpp:2790

Resolution

Please first try to make sure that you are using the correct password for the FTP user being used to upload the logs to the Reporter. First, try to reset the FTP user password in the Reporter, and apply the updated password on the Upload Client in the Edge SWG (ProxySG):

1. Click the Upload Client tab, under Configuration > Access Logging > Logs > Upload Client, and select the access log name that you want to upload to Reporter, which you already had configured.
2. For "Upload Client: Client type:", select "FTP Client" and then click Settings.
3. Click Change Primary Password and enter the new password twice. Click OK, and then click the Apply.

If after resetting the password, the access logs are still not received in the Reporter, and the error obtained in the event log is the same 530 Login incorrect, it is probably that the FTP user is locked out. To disable this, please issue in the CLI of the Reporter the below command:

# authentication disable-user-lockout