VMware Aria Operations for Networks UI logging fails with error “Too many Failed Login Attempt. Please try after some time” intermittently.

Products

• VCF Operations for Networks

Issue/Introduction

• The admin@local account is getting locked out repeatedly. 
• Upon admin@local password reset, the UI login works for few minutes before it locks again automatically with same error message as highlighted in the screenshot below.
  
  

Environment

VMware Aria Operations for Networks (formerly vRealize Network Insight) 6.x

Cause

• If VMware Aria Operations for Networks is integrated with a VMware or third-party product that is repeatedly attempting to authenticate using an outdated or incorrect admin@local password, it can lead to account lockouts and prevent successful login to the Aria Operations for Networks UI with the same credentials.
• In order to review the issue,  access.log should show us where the request came in from: 
  
  cd /var/log/arkin/nginx
  less access.log | grep -i "/api/auth/login"
  
  
• └─$ less access.log | grep -i "/api/auth/login"
  {"time": "2025-04-28T00:47:59+00:00", "remote_addr": "a.b.c.d", "request": "POST /api/auth/login HTTP/1.1", "request_length(bytes)": "X", "request_time(s)": "X", "bytes_sent": "X", "body_bytes_sent": "X", "upstream_response_time(s)": "X", "status": "X", "http_referrer": "-", "http_user_agent": "okhttp/X", "http_x_forwarded_for": "-", "http_x_originating_url": "-", "host": "x.x.x.x", "proxy_host": "X", "gzip_ratio": "-"}
  
  
• The access.log, "remote_addr" IP should ideally show us the authentication attempts made from our jump host IP address from where we are trying to login UI. If we observe any different IP listed, then it needs to be reviewed on how it is integrated to Aria operations for network including admin@local credential.  

 

Resolution

Reviewing the admin@local password / removing the VMware Aria Operations integration from the application should help fix the login issue.