[email protected] failed attempts reported in Log Events.

Products

• VMware Aria Suite

Issue/Introduction

Numerous failed access attempts for [email protected] is reported in ingested log events in Log Explorer.

Environment

VMware Aria Operations for Logs 8.x

Cause

This is working by design.  VMware Aria Operations for Logs ingested vCenter events from the vCenter integration.  

These events are pointing to some unsuccessful login attempts to the vCenter with [email protected] credential.  Some cause to these event may include 

• Recent update to administrator credential on vSphere. However, the change didn't get updated on associated endpoint integration, such as HCX, Aria Operations, and Aria Operations for Logs.
• Suspicious attempts from unauthorized endpoint host or VM.

Resolution

Review logs on vCenter to identify the source of the access attempts. If administrator password was recently modified, ensure that this change is updated on all associated endpoint integration.