VMware Aria Operations for Logs found the following <X> events matching the criteria for alert "NSX - Failed login attempts"

Products

• VMware NSX

Issue/Introduction

• NSX is configured as a Data Source in VCF Operations for Networks.
• VMware Identity Manager is used within the environment.
• Manual login to NSX using the service account used by VCF Operations for Networks is successful.
• NSX Manager Reverse Proxy logs shows invalid credentials intermittently.
  
  /var/log/proxy/reverse-proxy.log
[TIMESTAMP] ERROR Processing request [UUID] SessionInvalidationFilter 2806751 - [nsx@6876 comp="nsx-manager" errorCode="MP1" level="ERROR" subcomp="http"] Authentication validation failed.
org.springframework.security.authentication.BadCredentialsException: Invalid credentials
        org.springframework.security.authentication.BadCredentialsException: Invalid credentials
        at com.vmware.nsx.management.rp.security.oauth2.OAuth2AuthenticationProvider.attemptAuthentication(OAuth2AuthenticationProvider.java:158) ~[libreverse-proxy-compile.jar:?]
        at com.vmware.nsx.management.rp.security.oauth2.OAuth2AuthenticationProvider._authenticate(OAuth2AuthenticationProvider.java:149) ~[libreverse-proxy-compile.jar:?]
        at com.vmware.nsx.management.rp.security.oauth2.OAuth2AuthenticationProvider.authenticate(OAuth2AuthenticationProvider.java:81) ~[libreverse-proxy-compile.jar:?]
        at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:182) ~[spring-security-core-5.6.12.jar:5.6.12]
  
  
• The NSX Manager Envoy logs shows API calls from the VCF Operations for Networks are failing and succeeding in quick succession.
  
  grep "/api/session/create" /var/log/proxy/envoy*
20251029T132003Z/var/log/proxy/envoy_access_log.txt.3:[2025-10-29T10:27:01.632Z] [IP] [IP] "POST" "/api/session/create" "HTTP/1.1" 403 UAEX 71 109 193 - "[IP]" "Apache-HttpClient/4.5.9 (Java/17.0.10)" "[UUID]" "[IP]:443" "-"
20251029T132003Z/var/log/proxy/envoy_access_log.txt.3:[2025-10-29T10:27:01.828Z] [IP] [IP] "POST" "/api/session/create" "HTTP/1.1" 200 UAEX 71 14 325 - "[IP]" "Apache-HttpClient/4.5.9 (Java/17.0.10)" "[UUID]" "[IP]:443" "-"
20251029T132003Z/var/log/proxy/envoy_access_log.txt.3:[2025-10-29T10:27:01.632Z] [IP] [IP] "POST" "/api/session/create" "HTTP/1.1" 403 UAEX 71 109 193 - "[IP]" "Apache-HttpClient/4.5.9 (Java/17.0.10)" "[UUID]" "[IP]:443" "-"
20251029T132003Z/var/log/proxy/envoy_access_log.txt.3:[2025-10-29T10:27:01.828Z] [IP] [IP] "POST" "/api/session/create" "HTTP/1.1" 200 UAEX 71 14 325 - "[IP]" "Apache-HttpClient/4.5.9 (Java/17.0.10)" "[UUID]" "[IP]:443" "-"
  
  
• No functional impact is observed.
  
         

Environment

VMware NSX

Resolution

This is a known issue impacting VMware NSX.