Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

interesting issue I am running into. I am trying to get syslog rmeote logging working with a Cisco switch. i have it working and logging for both on-success and on-failure. However when it is a failed login attempt it does not show the user name that tried to log in in the logs?

Here is what the log looks like after a failed login:

 %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: ] [Source: 10.0.
0.6] [localport: 23] [Reason: Login Authentication Failed]

Here is what I ahve in the sh run:

login block-for 60 attempts 3 within 60
login delay 1
login on-failure log
login on-success log

 log config
  logging enable
  notify syslog contenttype plaintext

logging trap notifications
logging facility local4

aaa new-model
aaa authentication login default local group tacacs+
aaa authorization config-commands
aaa authorization exec default local group tacacs+
share|improve this question
Where are your user accounts? Are you using AAA? Are you auth'ing with a TACACS, RADIUS, or Local user account? – jwbensley Nov 8 '12 at 20:32
Yes both tacas and local, see edits. – Jim Nov 8 '12 at 20:39
Doesn't show username in logs for either local or tacacs authentication. – Jim Nov 8 '12 at 20:58
What about console access? Also is this via ssh or telnet? Have you tried the other? – jwbensley Nov 8 '12 at 22:28
Telnet, no SSH on this firmware version. This is our current firmware bin c3750-ipbase-mz.122-50.SE5.bin – Jim Nov 9 '12 at 13:37
up vote 1 down vote accepted

This is a known bug:

I was able to reproduce it in my lab as well.

share|improve this answer

It has been known in the *nix and network community for a long time that logging usernames can sometimes divulge the password of an account.

For example: Someone types the username, and accidentally hits return twice. This will result in two login failures being logged, one for the username, and one for the password in the username field.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.