Error - Authentication finally failed for admin

[Aditya PS]

Hello All,

I changed the password for wazuh admin by running the security script. After changing the password, i am able to login to wazuh-dashboard. However in the log file of my wazuh indexer, I am seeing this error :

[2024-05-21T02:38:40,269][WARN ][o.o.s.a.BackendRegistry  ] [wazuh-indexer01.local] Authentication finally failed for admin from 192.168.14.100:42346
[2024-05-21T02:38:40,532][WARN ][o.o.s.a.BackendRegistry  ] [wazuh-indexer01.local] Authentication finally failed for admin from 192.168.14.100:42354
[2024-05-21T02:38:50,265][WARN ][o.o.s.a.BackendRegistry  ] [wazuh-indexer01.local] Authentication finally failed for admin from 192.168.14.100:49058
[2024-05-21T02:38:50,529][WARN ][o.o.s.a.BackendRegistry  ] [wazuh-indexer01.local] Authentication finally failed for admin from 192.168.14.100:49070

These ports are continously changing after my wazuh indexer ip(192.168.14.100), I have seen atleast 10 different ports. Does anybody know where else do I have to update my Wazuh admin password.

[Rolly Davany Mougoue Kakanou]

Hello Adiyta,

After the password change you should ensure to update it on you components. In this case it'll be the Filebeat installation. You will need to update the new admin password in the filebeat keystore. 

https://documentation.wazuh.com/current/user-manual/user-administration/password-management.html#changing-the-password-for-single-user

Also, could you please provide more insights on your installation type and what steps you performed after changing the password.

Best regards,

Rolly Mougoue