How to find IP of failed login attempts

We have a self hosted JIRA install. On the admin page I noticed failed login attempts for a user who's left the company and had his account disabled:

Last Failed Login: Today 6:05 PM
Current Failed Login Count: 8
Total Failed Login Count: 11

How I can I see what IP these attempts came from? 

I read this question: https://answers.atlassian.com/questions/203776

And it said: 

You can view the information from the user sessions under the Security on the JIRA Administration page.

From there you are able to tell who is trying to establish the session and which session is still active. Failed session will have no session ID and no user, but it will track which ip is the request from.

When I went there I saw a session that had a session ID, and under user it said 'Not available' But there were no entries with no session ID. 

1 answer

1 vote

Hey Larry,

Go to JIRA_HOME/log/atlassian-jira-security.log and search for the text

The user '<insert username here>' has FAILED authentication

That should give you the IP address

Suggest an answer

Log in or Join to answer
Community showcase
Emilee Spencer
Published yesterday in Marketplace Apps

Marketplace Spotlight: DeepAffects

Hello Atlassian Community! My name is Emilee, and I’m a Product Marketing Manager for the Marketplace team. Starting with this post, I'm kicking off a monthly series of Spotlights to highlight Ma...

37 views 0 3
Read article

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you
Atlassian Team Tour

Join us on the Team Tour

We're bringing product updates and pro tips on teamwork to ten cities around the world.

Save your spot