Authentication Failure or event 201

[eddie_scarberry]

I am using a radius server. sometimes I have a device that is still trying to connect using a users old password, and after trying the bad password 3 times in a roll, it locks the user out. I see that there is a EVENT 201 in the event viewer. Shouldn't these type events of Client authentication failed get logged? 201 is set to log, but I never get any 201 logs. Is there a way I can see authentication failures to maybe see the device type, name or mac address of the device the password is failing on? 

[syamantakomer]

Hi Eddie,

Are you referring event 201 on ZD or auth server?

For the controller it is just a authentication failure. It depends upon the log level set on ZD, If it is set to Show more, you will be able to see authentication failure in the ZD event logs with client's MAC address.

Go to ZD >> System >> system settings >> Log settings >> "show more".

Regards,
Syamantak Omer

[eddie_scarberry]

I am referring to ZD.  I do not have authentication server sat up.  if I did, would it show more than the ZD?   Any good links to show how to set one up?   In my ZD, I have SYSTEM, but under that I just have General, AP, Cluster, Maps, Certificates and Templates.  I do not have a System Settings.     is there anywhere that it would show a failure referencing the username?   I need to be able to search for a username and see failures.  

[syamantakomer]

Hi Eddie,

Please refer online document from here.

Regards,
Syamantak Omer

[eddie_scarberry]

Thanks, I must have a different version of firmware, as I dont have a SYSTEM>SYSTEM SETTINGS.  I have done a screen shot.