failed admin login attempt NOT recorded in system log

[nextgenhappines]

During a routine test,  we found out if failed attempt login with the admin name as root via ssh or console will not record to system log, but failedd  attempt login with other name via ssh or console will record to system log.

[gswcowboy]

No auth profile associated with this admin user so to mimic your config, I added the local user 'renato' as an administrator and using the localdb as my auth profile for said user. I still see syslogs for the 'root' user. Only difference I see with our config is that the 'admin' user is configured on my unit whereas it's not on yours.

renato@renato(active)> show admins all

admin

panorama

oliver

renato

config {

  mgt-config {

    users {

      admin {

      permissions {

          role-based {

            superuser yes;

          }

        }

renato {

        permissions {

          role-based {

            superuser yes;

          }

        }

        authentication-profile LocalDB;

      }

    }

  }

2012/10/20 16:05:45info     general        general 0   Accepted keyboard-interactive/pam for renato from 172.16.20.24 port 6960 ssh2

2012/10/20 16:05:39info     general        auth-fa 0  User 'renato' failed authentication.  Reason: Invalid username/password From: 172.16.20.24.

2012/10/20 16:05:27info     general        general 0  User renato logged in via CLI from 172.16.20.24

2012/10/20 16:05:26info     general        auth-su 0  User 'renato' authenticated.   From: 172.16.20.24.

2012/10/20 16:05:15info     general        general 0  User root

failed authentication from 172.16.20.24

[nextgenhappines]

Hmm,  not sure what to say, but I tested with 4.1.7 and 5.0.0 beta.  

[gswcowboy]

Call into PAN Support so we can turn on some debugging features. If indeed a bug, we'll file one accordingly and investigate further.