Login Failures
Login Failures records every unsuccessful sign-in attempt on your ERP — wrong passwords, logins for accounts that do not exist, and brute-force runs. It serves two purposes at once: helping a genuine user who cannot get in, and showing you when somebody is attacking the system.
Where to find it
Go to Company > Login Failures.
What the log shows
| Column | Description |
|---|---|
| User Name / Email | The account that was attempted. |
| Password | What was submitted. Often reveals a caps-lock or old-password problem at a glance. |
| IP Address | Where the attempt came from. Clickable through to an IP lookup so you can see the location. |
| Attempt Count | How many times that email has failed. The number that separates a forgetful user from an attack. |
| Date | When it happened. |
Reading the log
| Pattern | What it usually means | What to do |
|---|---|---|
| Two or three failures, one email, one IP | A user who has forgotten their password. | Ask them to reset it from their email. |
| An email that does not exist in the system | Someone trying to log in without signing up. | Follow up — this is a prospect, not a problem. Get them signed up. |
| Many attempts, many emails, one IP | A brute-force run. | Check the IP location and block it at your firewall. |
| One email, high attempt count, several IPs | A targeted attempt on that account. | Warn the account holder and have them change their password. |
The attempt count is the field to sort by. A single failure is noise; the same email failing thirty times is the one entry on the page that needs you.
Related pages
- Registered Users — signups that never activated
- Active Users — sessions that did succeed
- Audit Trail System — what happened after a login