We have integrated ServiceNow instance 'A' with another ServiceNow instance 'B' for Incident sync using Basic Authentication (locally created account in ServiceNow)
Issue is - Some times the web service call fails from instance 'B' to instance 'A'. When we checked the logs, we could see several log entries saying 'Invalid username/password' foe the above account.
So looks like someone is purposely trying to use login using wrong credentials and the account is getting locked out.
Is there a way to check WHO tried to login using the web service credentials?
NOTE - I could see an login attempt entry in 'syslog_transaction' for above web service account. But WHO is that is not shown.
