Investigate NOPERM and WRONGPASS errors (ACL LOG)

Command

# Last 10 permission denials and failed logins (reason: auth/command/key/channel):
ACL LOG 10
# User of this connection:
ACL WHOAMI
# Cumulative denial counters:
INFO stats
# acl_access_denied_auth, acl_access_denied_cmd, acl_access_denied_key, acl_access_denied_channel
ACL LOG RESET

What it does

Lists denied command, key and channel accesses and failed AUTH attempts with user name, object, repeat count and client information (IP, last command); shows cumulative denial counters.

When to use it

When the application gets NOPERM or WRONGPASS after a deploy, to find the command broken by a tightened ACL rule, or to detect password guessing.

Caution

ACL LOG lives in memory, is cleared on restart and is limited to acllog-max-len (default 128) entries; when the same error repeats, count increases instead of a new row. The client-info field contains the client IP and the user in use; record what you need before resetting.