Troubleshoot log-in issue

Question

In interview, I have been asked that "A user tries to log-in to a website with proper credentials and he is just taken to blank page. How would you troubleshoot that?"

I have basically talked about to go and check the splunk logs with X-request id. Make sure the entire URL request is correct, and check the error message.

But I am not sure the exact answer of this question? Could you help me to answer this question perfectly?

Answer 1

There is no perfect answer, because it depends on what web infrastructure they are using, and if they are leveraging Splunk at all. In most cases, an investigation will not start with a request-id. Someone will come to you and say 'find it'. I'd say the best way to answer this question is by asking questions.

IF (big if here) they are using splunk, then it's something like this:

Questions to ask:

1. What is the time frame this happened in?
2. is there are user / ip associated with this, or is that what you're looking for?
3. what system did this occur on? (assuming they have more than a single web front end. iis, apache, blah blah)

Solution:

Use Splunk to search web data any failed login events during the time window mentioned, and provide a report of user/hosts/ips to the SME / system owner or requester.