# Auth failure spike
Symptom: authentication failure count jumps in Atlas logs or alerts.
## Diagnose
1. When did it start? Correlate with deploys, credential rotations, and IP access list changes.
2. Which usernames fail? One service user failing everywhere points at that service's stored secret. Many random usernames failing from one IP points at a scan/probe.
3. Which source IPs? Unexpected geographies or cloud ranges you do not use deserve a closer look.
## Confirm
- Rotated password + one stale deploy = that deploy's failures. Check env vars and secret manager versions per service.
- Deleted or renamed user + old string = same shape.
- Random usernames = internet noise against the public endpoint; the IP access list should already be narrow, which makes this mostly harmless.
## Fix
Update the stale secret, or remove the stale deploy. For probes, tighten the IP access list and consider a private endpoint so there is no public surface at all.
## Verify
Failure rate returns to baseline and stays there for a day. If you rotated, confirm every service picked up the new secret (no stragglers in the logs).