# High Volume of ACL Denials Alert

The High Volume of ACL Denials alert indicates that many client topic access attempts were denied by ACL checks within a short period. The alert is triggered when both of the following conditions are met:

- At least **1,800 authorization attempts** occurred in the past 30 minutes.
- More than **50% of authorization attempts failed** in the past 30 minutes.

This condition usually indicates abnormal client access behavior and may disrupt legitimate message publishing or subscription. Common causes include incorrect ACL rules, clients accessing unauthorized topics, malicious access attempts, and an unhealthy external authorization service.

## Client Access to Unauthorized Topics

### Symptom

Some clients repeatedly receive ACL denials when publishing or subscribing, and the failures are concentrated on a specific set of topics.

### Common Causes

- ACL rules do not allow the topics required by legitimate clients.
- Client settings were not updated after an ACL policy change.

### Resolution

- Verify that the ACL rules allow legitimate clients to publish and subscribe to the required topics.
- Test or gradually roll out ACL policy changes before applying them to all clients.

## Unauthorized Client Access Attempts

### Symptom

Many authorization requests fail within a short period, and the requests originate from unfamiliar clients or sources.

ACL denial logs may show requests concentrated among unfamiliar source IP addresses or many unknown Client IDs attempting to access random topics.

### Common Causes

- Malicious clients attempt to access the EMQX deployment.
- Clients without the required permissions repeatedly attempt to publish or subscribe.

### Resolution

- Review Deployment Logs to identify the Client ID, source IP address, and username associated with each denial.
- Add suspicious Client IDs or IP addresses to the blocklist.
- Strengthen authentication based on your security requirements, for example, with username and password authentication, JWT, or mutual TLS.

## External Authorization Service Failure

### Symptom

When an external ACL authorization service based on an HTTP API, database, or LDAP experiences latency or failure, legitimate authorization requests may fail.

If the increase in ACL failures coincides with higher latency or error rates from the external service, the service is likely the cause.

### Common Causes

- The external ACL authorization service is unavailable or returns abnormal responses.
- The external service is overloaded, causing requests to time out or fail.

### Resolution

- Check the external authorization service status and logs for errors.
- Configure appropriate timeout and retry policies in EMQX to reduce the impact of temporary service instability.
- Increase the external service's connection pool size to improve concurrency and throughput.

## Troubleshooting

1. Log in to the EMQX Cloud Console, enter the deployment, and open **Deployment Logs**. Review ACL-related entries to identify the affected clients and topics.

2. Open **Alerts** and check the trigger period and scope of the ACL denial alert.

3. Use a client such as MQTTX to reproduce the failure by publishing and subscribing as one or more affected clients.

4. If you use an external ACL authorization service, check its logs and health status for latency or failures.

## Impact

- This alert does not stop the deployment or change billing.
- Repeated alerts indicate a likely problem with client access logic or ACL policies and may prevent normal message publishing or delivery.
- Investigate and correct the ACL configuration or client access logic promptly.