The warning CentralAuthSessionProvider::provideSessionInfo: token mismatch for {username} is logged tens of thousands of time a day, with some huge spikes (e.g. 1.5M times on 2025-03-01). In small amounts it wouldn't be strange (it means the user's CentralAuth user token, gu_auth_token, changed, probably because the user logged out on a different device or domain and the token cookie on the current device or domain isn't valid anymore), but this seems quite high and spiky. A bug? A brute-forcing attempt? Maybe I'm just underestimating how often CentralAuth user tokens change?

(logstash)
(The logs start in January, because that's when rECAU90e91436f710: CentralAuthSessionProvider: Improve logging changed the log level, but presumably the event has been happening for much longer.)