If the History log or User Activity log shows Login failure entries with "Key mismatch" as the failure type, this indicates a login attempt using an SFTP (SSH) key not found in your site.

This message could indicate either a legitimate mistake or a false alarm.

A user might be trying to log in using an incorrect SFTP (SSH) key. Contact the user and verify that the key being used matches an existing key in your Files.com site.

However, many SFTP apps will automatically attempt to log in using all their known SFTP (SSH) keys before presenting the user with a login prompt. These apps use a known_hosts file to store keys. If the known_hosts file contains multiple keys, the SFTP app will cycle through them one by one, trying each one before falling back to a login prompt.

These automatic attempts to use keys will trigger corresponding login failure entries in the log files, even though the user may subsequently log in successfully. While these are login failures that are correctly logged, they are 'false positive' messages and are not a cause for concern.

You can contact the user and ask them to update their known_hosts file to remove unneeded keys. However, this file is shared by multiple SFTP and SSH apps, so removing keys may not always be possible when multiple SFTP and SSH sites are actively used.