Look at the host in your log line. That’s the broker host from the US firmware.
Hermetry runs as separate deployments per region (EU, US, TR) and every organisation lives in one home region. Devices have to connect to the device host of their own organisation’s region, the one on each device’s Connection details card. I’d bet the US plant’s organisation is in the US region and yours, created by your IT from the UK, is in the EU. Your UK devices are knocking on the US broker with tokens that only exist in your organisation’s region. To that broker they’re unknown tokens, so you get a 4. Nothing reaches your Log tab because your org was never asked.
I hit exactly this when we cloned a project between two of our utilities, one in each region. Fix:
- Open any of your devices, Credentials tab, Connection details. Note the MQTT broker host.
- Replace the host in the firmware (and the HTTPS host if they use it).
- Keep connecting by host name. SNI is required, so don’t hardcode an IP from a DNS lookup.
Owners and admins can also see the home region under the organisation settings, Residency. The page is Regions and data residency.
And since you’re getting 4s: the firmware backs off 5 minutes, good. Keep that. Repeated failed logins from one address block that address for a while, and the whole plant is behind one NAT.