Failed SSH/Authentication Attempts: LM Collector to Cisco Catalyst 9300 Switches
Recently (w/in the last 2 weeks), our Cisco ISE Authentication began alarming with excessive failed authentication attempts from our LogicMonitor Collector when trying to connect via SSH to our Cisco Catalyst 9300 switches. Checking the switch logs, the issue appears to be the Collector is attempting SSH connections to the switches without providing the configured SSH user account credentials, as can be seen from a brief snippet of the sh log output filtered for the specific log being referenced (attached to this message). We have ssh.user and ssh.pass already configured in LogicMonitor for things like the Common Config DataGroup/DataSource and instances, and this login session works without issue and our switch configs are backed up as would be expected.
My question is this: What other LogicModule or process/processes could be prompting the collector to attempt SSH connections w/out using the configured credentials for the switch device group? Is there a way to determine this and what would it take to halt these attempts. I've scoured the DataSources available in the switch resource dropdown but haven't figured out just yet what is prompting the Collector on these connection attempts. Any feedback or suggestions is welcome, thanks! -Ernest
Mike Moniz
·1 year agoThat can hard to trackdown. Along with DataSources I would also check other sections like NetScans, EventSources, PropertySources, etc for any that might also be applied to that device.
You can also try using !tlist h=[device/ip] in the collector debug console. That will list all the normal tasks that are scheduled on the collector to check on that device. Perhaps that will help locate a specific check.
Also make sure there isn't anything unrelated to LM that is running on the collector that might also be attempting to communicate with the device.
ErnestG72
OP1 year agoThanks Mike! I will try doing the debugging as you suggested, as well as checking the other source types to see if there are any connections there. Much appreciate the feedback, thanks again.