Probes are trying to logon to Cisco devices with SSH credentials

Hello there,

When PRTG uses these credentials for direct queries against those devices, then...

a) those devices have been added to PRTG

b) sensors were added to those devices that require those credentials (SSH, Linux etc. sensors)

....otherwise PRTG would have no reason to send queries with those particular credentials towards those devices.

Kind regards,

Erhard

May, 2017 - Permalink

Hi! Only sensor that I have for Cisco switches and WG are SNMP Moreover there should be sensor with error due to problems with login via ssh, right Acutally all green, no problems But Cisco ACS is reporting failed logons

Darek

May, 2017 - Permalink

Hello! Sure that devices are there but I do not have any ssh related sensor Only SNMP and all are green, without error So thats not a case

BR

Darek

May, 2017 - Permalink

Hello Darek,

Are you maybe running auto-discoveries in PRTG against those devices? That could possibly cause such login attempts or maybe sensor recommendation.

To verify that these login attempts are indeed coming from PRTG, stop service PRTG Probe Service to see if the login attempts stop then.

Kind regards,

Erhard

May, 2017 - Permalink

Hello! There is no autodiscovery on those devices set - only manual and no any recommendations They are coming from probes as source addresses are probes' ones and username is same created ONLY for logon to SSH/Linux machines from PRTG

May, 2017 - Permalink

Have you tried stopping PRTG Probe service to see if the attempts also stop then?

For further investigation I would suggest to send us an email to support@paessler.com, enter PAE867556 in the subject and also let us know the affected hosts as you have entered them in PRTG (IPs/hostnames). Furthermore please open PRTG Administration Tool on the PRTG server, tab "Logs and Info", there you find an option for uploading logs. Also enter there PAE867556 in the upload form.

Thank you & kind regards,

Erhard

May, 2017 - Permalink