March 2006 - Xymon - Xymon mailman web

[hobbit] using var in bb-hosts?
by brandste＠hebis.de 06 Mar '06

06 Mar '06

[sorry, columns :(, this morning my input devics are a bit dizzy ] Hi all, maybe a not important question... Using bb-hosts with multiple hosts elongates to quiet a view lines ;-) But using different tests, slas, maintenance windows and stuff easy generates a lot of columns...and the line gets hard to read and to edit. (okok....i know about sed ;-) ) Is there a possibility to use variables as in hobbit-alerts? So one could group: $locationA-sla="DOWNTIME=W:0700:0730 REPORTTIME=W:0731:0659 WARNPCT:95.0" $locationA-service="NK:conn ftp ssh imap otherstuff route:router1,router2,router3" 1.1.1.1 usermonitor # http://www.userurl.com $locationA-sla $locationA-service 1.1.1.2 usermonitor2 # http://www.userurl2.com $locationA-sla $locationA-service ... man for bb-hosts says nothing about it. Best Mathias

4 4

[hobbit] Dropping a filesystem as opposed to entire DISK test
by EES2Y＠hscmail.mcc.virginia.edu 06 Mar '06

06 Mar '06

No, because the test data will just get regenerated the text time the hobbit client sends data. Assuming you ARE using the hobbit client, you could modify the hobbit-clients.cfg on your display server to not alarm against those mounted filesystems: DISK /mnt/iso 101 102 HOST=myhost Although I'm not entirely certain that it will work with percentages above 100%, but it'd be worth a shot. -Eric > -----Original Message----- > From: Rob Munsch [mailto:rmunsch at solutionsforprogress.com] > Sent: Thursday, March 02, 2006 6:01 PM > To: hobbit at hswn.dk > Subject: [hobbit] Dropping a filesystem as opposed to entire DISK test > > Along the lines of > > ~/server/bin/bb 127.0.0.1 "drop HOSTNAME ftp" to > permanenly remove all traces of a test. > > > from the FAQ, can i do something like > > "drop HOSTNAME disk /file/system/i/dont/care/about" > > to get rid of something goofy causing an alert (in this case, > a mounted > ISO, which is, of course, at 100%...)? > > -- > Rob Munsch > Solutions For Progress IT > > > To unsubscribe from the hobbit list, send an e-mail to > hobbit-unsubscribe at hswn.dk > >

2 1

[hobbit] sshd notification in syslog
by EES2Y＠hscmail.mcc.virginia.edu 06 Mar '06

06 Mar '06

Three posibilities, off the top of my head: On the client side: 1. Install syslog-ng instead of ksyslogd, and filter on the ip address of your hobbit server. 2. Call your logrotate script (assuming you use one) more often, and/or make it compress your old syslog messages. On the hobbit server side: (this is my preferred option) 1. change your bb-services file ($HOBBIT/server/etc/bb-services) so that ssh test sends the version string. I think that will stop your sshd from complaining. ie.: [ssh|ssh1|ssh2] send "SSH-2.0-OpenSSH_4.1\r\n" expect "SSH" options banner port 22 I think if you disconnect after the version exchange, but before the diffie-helman key exchance, sshd wont log anything. Now, if you arent accepting v2 connections on your clients, you'll have to set up a separate [ssh1] stanza that supplies an ssh v1 string (SSH-1.5-OpenSSH_4.2) and change your ssh statement in your bb-hosts to ssh1 for those machines. Otherwise your logs are just going to be filled with protocol mismatch messages instead. HTH, -Eric Schwimmer Network Engineer UVA HSCS Network Engineering > -----Original Message----- > From: thomas.seglard.enata at cnp.fr > [mailto:thomas.seglard.enata at cnp.fr] > Sent: Thursday, March 02, 2006 6:09 AM > To: hobbit at hswn.dk > Subject: [hobbit] sshd notification in syslog > > > Hello, > > since deployment of hobbit's client on 200 servers (hpux, > aix, sun, linux), I got this message in syslog : > > Feb 13 12:05:44 psa089 sshd[9813]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:06:47 psa089 sshd[9980]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:07:49 psa089 sshd[10006]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:08:17 psa089 sshd[10012]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:08:48 psa089 sshd[10078]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:09:52 psa089 sshd[10564]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:10:55 psa089 sshd[10871]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:11:57 psa089 sshd[10987]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:13:00 psa089 sshd[11060]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:13:20 psa089 sshd[11065]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:14:02 psa089 sshd[11166]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:15:06 psa089 sshd[11297]: Did not receive > identification string from 158.157.156.91 > > Ip address is the one from my hobbit's server > (158.157.156.91). This message do not specify that the ssh > test failed, so I'm not worried about this. The main problem > is the size of syslog and /var is growing rapidly ! Anyone > knows how to prevent this message to be display in syslog ? > Thank you ! > > Thomas Seglard > (I'm using Lotus Notes, what a challenge...) > > Ce message (et toutes ses pieces jointes eventuelles) est > confidentiel et etabli a l'intention exclusive de ses destinataires. > Toute utilisation de ce message non conforme a sa > destination, toute diffusion ou toute publication, totale ou > partielle, est > interdite, sauf autorisation expresse. > L'internet ne permettant pas d'assurer l'integrite de ce > message, CNP Assurances et ses filiales declinent toute responsabilite > au titre de ce message, s'il a ete altere, deforme ou falsifie. > > ***** > > This message and any attachments (the "message") are > confidential and intended solely for the addressees. > Any unauthorised use or dissemination is prohibited. > E-mails are susceptible to alteration. > Neither CNP Assurances nor any of its subsidiaries or > affiliates shall be liable for the message if altered, > changed or falsified. > >

4 4

[hobbit] Collecting RRD from custom script, but no graph
by Syms.MS＠forces.gc.ca 03 Mar '06

03 Mar '06

Thanks, this was the problem! S -----Original Message----- From: Dan Vande More [mailto:bigdan at gmail.com] Sent: 3-Mar-06 12:53 PM To: hobbit at hswn.dk Subject: Re: [hobbit] Collecting RRD from custom script, but no graph Usually the magnifying glass link with no graph is a sign that the RRD was unable to generate. This is normally because of a configuration issue, and I seem to get them when my hobbitgraph.cfg section is wrong. I get the impression that your DEF line is incorrect in your hobbitgraph.cfg file. by using DEF:tr=trackoswex.rrd:tracks:AVERAGE, you are telling the grapher to use the trackoswex.rrd file and "tracks" as the name of your datasource. Is your datasource's name really "tracks"? To find the name of your real datasource from a simple rrd file, do this: rrdtool dump /path/to/your.rdd | less Then search for the <RENAMED_ds> tag. (Should be right near the top.) For instance, one of mine says: <RENAMED_ds> <RENAMED_name> procATemp </RENAMED_name> <RENAMED_type> GAUGE </RENAMED_type> <RENAMED_minimal_heartbeat> 600 </RENAMED_minimal_heartbeat> <RENAMED_min> 0.0000000000e+00 </RENAMED_min> <RENAMED_max> NaN </RENAMED_max>  <RENAMED_last_ds> UNKN </RENAMED_last_ds> <RENAMED_value> 6.4550000000e+03 </RENAMED_value> <RENAMED_unknown_sec> 0 </RENAMED_unknown_sec> </RENAMED_ds> So my datasource's name is procATemp. Note that this only works for a simple .rrd file. Some rrds contain several data sources, so don't let this mislead you. HTH, Dan On 3/3/06, Syms.MS at forces.gc.ca <Syms.MS at forces.gc.ca> wrote: > Hi, folks- > > I wrote a custom data collection script to send varying data to hobbit- hobbit receives it ok, displays the status properly and populates an rrd to store the data, but then doesn't graph it. I do get the graph name in a text hyperlink beside the magnifying glass icon, but that's it. > > I've done a similar thing with hobbit on a debian box before without a problem, but now that I'm running it on an aging Redhat Advanced Server 3 box, it's giving me some trouble. > > The configuration bits: I'm running rrdtool 1.0.48, gcc 2.3.3 and Hobbit 4.1.2p1. > > The output line from my script: > ${BB} ${BBDISP} "status ${MACHINE}.trackoswex ${COLOR} `date` > > trackoswex: ${TRACKS} > > " > > In hobbitlaunch.cfg, I'ved added > [trackoswex] > ENVFILE /usr/local/hobbit/client/etc/hobbitclient.cfg > NEEDS hobbitd > CMD /usr/local/hobbit/server/ext/gccs/trackoswex.sh > LOGFILE $BBSERVERLOGS/hobbitclient.log > INTERVAL 30m > > From hobbitgraph.cfg > [trackoswex] > TITLE OSWEX Tracks > YAXIS Number of tracks > DEF:tr=trackoswex.rrd:tracks:AVERAGE > AREA:tr#00CCCC:Tracks > COMMENT:These are the number of tracks received in the last 120 minutes.\n > GPRINT:tr:LAST: \: %5.1lf (cur) > GPRINT:tr:MAX: \: %5.1lf (max) > GPRINT:tr:MIN: \: %5.1lf (min) > GPRINT:tr:AVERAGE: \: %5.1lf (avg)\n > > > From hobbitserver.cfg > TEST2RRD="cpu=la,disk,inode,qtree,memory,$PINGCOLUMN=tcp,http=tcp,dns=tcp,dig=tcp,time=ntpstat,vmstat,iostat,netstat,temperature,apache,bind,sendmail,mailq,nmailq=mailq,socks,bea,iishealth,citrix,bbgen,bbtest,bbproxy,hobbitd,trackoswex=ncv" > > # This defines which RRD files to include on the "trends" column webpage, > # and the order in which they appear. > GRAPHS="la,disk,inode,qtree,memory,users,vmstat,iostat,tcp.http,tcp,netstat,mrtg::1,temperature,ntpstat,apache,bind,sendmail,mailq,socks,bea,iishealth,citrix,bbgen,bbtest,bbproxy,hobbitd,trackoswex" > > NCV_trackoswex="trackoswex:GAUGE" > > > Any help would be appreciated! > > tks > > S > > To unsubscribe from the hobbit list, send an e-mail to > hobbit-unsubscribe at hswn.dk > > > To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

1 0

Collecting RRD from custom script, but no graph
by Syms.MS＠forces.gc.ca 03 Mar '06

03 Mar '06

Hi, folks- I wrote a custom data collection script to send varying data to hobbit- hobbit receives it ok, displays the status properly and populates an rrd to store the data, but then doesn't graph it. I do get the graph name in a text hyperlink beside the magnifying glass icon, but that's it. I've done a similar thing with hobbit on a debian box before without a problem, but now that I'm running it on an aging Redhat Advanced Server 3 box, it's giving me some trouble. The configuration bits: I'm running rrdtool 1.0.48, gcc 2.3.3 and Hobbit 4.1.2p1. The output line from my script: ${BB} ${BBDISP} "status ${MACHINE}.trackoswex ${COLOR} `date` trackoswex: ${TRACKS} " In hobbitlaunch.cfg, I'ved added [trackoswex] ENVFILE /usr/local/hobbit/client/etc/hobbitclient.cfg NEEDS hobbitd CMD /usr/local/hobbit/server/ext/gccs/trackoswex.sh LOGFILE $BBSERVERLOGS/hobbitclient.log INTERVAL 30m >From hobbitgraph.cfg [trackoswex] TITLE OSWEX Tracks YAXIS Number of tracks DEF:tr=trackoswex.rrd:tracks:AVERAGE AREA:tr#00CCCC:Tracks COMMENT:These are the number of tracks received in the last 120 minutes.\n GPRINT:tr:LAST: \: %5.1lf (cur) GPRINT:tr:MAX: \: %5.1lf (max) GPRINT:tr:MIN: \: %5.1lf (min) GPRINT:tr:AVERAGE: \: %5.1lf (avg)\n >From hobbitserver.cfg TEST2RRD="cpu=la,disk,inode,qtree,memory,$PINGCOLUMN=tcp,http=tcp,dns=tcp,dig=tcp,time=ntpstat,vmstat,iostat,netstat,temperature,apache,bind,sendmail,mailq,nmailq=mailq,socks,bea,iishealth,citrix,bbgen,bbtest,bbproxy,hobbitd,trackoswex=ncv" # This defines which RRD files to include on the "trends" column webpage, # and the order in which they appear. GRAPHS="la,disk,inode,qtree,memory,users,vmstat,iostat,tcp.http,tcp,netstat,mrtg::1,temperature,ntpstat,apache,bind,sendmail,mailq,socks,bea,iishealth,citrix,bbgen,bbtest,bbproxy,hobbitd,trackoswex" NCV_trackoswex="trackoswex:GAUGE" Any help would be appreciated! tks S

2 1

Hobbit client will no longer start
by Jason.Chambers＠geosoft.com 03 Mar '06

03 Mar '06

I am having a problem getting the hobbit client to start on the hobbit server: - Program crashed Fatal signal caught! Any suggestions? Jason Chambers IT Helpdesk Support <http://www.geosoft.com/> eosoft Inc. 85 Richmond St. West - 8th Floor Toronto, Ontario, Canada M5H 2C9 Tel: 416-369-0111 x344 Fax: 416-369-9599 www.geosoft.com <http://www.geosoft.com/>

2 1

[Hobbit] Order in rules keyword
by plardinois＠be.tiauto.com 03 Mar '06

03 Mar '06

Hello, oh, I forgot to specify something :-( This is about the order in the rules keywords in the hobbit-alerts.cfg. Yesterday, I was doing some tests like this example : # rock-n-roll devices HOST=%(rock|roll).domain.com \ TIME=0123456:0000:2359 \ SERVICE=conn,bbd,bbgen,cpu,disk,hobbitd,http,memory SCRIPT /usr/home/hobbit/server/ext/ti-notify.pl test-email at localhost \ RECOVERED \ DURATION>10m When I put Duration>10m below SERVICE, I received a _lot_ of mails for any devices with a down service. I have also an additional question : the % sign. Does it apply to the whole line or just to the next word. thanks. Regards, Pierre Lardinois -----Original Message----- From: Schwimmer, Eric E *HS [mailto:EES2Y at hscmail.mcc.virginia.edu] Sent: jeudi 2 mars 2006 17:51 To: hobbit at hswn.dk Subject: RE: [hobbit] Order in rules keyword Are you referring to the host tags in the bb-hosts file? like: 10.0.0.1 myhost # badconn1:1:2 NOPROPRED:conn If so, then no, the order of the tags after the '#' doesn't matter. -Eric > -----Original Message----- > From: Lardinois, Pierre [mailto:plardinois at be.tiauto.com] > Sent: Thursday, March 02, 2006 11:43 AM > To: 'hobbit at hswn.dk' > Subject: [hobbit] Order in rules keyword > > > Hi again, > > Is There a specific order in the keywords ? > > Thanks you for your support, > > regards, > > P. Lardinois > > > The information contained in this transmission may contain privileged > and confidential information. It is intended only for the use of the > person(s) named above. If you are not the intended recipient, you are > hereby notified that any review, dissemination, distribution or > duplication of this communication is strictly prohibited. If you are > not the intended recipient, please contact the sender by reply email > and destroy all copies of the original message. > > To unsubscribe from the hobbit list, send an e-mail to > hobbit-unsubscribe at hswn.dk > > To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk The information contained in this transmission may contain privileged and confidential information. It is intended only for the use of the person(s) named above. If you are not the intended recipient, you are hereby notified that any review, dissemination, distribution or duplication of this communication is strictly prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.

1 0

[hobbit] RE: [SOLVED][hobbit] sshd notification in syslog
by rmcgraw＠purdue.edu 02 Mar '06

02 Mar '06

What ever I did this time seem to work. I used SSH-2.0-Sun_SSH_1.0.1\r\n and this seems to work now. Thanks Robert _____________________________________________________________________ Robert P. McGraw, Jr. Manager, Computer System EMAIL: rmcgraw at purdue.edu Purdue University ROOM: MATH-807 Department of Mathematics PHONE: (765) 494-6055 150 N. University Street FAX: (419) 821-0540 West Lafayette, IN 47907-2067 > -----Original Message----- > From: Schwimmer, Eric E *HS [mailto:EES2Y at hscmail.mcc.virginia.edu] > Sent: Thursday, March 02, 2006 2:42 PM > To: hobbit at hswn.dk > Subject: RE: [hobbit] RE: [SOLVED][hobbit] sshd notification in syslog > > > > Hrm, the first string (SSH-2.0-Sun_SSH_1.0.1) should > have worked (or at least, it works on my server running the openssh > version of sshd). > > Have you tried telneting into the port and typing the version number > in yourself? If it accepts it, you'll get some crazy diffie-hellman > text, otherwise it will spit a protocol mismatch line back at you. > > Also, silly question, but did you make sure to include to '\r\n' at > the end of the message? If you did, you might want to try messing > with that (changing it to just '\r' or '\n') because the protocol > error in your syslog looks a little weird (extra newline), so I'm > wondering if there isnt something wrong there. > > -Eric > > > -----Original Message----- > > From: McGraw, Robert P. [mailto:rmcgraw at purdue.edu] > > Sent: Thursday, March 02, 2006 2:19 PM > > To: hobbit at hswn.dk > > Subject: RE: [hobbit] RE: [SOLVED][hobbit] sshd notification in syslog > > > > I am having the same problem and trying to follow your instructions. > > > > > > > > I ran > > > > > > > > ##R##-zorn->[227] ##> ssh -V > > > > Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f > > > > > > > > To get the version number. > > > > > > > > I also ran telnet host 22 and got back the following > > > > > > > > SSH-2.0-Sun_SSH_1.0.1 > > > > > > > > I have tried the following > > > > > > > > SSH-2.0-Sun_SSH_1.0.1 > > > > Sun_SSH_1.1 > > > > Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f > > > > > > > > as the version number with no luck. > > > > > > > > I keep getting the following message log. > > > > > > > > Mar 2 14:03:47 zada.math.purdue.edu sshd[29349]: [ID 800047 > > auth.info] Bad protocol version identification 'Sun_SSH_1.1 > > > > Mar 2 14:03:47 zada.math.purdue.edu ' from 128.210.3.176 > > > > > > > > The only change in the log message is the version > > identification string. > > > > > > > > How do I find the right version number to use? > > > > > > > > Thanks > > > > > > > > Robert > > > > > > > > > > > > > > > > _____________________________________________________________________ > > > > Robert P. McGraw, Jr. > > > > Manager, Computer System > > EMAIL: rmcgraw at purdue.edu > > > > Purdue University > > ROOM: MATH-807 > > > > Department of Mathematics > > PHONE: (765) 494-6055 > > > > 150 N. University Street > > FAX: (419) 821-0540 > > > > West Lafayette, IN 47907-2067 > > > > ________________________________ > > > > From: thomas.seglard.enata at cnp.fr > > [mailto:thomas.seglard.enata at cnp.fr] > > Sent: Thursday, March 02, 2006 12:21 PM > > To: hobbit at hswn.dk > > Subject: [hobbit] RE: [SOLVED][hobbit] sshd notification in syslog > > > > > > > > > > Thank you ! > > > > the second option (the one you preferred) was a good bet ! > > I added the lines as you indicate and that's solved my problem. > > > > Best regards, > > > > Thomas Seglard > > > > "Schwimmer, Eric E *HS" <EES2Y at hscmail.mcc.virginia.edu> a > > écrit sur 02/03/2006 17:31:10 : > > > > > > > > Three posibilities, off the top of my head: > > > > > > On the client side: > > > 1. Install syslog-ng instead of ksyslogd, and > > > filter on the ip address of your hobbit server. > > > 2. Call your logrotate script (assuming you use one) > > > more often, and/or make it compress your old syslog > > > messages. > > > > > > On the hobbit server side: > > > (this is my preferred option) > > > 1. change your bb-services file ($HOBBIT/server/etc/bb-services) > > > so that ssh test sends the version string. I think that will > > > stop your sshd from complaining. > > > > > > ie.: > > > > > > [ssh|ssh1|ssh2] > > > send "SSH-2.0-OpenSSH_4.1\r\n" > > > expect "SSH" > > > options banner > > > port 22 > > > > > > > > > > To unsubscribe from the hobbit list, send an e-mail to > hobbit-unsubscribe at hswn.dk >

1 0

[hobbit] RE: [SOLVED][hobbit] sshd notification in syslog
by EES2Y＠hscmail.mcc.virginia.edu 02 Mar '06

02 Mar '06

Hrm, the first string (SSH-2.0-Sun_SSH_1.0.1) should have worked (or at least, it works on my server running the openssh version of sshd). Have you tried telneting into the port and typing the version number in yourself? If it accepts it, you'll get some crazy diffie-hellman text, otherwise it will spit a protocol mismatch line back at you. Also, silly question, but did you make sure to include to '\r\n' at the end of the message? If you did, you might want to try messing with that (changing it to just '\r' or '\n') because the protocol error in your syslog looks a little weird (extra newline), so I'm wondering if there isnt something wrong there. -Eric > -----Original Message----- > From: McGraw, Robert P. [mailto:rmcgraw at purdue.edu] > Sent: Thursday, March 02, 2006 2:19 PM > To: hobbit at hswn.dk > Subject: RE: [hobbit] RE: [SOLVED][hobbit] sshd notification in syslog > > I am having the same problem and trying to follow your instructions. > > > > I ran > > > > ##R##-zorn->[227] ##> ssh -V > > Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f > > > > To get the version number. > > > > I also ran telnet host 22 and got back the following > > > > SSH-2.0-Sun_SSH_1.0.1 > > > > I have tried the following > > > > SSH-2.0-Sun_SSH_1.0.1 > > Sun_SSH_1.1 > > Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f > > > > as the version number with no luck. > > > > I keep getting the following message log. > > > > Mar 2 14:03:47 zada.math.purdue.edu sshd[29349]: [ID 800047 > auth.info] Bad protocol version identification 'Sun_SSH_1.1 > > Mar 2 14:03:47 zada.math.purdue.edu ' from 128.210.3.176 > > > > The only change in the log message is the version > identification string. > > > > How do I find the right version number to use? > > > > Thanks > > > > Robert > > > > > > > > _____________________________________________________________________ > > Robert P. McGraw, Jr. > > Manager, Computer System > EMAIL: rmcgraw at purdue.edu > > Purdue University > ROOM: MATH-807 > > Department of Mathematics > PHONE: (765) 494-6055 > > 150 N. University Street > FAX: (419) 821-0540 > > West Lafayette, IN 47907-2067 > > ________________________________ > > From: thomas.seglard.enata at cnp.fr > [mailto:thomas.seglard.enata at cnp.fr] > Sent: Thursday, March 02, 2006 12:21 PM > To: hobbit at hswn.dk > Subject: [hobbit] RE: [SOLVED][hobbit] sshd notification in syslog > > > > > Thank you ! > > the second option (the one you preferred) was a good bet ! > I added the lines as you indicate and that's solved my problem. > > Best regards, > > Thomas Seglard > > "Schwimmer, Eric E *HS" <EES2Y at hscmail.mcc.virginia.edu> a > écrit sur 02/03/2006 17:31:10 : > > > > > Three posibilities, off the top of my head: > > > > On the client side: > > 1. Install syslog-ng instead of ksyslogd, and > > filter on the ip address of your hobbit server. > > 2. Call your logrotate script (assuming you use one) > > more often, and/or make it compress your old syslog > > messages. > > > > On the hobbit server side: > > (this is my preferred option) > > 1. change your bb-services file ($HOBBIT/server/etc/bb-services) > > so that ssh test sends the version string. I think that will > > stop your sshd from complaining. > > > > ie.: > > > > [ssh|ssh1|ssh2] > > send "SSH-2.0-OpenSSH_4.1\r\n" > > expect "SSH" > > options banner > > port 22 > > > >

1 0

[hobbit] RE: [SOLVED][hobbit] sshd notification in syslog
by rmcgraw＠purdue.edu 02 Mar '06

02 Mar '06

I am having the same problem and trying to follow your instructions. I ran ##R##-zorn->[227] ##> ssh -V Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f To get the version number. I also ran telnet host 22 and got back the following SSH-2.0-Sun_SSH_1.0.1 I have tried the following SSH-2.0-Sun_SSH_1.0.1 Sun_SSH_1.1 Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f as the version number with no luck. I keep getting the following message log. Mar 2 14:03:47 zada.math.purdue.edu sshd[29349]: [ID 800047 auth.info] Bad protocol version identification 'Sun_SSH_1.1 Mar 2 14:03:47 zada.math.purdue.edu ' from 128.210.3.176 The only change in the log message is the version identification string. How do I find the right version number to use? Thanks Robert _____________________________________________________________________ Robert P. McGraw, Jr. Manager, Computer System EMAIL: rmcgraw at purdue.edu Purdue University ROOM: MATH-807 Department of Mathematics PHONE: (765) 494-6055 150 N. University Street FAX: (419) 821-0540 West Lafayette, IN 47907-2067 _____ From: thomas.seglard.enata at cnp.fr [mailto:thomas.seglard.enata at cnp.fr] Sent: Thursday, March 02, 2006 12:21 PM To: hobbit at hswn.dk Subject: [hobbit] RE: [SOLVED][hobbit] sshd notification in syslog Thank you ! the second option (the one you preferred) was a good bet ! I added the lines as you indicate and that's solved my problem. Best regards, Thomas Seglard "Schwimmer, Eric E *HS" <EES2Y at hscmail.mcc.virginia.edu> a écrit sur 02/03/2006 17:31:10 : > > Three posibilities, off the top of my head: > > On the client side: > 1. Install syslog-ng instead of ksyslogd, and > filter on the ip address of your hobbit server. > 2. Call your logrotate script (assuming you use one) > more often, and/or make it compress your old syslog > messages. > > On the hobbit server side: > (this is my preferred option) > 1. change your bb-services file ($HOBBIT/server/etc/bb-services) > so that ssh test sends the version string. I think that will > stop your sshd from complaining. > > ie.: > > [ssh|ssh1|ssh2] > send "SSH-2.0-OpenSSH_4.1\r\n" > expect "SSH" > options banner > port 22

1 0