Funny you should mention.

From the SSH list where i posted the same question (secureshell at securityfocus dot com):

"Generally, these are caused when a machine connects to the SSH port, but doesn't attempt login. they're very common if, for example, you're making periodic connections to port 22 via some kind of monitoring system. However, any connection which never gets around to authenticating, from a port scan to a user connecting and walking away for a few minutes, can cause this message."

So... yeah.

thomas.seglard.enata at cnp.fr wrote:

Hello,

since deployment of hobbit's client on 200 servers (hpux, aix, sun, linux), I got this message in syslog :

Feb 13 12:05:44 psa089 sshd[9813]: Did not receive identification string from 158.157.156.91 Feb 13 12:06:47 psa089 sshd[9980]: Did not receive identification string from 158.157.156.91 Feb 13 12:07:49 psa089 sshd[10006]: Did not receive identification string from 158.157.156.91 Feb 13 12:08:17 psa089 sshd[10012]: Did not receive identification string from 158.157.156.91 Feb 13 12:08:48 psa089 sshd[10078]: Did not receive identification string from 158.157.156.91 Feb 13 12:09:52 psa089 sshd[10564]: Did not receive identification string from 158.157.156.91 Feb 13 12:10:55 psa089 sshd[10871]: Did not receive identification string from 158.157.156.91 Feb 13 12:11:57 psa089 sshd[10987]: Did not receive identification string from 158.157.156.91 Feb 13 12:13:00 psa089 sshd[11060]: Did not receive identification string from 158.157.156.91 Feb 13 12:13:20 psa089 sshd[11065]: Did not receive identification string from 158.157.156.91 Feb 13 12:14:02 psa089 sshd[11166]: Did not receive identification string from 158.157.156.91 Feb 13 12:15:06 psa089 sshd[11297]: Did not receive identification string from 158.157.156.91

Ip address is the one from my hobbit's server (158.157.156.91). This message do not specify that the ssh test failed, so I'm not worried about this. The main problem is the size of syslog and /var is growing rapidly ! Anyone knows how to prevent this message to be display in syslog ? Thank you !

Thomas Seglard (I'm using Lotus Notes, what a challenge...)

Ce message (et toutes ses pieces jointes eventuelles) est confidentiel et etabli a l'intention exclusive de ses destinataires. Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. L'internet ne permettant pas d'assurer l'integrite de ce message, CNP Assurances et ses filiales declinent toute responsabilite au titre de ce message, s'il a ete altere, deforme ou falsifie.

---

This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. E-mails are susceptible to alteration. Neither CNP Assurances nor any of its subsidiaries or affiliates shall be liable for the message if altered, changed or falsified.

-- Rob Munsch Solutions For Progress IT

Thanxs!

i guess we will love the next versions ;-)

best Mathias

In message <20060306101151.GE30489 at hswn.dk>, Henrik Stoerner writes:

On Thu, Mar 02, 2006 at 09:44:02AM +0100, brandste at hebis.de wrote:

...

Using bb-hosts with multiple hosts elongates to quiet a view lines ;-)

But using different tests, slas, maintenance windows and stuff easy generates a lot of columns...and the line gets hard to read and to edit. (okok....i know about sed ;-) )

Is there a possibility to use variables as in hobbit-alerts?

So one could group:

$locationA-sla="DOWNTIME=W:0700:0730 REPORTTIME=W:0731:0659 WARNPCT:95.0

"

...

$locationA-service="NK:conn ftp ssh imap otherstuff route:router1,router 2,router3"

1.1.1.1 usermonitor # http://www.userurl.com $locationA-sla $locationA-s ervice 1.1.1.2 usermonitor2 # http://www.userurl2.com $locationA-sla $locationA- service

Not currently.

I'm working on several enhancements to the configuration library, because frankly the "bb-hosts" format has been pushed too far. It was OK for Big Brother, but Hobbit has just evolved to have way too many configuration options. We need something that allows using templates, macros and such. And I also very much want to cut the connection between the configuration of e.g. network tests and SLA's, and the configuration of the webpage layout - that would allow for a much more flexible setup of the Hobbit display.

Regards, Henrik

To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk