While digging for the cause of another problem, we came across multiple occurrences of
Oct 25 16:44:07 host sshd[27010]: Connection closed by UNKNOWN
in /var/log/secure at 1 minute intervals which corresponds to the check interval of the "SSH server is running" Item. Disabling this item in the host's "Linux" template (a modded version of Template_Linux) stopped the errors.
Q: Is it right for ssh checks to attempt logins that result in errors like this? How are ssh service checks actually performed by agentd and by which user (presumably "zabbix")?
thanks!
- c sawyer
Oct 25 16:44:07 host sshd[27010]: Connection closed by UNKNOWN
in /var/log/secure at 1 minute intervals which corresponds to the check interval of the "SSH server is running" Item. Disabling this item in the host's "Linux" template (a modded version of Template_Linux) stopped the errors.
Q: Is it right for ssh checks to attempt logins that result in errors like this? How are ssh service checks actually performed by agentd and by which user (presumably "zabbix")?
thanks!
- c sawyer