several SSH errors with Zabbix running

[rezilient]

We have been getting the following errors in syslog:

cp sshd[10549]: error: Could not get shadow information for NOUSER
cp sshd[5977]: fatal: Read from socket failed: Connection reset by peer

My host says the following:

Seems like zabbix is checking if the port is running and logging off in a unclean fashion, killing the coonection causing the read from socket to fail because the socket is gone. The Zabbix monitoring seems to be the culprit here. SSH is working fine.

Does this seems accurate? Any idea how to fix this?

Thanks.
Reza

[rezilient]

Anyone have an idea? Is that caused by Zabbix?

[Alexei]

Yes, it may be caused by ZABBIX SSH check. I see nothing wrong here.

[rezilient]

But it's happening every minute and spamming my logs, is Zabbix terminating the connection in an "unclean" fashion, and if so how do I fix that? Thanks.

[sterno]

If you're getting too many log errors from the ssh monitor you can either disable it or make it run less often. Personally, I don't find the TCP checks to be useful in most situations so I disable them all.

[rezilient]

cp sshd[10549]: error: Could not get shadow information for NOUSER

^ this one is from constant dictionary attacks from a couple Asia Pacific IPs, since being blocked they have stopped.

cp sshd[5977]: fatal: Read from socket failed: Connection reset by peer

^ this is from Zabbix. I might do as you suggested and just turn off those checks. Thanks!