zabbix checks ssh

[droog72]

Hi,
Just want to be sure I'm understanding something correctly -

What exactly is the difference between these two items?
SSH server is down on {HOSTNAME}
Sshd is not running on {HOSTNAME}

I'm seeing the message below over and over on my UNIX hosts I'm monitoring w/ Zabbix.
sshd[21726]: [ID 800047 auth.crit] fatal: Read from socket failed: Connection reset by peer


I thought I read somewhere the zabbix agent is disconnecting too quickly or something, not cleanly exiting w/ these messages as the end result???
Should I disable these items in the host checks, and check if ssh is running from the server w/ a simple check rather than w/ the agent?

thanks in advance

[sterno]

The first is probably a TCP connection to port 22 and the second is probably an agent check for processes named "sshd". The port check isn't an actual ssh client connection so you'll get error messages in the logs if you let it run, if you don't like the error message disable the monitor.

Personally, I don't do either one. It doesn't matter if sshd is running or listening, it matters if a user can log in to the server. In my environment that's going to be difficult to check properly because of our authentication mechanism and the application admins are the only ones who need to log in, so I don't worry about it.