One of the devices on my network is generating RCMD-4-RSHPORTATTEMPT syslog messages, daily and at a fixed hour, originating from the ciscoworks server IP address.
Does ciscoworks (LMS2.5.1) initiate RSH connection to the devices it monitors during its acquisitions or archiving processes? or should i worry about those syslog messages?
Thanks a lot.
LMS can initiate RCP sessions to the device (and these use the same port as rsh). You should check your protocol order at RME > Admin > Config Mgmt > Transport Settings to make sure RCP is excluded from all of the config operations if you do not with to use RCP.