Alert sshd(pam_unix)[17605]: check pass; user unknown

Unanswered Question
Feb 27th, 2009
User Badges:


I get this message often in my syslog:

IPTel On Fri Feb 27 09:38:31 CET 2009 on node ditelcm1, the following SyslogSeverityMatchFound events generated: SeverityMatch - Alert sshd(pam_unix)[17605]: check pass; user unknown

What does it mean exactly?



  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
irisrios Thu, 03/05/2009 - 06:39
User Badges:
  • Silver, 250 points or more

This error generally means that somebody on the network is trying to access your CCM via SSH and it is failing. This could also be indicative of one of the administrators trying the wrong password a couple of times and eventually were logged in.

Ndudi Onwufor Mon, 02/22/2016 - 01:56
User Badges:
Hello Iris, I get the same message but please how do i get to the login details of the administrator. Thanks Ndudi
Deepak Rawat Mon, 02/22/2016 - 02:29
User Badges:
  • Cisco Employee,

You will need to pull Audit logs from RTMT in order to find out the details. Refer to below links for more details:

Please note the above logs will only show you the detailed information if set to debug. In case, if they are not as of now then probably you might not be able to see the required information




This Discussion