cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3596
Views
5
Helpful
3
Replies

Alert sshd(pam_unix)[17605]: check pass; user unknown

kurtdeneef
Level 1
Level 1

Hi,

I get this message often in my syslog:

IPTel On Fri Feb 27 09:38:31 CET 2009 on node ditelcm1, the following SyslogSeverityMatchFound events generated: SeverityMatch - Alert sshd(pam_unix)[17605]: check pass; user unknown

What does it mean exactly?

Thanks,

Kurt

3 Replies 3

irisrios
Level 6
Level 6

This error generally means that somebody on the network is trying to access your CCM via SSH and it is failing. This could also be indicative of one of the administrators trying the wrong password a couple of times and eventually were logged in.

Hello Iris, I get the same message but please how do i get to the login details of the administrator. Thanks Ndudi

You will need to pull Audit logs from RTMT in order to find out the details. Refer to below links for more details:

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/service/7_1_2/admin/Serviceability/saaulog.html

https://supportforums.cisco.com/discussion/10853871/how-see-access-log-call-manager-7-administration

Please note the above logs will only show you the detailed information if set to debug. In case, if they are not as of now then probably you might not be able to see the required information

Regards

Deepak

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: