cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1166
Views
0
Helpful
2
Replies

Prime Infrastructure 3.1 logs in repeatedly via SSH to devices every three minutes

Chad Hoover
Level 1
Level 1

I am seeing PI log in to devices on the network via SSH over and over again with no further action every three minutes. I cannot find the setting that is causing this, nor do I know the reason for it. Any enlightenment would be appreciated.

From router log:

*May 20 18:59:17.013 UTC: %PARSER-5-CFGLOG_LOGGEDCMD: User:Username logged command:!exec: enable
*May 20 19:02:22.142 UTC: %PARSER-5-CFGLOG_LOGGEDCMD: User:Username logged command:!exec: enable
*May 20 19:05:26.989 UTC: %PARSER-5-CFGLOG_LOGGEDCMD: User:Username logged command:!exec: enable
*May 20 19:08:32.188 UTC: %PARSER-5-CFGLOG_LOGGEDCMD: User:Username logged command:!exec: enable
*May 20 19:11:37.396 UTC: %PARSER-5-CFGLOG_LOGGEDCMD: User:Username logged command:!exec: enable
*May 20 19:14:42.722 UTC: %PARSER-5-CFGLOG_LOGGEDCMD: User:Username logged command:!exec: enable
*May 20 19:17:47.247 UTC: %PARSER-5-CFGLOG_LOGGEDCMD: User:Username logged command:!exec: enable
*May 20 19:20:52.231 UTC: %PARSER-5-CFGLOG_LOGGEDCMD: User:Username logged command:!exec: enable
*May 20 19:23:57.515 UTC: %PARSER-5-CFGLOG_LOGGEDCMD: User:Username logged command:!exec: enable
*May 20 19:27:02.437 UTC: %PARSER-5-CFGLOG_LOGGEDCMD: User:Username logged command:!exec: enable
*May 20 19:30:07.513 UTC: %PARSER-5-CFGLOG_LOGGEDCMD: User:Username logged command:!exec: enable
*May 20 19:33:12.511 UTC: %PARSER-5-CFGLOG_LOGGEDCMD: User:Username logged command:!exec: enable
*May 20 19:36:17.524 UTC: %PARSER-5-CFGLOG_LOGGEDCMD: User:Username logged command:!exec: enable
*May 20 19:39:22.553 UTC: %PARSER-5-CFGLOG_LOGGEDCMD: User:Username logged command:!exec: enable
*May 20 19:42:27.872 UTC: %PARSER-5-CFGLOG_LOGGEDCMD: User:Username logged command:!exec: enable

2 Replies 2

Marvin Rhoads
Hall of Fame
Hall of Fame

It looks like what I might expect from a credential verification job. That is normally only done on an ad hoc basis though.

It also happens as part of an inventory collection. It could possibly be kicked off as part of event-based inventory collection. You can check if that is enabled under "Administration > Settings > System Settings > Inventory > Inventory"

bolamiposi
Level 1
Level 1

Chad,

Did you ever got to resolve this issue?