Re: monitoring sshd generates socket failures in auth.log

[Martin Pala]

Hello Marcus,

can you try with Monit 5.9? There was fix in Monit 5.8.1 for socket shutdown:

--8<--
Fixed: Do graceful TCP close for TCP/UDP port test instead of RST.
--8<--

This RST-on-close may be related to sshd's message.

Regards,
Martin


On 01 Oct 2014, at 12:48, Marcus Mülbüsch <address@hidden> wrote:

> Hello list,
> 
>   I don't know, when it started, but in /var/log/auth.log I now have error 
> messages like this one (I set "LogLevel DBUG" for sshd):
> 
>> debug1: SSH2_MSG_KEXINIT sent [preauth]
>> fatal: Read from socket failed: Connection reset by peer [preauth]
> 
>   This is generated by the line
> 
> > if failed port 22 protocol ssh then restart
> 
> in the monitrc-file
> 
>   It doesn't make a difference, whether I specify a host or not (i.e. "host 
> localhost" or "host 127.0.0.1" or "host 192.168.1.1")
> 
>   monit does not record anything out of the ordinary: sshd is fully 
> functional for it.
> 
>   Additionally a ssh-connect from the host itself generates no error:
> 
>> # ssh localhost
>> debug1: SSH2_MSG_KEXINIT sent [preauth]
>> debug1: SSH2_MSG_KEXINIT received [preauth]
> 
>   What can I do to stop filling my logfile with "fatal" errors?
> 
>   I do have that problem with monit-5.5 and monit-5.8 on gentoo; I do not 
> have a similar entry in a log file with monit-5.2.5 on a centos-5 server nor 
> with a monit-5.5 on a Ubuntu 10.04.4 LTS.
> 
>   So it has probably something to do with gentoo and openrc? But 
> duckduckgoing around provided no useful hints.
> 
> Marcus
> 
> -- 
> 
> Marcus Mülbüsch
> Systemadministration
> 
> fon: +49 (0)208 9898 98-49
> fax: +49 (0)208 9898 98-949
> _______________________________________
> 
> AS-Infodienste GmbH
> Hardenbergstr. 18b
> 45472 Mülheim
> 
> mail: address@hidden
> web: www.as-infodienste.de
> fb:  www.facebook.com/ASInfodienste
> 
> Kontakt zum Telefonsupport für
> Servicerufnummern:    +49 (0)208 9898 98-11
> Telefonsekretariat:   +49 (0)208 9898 98-12
> SMS-Dienstleistungen: +49 (0)208 9898 98-13
> Telefonkonferenzen:   +49 (0)208 9898 98-17
> 
> Unternehmenszentrale:
> fon: +49 (0)208 9898 98-00
> fax: +49 (0)208 9898 98-900
> _______________________________________
> 
> Unternehmensangaben:
> 
> Die AS-Infodienste GmbH ist im
> Handelsregister des AG Duisburg
> unter HRB 16061 registriert.
> 
> Geschäftsführer:
> Andreas Schlacht
> Alexander Stellmach
> 
> USt.-ID: DE 813295188
> St.-Nr.: 120/5742/0589
> ________________________________________
> 
> Wir sind Mitglied im Wirtschaftsrat
> der Deutschen Umweltstiftung.
>       
> Wir nutzen klimafreundlichen Ökostrom
> von NATURSTROM. Damit leisten wir
> einen Beitrag zum Umweltschutz.
> 
> --
> To unsubscribe:
> https://lists.nongnu.org/mailman/listinfo/monit-general