RTMT To Monitor Remote SSH Connections

[Kensith 2016]

We would like to monitor administrators who will be accessing the CLI remotely via SSH. Is there a way to send email alerts on unsuccessful and successful logins through RTMT?

[Jitender Bhandari]

Hi,

RTMT has a System Alert for Authentication that you can use.

HTH

JB

[Kensith 2016]

Does this just alert on failed attempts or both failed & successful? We need both.

[Jitender Bhandari]

Just the failed attempts depending on what threshold you have set for them.

JB

[Jitender Bhandari]

You can also check the same in Audit logs which goes more granular

http://www.netcraftsmen.com/audit-logs-on-cisco-unified-communications-manager-cucm/

HTH

JB

[Jitender Bhandari]

some more detail that you can go through

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/service/8_5_1/rtmt/RTMT/rtalsys.html#wp1053071

https://supportforums.cisco.com/discussion/11435716/how-disable-auth-failed-rtmt-alert

http://www.gossamer-threads.com/lists/cisco/voip/117606

https://supportforums.cisco.com/discussion/12044971/rtmt-alert-severitymatch-critical-pamsucceedifsshdauth-error-retrieving

HTH

JB

[Kensith 2016]

Thanks JB

I think SyslogStringMatchFound will work we will test. Thanks for the information.

[Jitender Bhandari]

Happy to help,

You can mark the forum as answered if you dont have further questions.

JB