cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
143
Views
0
Helpful
7
Replies

RTMT To Monitor Remote SSH Connections

Kensith 2016
Beginner
Beginner

We would like to monitor administrators who will be accessing the CLI remotely via SSH. Is there a way to send email alerts on unsuccessful and successful logins through RTMT?

7 Replies 7

Jitender Bhandari
Cisco Employee
Cisco Employee

Hi,

RTMT has a System Alert for Authentication that you can use.

HTH

JB

Does this just alert on failed attempts or both failed & successful? We need both.

Just the failed attempts depending on what threshold you have set for them.

JB

You can also check the same in Audit logs which goes more granular

http://www.netcraftsmen.com/audit-logs-on-cisco-unified-communications-manager-cucm/

HTH

JB

some more detail that you can go through

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/service/8_5_1/rtmt/RTMT/rtalsys.html#wp1053071

https://supportforums.cisco.com/discussion/11435716/how-disable-auth-failed-rtmt-alert

http://www.gossamer-threads.com/lists/cisco/voip/117606

https://supportforums.cisco.com/discussion/12044971/rtmt-alert-severitymatch-critical-pamsucceedifsshdauth-error-retrieving

HTH

JB

Thanks JB

I think SyslogStringMatchFound will work we will test. Thanks for the information.

Happy to help,

You can mark the forum as answered if you dont have further questions.

JB

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers