ciscoworks RSHELL

[ngholmieh]

One of the devices on my network is generating RCMD-4-RSHPORTATTEMPT syslog messages, daily and at a fixed hour, originating from the ciscoworks server IP address.

Does ciscoworks (LMS2.5.1) initiate RSH connection to the devices it monitors during its acquisitions or archiving processes? or should i worry about those syslog messages?

Thanks a lot.

Nathalie

[Joe Clarke · Accepted solution]

LMS can initiate RCP sessions to the device (and these use the same port as rsh). You should check your protocol order at RME > Admin > Config Mgmt > Transport Settings to make sure RCP is excluded from all of the config operations if you do not with to use RCP.