cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1346
Views
5
Helpful
3
Replies
Beginner

Syslog SSH_Close

Hi all.
It was he setting a cisco switch 2960S, the ssh logging, the configuration I have is:

logging trap notifications
logging x.x.x.x
snmp-server community public RO
snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart
snmp-server enable traps tty
snmp-server enable traps cluster
snmp-server enable traps config-copy
snmp-server enable traps config
snmp-server enable traps entity
snmp-server enable traps cpu threshold
snmp-server enable traps bridge newroot topologychange
snmp-server enable traps stpx inconsistency root-inconsistency loop-inconsistency
snmp-server enable traps syslog
snmp-server enable traps flash insertion removal
snmp-server enable traps port-security
snmp-server enable traps envmon fan shutdown supply temperature status
snmp-server enable traps stackwise
snmp-server enable traps vlan-membership
snmp-server enable traps mac-notification change move threshold
snmp-server host x.x.x.x version 2c public
snmp-server host x.x.x.x version 2c public  tty config entity cpu syslog stackwise mac-notification snmp

Additionally


login on-failure log every 1
login on-success log every 1
ip sla enable reaction-alerts
logging history notifications
logging trap debugging
logging facility local4
ip ssh logging event

In the log, shows me the following

11:49:52 2016/03/11 SNMPv2-SMI::enterprises.9.9.41.2.0.1 Normal "Status Events" x.x.x.x - ZBXTRAP x.x.x.x
 clogHistFacility  : SSH
 clogHistSeverity  : 6
 clogHistMsgName   : SSH2_SESSION
 clogHistMsgText   : SSH2 Session request from x.x.x.x (tty = 0) using crypto cipher 'aes256-cbc', hmac 'hmac-sha1' Succeeded
 clogHistTimestamp : 61:14:30:02.43

 clogHistFacility  : SEC_LOGIN
 clogHistSeverity  : 6
 clogHistMsgName   : LOGIN_SUCCESS
 clogHistMsgText   : Login Success [user:xxxx] [Source: x.x.x.x] [localport: 22] at 14:30:12 UTC Sat May 1 1993
 clogHistTimestamp : 61:14:30:12.85

11:50:03 2016/03/11 SNMPv2-SMI::enterprises.9.9.41.2.0.1 Normal "Status Events" x.x.x.x - ZBXTRAP 172.18.0.23
 clogHistFacility  : SSH
 clogHistSeverity  : 6
 clogHistMsgName   : SSH2_USERAUTH
 clogHistMsgText   : User 'xxx' authentication for SSH2 Session from x.x.x.x (tty = 0) using crypto cipher 'aes256-cbc', hmac 'hmac-sha1' Succeeded
 clogHistTimestamp : 61:14:30:12.85

When I exit the terminal ssh, ssh does not show the SSH2_Close, to know when the user disconnected

I need to configure something else?

I hope you can help me..

Everyone's tags (1)
1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Cisco Employee

Fantastic! Glad the upgrade

Fantastic! Glad the upgrade solved the problem! Thank you for taking the time to post back and let us know that the issue was with that version of code (+5 from me). 

Since your issue is resolved, you should mark the thread as "answered" :)

Thank you for rating helpful posts!

View solution in original post

3 REPLIES 3
Highlighted
Cisco Employee

Hmm, your config looks good.

Hmm, your config looks good. I just tested this in my lab and I ams seeing the following log message:

Mar 12 16:15:29.245: %SSH-5-SSH2_CLOSE: SSH2 Session from x.x.x.x (tty = 0) for user 'removed' using crypto cipher 'aes256-cbc', hmac 'hmac-sha1' closed

Here is my config

Perhaps you are hitting a bug?

NS-3560c-01# sh run | i logging
logging buffered informational
logging console warnings
ip ssh logging events
logging source-interface Vlan30
logging host x.x.x.x

Thank you for rating helpful posts!

Highlighted
Beginner

Hi Neno.

Hi Neno.

First thank you for your help. I added the command "logging buffered informational" and "configure warnings" and the problem was the same.

As I have another 2960S, updated the IOS version 12.2 (55) SE7 and began to run correctly.

Apparently version 12.2 (55) SE5 has a bug with SSH, being you need to upgrade to a higher version.

Highlighted
Cisco Employee

Fantastic! Glad the upgrade

Fantastic! Glad the upgrade solved the problem! Thank you for taking the time to post back and let us know that the issue was with that version of code (+5 from me). 

Since your issue is resolved, you should mark the thread as "answered" :)

Thank you for rating helpful posts!

View solution in original post