topic Re: XMC/NetSight connects to switch every 15 mins in ExtremeCloud IQ- Site Engine Management Center

XMC/NetSight connects to switch every 15 mins

Stefan_K_ — Wed, 30 Dec 2020 18:37:20 GMT

Hello,

it seems that my XMC logs in to all the switches via SSH every 15 minutes.

12/30/2020 11:21:30.38 <Info:AAA.logout> Administrative account (netsight) logout from ssh (10.100.0.17)
12/30/2020 11:21:27.17 <Info:AAA.LogSsh> Msg from Master : Did password authentication for user netsight (10.100.0.17)
12/30/2020 11:21:27.17 <Info:AAA.authPass> Login passed for user netsight through ssh (10.100.0.17)
12/30/2020 11:06:31.44 <Info:AAA.logout> Administrative account (netsight) logout from ssh (10.100.0.17)
12/30/2020 11:06:28.22 <Info:AAA.LogSsh> Msg from Master : Did password authentication for user netsight (10.100.0.17)
12/30/2020 11:06:28.22 <Info:AAA.authPass> Login passed for user netsight through ssh (10.100.0.17)
12/30/2020 10:51:30.29 <Info:AAA.logout> Administrative account (netsight) logout from ssh (10.100.0.17)
12/30/2020 10:51:27.08 <Info:AAA.LogSsh> Msg from Master : Did password authentication for user netsight (10.100.0.17)
12/30/2020 10:51:27.08 <Info:AAA.authPass> Login passed for user netsight through ssh (10.100.0.17)
12/30/2020 10:36:31.33 <Info:AAA.logout> Administrative account (netsight) logout from ssh (10.100.0.17)
12/30/2020 10:36:28.11 <Info:AAA.LogSsh> Msg from Master : Did password authentication for user netsight (10.100.0.17)
12/30/2020 10:36:28.11 <Info:AAA.authPass> Login passed for user netsight through ssh (10.100.0.17)
12/30/2020 10:21:31.36 <Info:AAA.logout> Administrative account (netsight) logout from ssh (10.100.0.17)
12/30/2020 10:21:28.14 <Info:AAA.LogSsh> Msg from Master : Did password authentication for user netsight (10.100.0.17)
12/30/2020 10:21:28.14 <Info:AAA.authPass> Login passed for user netsight through ssh (10.100.0.17)
12/30/2020 10:06:30.31 <Info:AAA.logout> Administrative account (netsight) logout from ssh (10.100.0.17)
12/30/2020 10:06:27.10 <Info:AAA.LogSsh> Msg from Master : Did password authentication for user netsight (10.100.0.17)

I’m not entirely sure, but I believe that it started after updating to 8.5.3.
Does someone of you guys see the same behaviour? Or do you have any idea what could cause this login?

Best regards
Stefan

Re: XMC/NetSight connects to switch every 15 mins

PeterK — Wed, 30 Dec 2020 19:21:33 GMT

hmm...not seen in this density yet. Could this have something to do with “collect device / port statistics”? Or do you have some workflows running?

Maybe, you can have a look for 900 sec timer in XMC options.

Re: XMC/NetSight connects to switch every 15 mins

Stefan_K_ — Wed, 30 Dec 2020 22:25:00 GMT

Hi Peter,

thanks for your anser!

No workflows.
Collector was my first guess also, so I disabled everything under “Options → Management Center Collector”. The login still happens. (And I have other installations where Collectors are enabled and I don’t see any logins - guess it’s done via SNMP.)

No way to check what triggers the login?

Re: XMC/NetSight connects to switch every 15 mins

PeterK — Wed, 30 Dec 2020 23:29:49 GMT

xmc uses ssh logins for backups and fw-upload.

I think you know that, but have you checked that this isn’t the case?

Maybe you could set xmc logging to a higher level?

Re: XMC/NetSight connects to switch every 15 mins

Dan15 — Tue, 05 Jan 2021 01:13:01 GMT

Are you using Analytics with App Telemetry? I have discovered the same 15 min logins to all Switches with App Telemetry active. The purpose of this logins is to get the App Telemetry statistics. It works as designed. I was able to lower the frequency setting a bit to once per hour in the DB together with GTAC.

Re: XMC/NetSight connects to switch every 15 mins

Tomasz — Tue, 05 Jan 2021 20:28:54 GMT

Hi Stefan,

If we talk about EXOS, you can use ‘show cli journal’ to check if XMC is really doing anything over SSH down there.

I think Telemetry should not be doing this, only when you trigger this from Analytics configuration section by adding Telemetry source, then XMC sets up an ACL for mirrors and it should be done. I hope so. 😉

I’m looking at 8.5.3 relnotes… XMC moves to the cloud, oof! But I don’t see anything special that could point to every-quarter login:https://emc.extremenetworks.com/content/common/releasenotes/release_notes/suite_release_notes.html

Hope that helps,

Tomasz

Re: XMC/NetSight connects to switch every 15 mins

Stefan_K_ — Wed, 06 Jan 2021 02:26:07 GMT

Hi Dany,

yes, we have been using Analytics and sFlow is configured on the switches. The Analytics Engine is down for some time in this Environment, but it still is configured inside XMC.

Hi Tomasz,

This indeed helped me - I didn’t think about cli journal at all. The executed commands are:

disable clipaging
show access-list counter ingress
show access-list counter egress
show sflow statistics

After that it was clear, that it indeed had something to do with Analytics and I started digging there. The switches are configured as “Application Telemetry Sources” (Analytics → Configuration → Engines → Appliaction Telemetry Sources). I deleted them from there (which also removed the whole sFlow config from the switch) and now no more logins occur.

Thanks, Dany and Tomasz! 🙂

Best regards
Stefan

Re: XMC/NetSight connects to switch every 15 mins

Dan15 — Wed, 06 Jan 2021 16:28:15 GMT

For completeness:

This is the article for changing the login frequency:

https://extremeportal.force.com/ExtrArticleDetail?an=000058114