XMC/NetSight connects to switch every 15 mins

[Stefan_K_]

Hello,

it seems that my XMC logs in to all the switches via SSH every 15 minutes.

12/30/2020 11:21:30.38 <Info:AAA.logout> Administrative account (netsight) logout from ssh (10.100.0.17)
12/30/2020 11:21:27.17 <Info:AAA.LogSsh> Msg from Master : Did password authentication for user netsight (10.100.0.17)
12/30/2020 11:21:27.17 <Info:AAA.authPass> Login passed for user netsight through ssh (10.100.0.17)
12/30/2020 11:06:31.44 <Info:AAA.logout> Administrative account (netsight) logout from ssh (10.100.0.17)
12/30/2020 11:06:28.22 <Info:AAA.LogSsh> Msg from Master : Did password authentication for user netsight (10.100.0.17)
12/30/2020 11:06:28.22 <Info:AAA.authPass> Login passed for user netsight through ssh (10.100.0.17)
12/30/2020 10:51:30.29 <Info:AAA.logout> Administrative account (netsight) logout from ssh (10.100.0.17)
12/30/2020 10:51:27.08 <Info:AAA.LogSsh> Msg from Master : Did password authentication for user netsight (10.100.0.17)
12/30/2020 10:51:27.08 <Info:AAA.authPass> Login passed for user netsight through ssh (10.100.0.17)
12/30/2020 10:36:31.33 <Info:AAA.logout> Administrative account (netsight) logout from ssh (10.100.0.17)
12/30/2020 10:36:28.11 <Info:AAA.LogSsh> Msg from Master : Did password authentication for user netsight (10.100.0.17)
12/30/2020 10:36:28.11 <Info:AAA.authPass> Login passed for user netsight through ssh (10.100.0.17)
12/30/2020 10:21:31.36 <Info:AAA.logout> Administrative account (netsight) logout from ssh (10.100.0.17)
12/30/2020 10:21:28.14 <Info:AAA.LogSsh> Msg from Master : Did password authentication for user netsight (10.100.0.17)
12/30/2020 10:21:28.14 <Info:AAA.authPass> Login passed for user netsight through ssh (10.100.0.17)
12/30/2020 10:06:30.31 <Info:AAA.logout> Administrative account (netsight) logout from ssh (10.100.0.17)
12/30/2020 10:06:27.10 <Info:AAA.LogSsh> Msg from Master : Did password authentication for user netsight (10.100.0.17)

I’m not entirely sure, but I believe that it started after updating to 8.5.3.
Does someone of you guys see the same behaviour? Or do you have any idea what could cause this login?

Best regards
Stefan

[Dan15]

For completeness:

This is the article for changing the login frequency:

https://extremeportal.force.com/ExtrArticleDetail?an=000058114

[Stefan_K_]

Hi Dany,

yes, we have been using Analytics and sFlow is configured on the switches. The Analytics Engine is down for some time in this Environment, but it still is configured inside XMC.
 

Hi Tomasz,

This indeed helped me - I didn’t think about cli journal at all. The executed commands are:

disable clipaging
show access-list counter ingress
show access-list counter egress
show sflow statistics

After that it was clear, that it indeed had something to do with Analytics and I started digging there. The switches are configured as “Application Telemetry Sources” (Analytics → Configuration → Engines → Appliaction Telemetry Sources). I deleted them from there (which also removed the whole sFlow config from the switch) and now no more logins occur. 

Thanks, Dany and Tomasz! 🙂  

Best regards
Stefan

[Tomasz]

Hi Stefan,

If we talk about EXOS, you can use ‘show cli journal’ to check if XMC is really doing anything over SSH down there.

I think Telemetry should not be doing this, only when you trigger this from Analytics configuration section by adding Telemetry source, then XMC sets up an ACL for mirrors and it should be done. I hope so. 😉

I’m looking at 8.5.3 relnotes… XMC moves to the cloud, oof! But I don’t see anything special that could point to every-quarter login:https://emc.extremenetworks.com/content/common/releasenotes/release_notes/suite_release_notes.html

Hope that helps,

Tomasz

[Dan15 · Accepted solution]

Are you using Analytics with App Telemetry? I have discovered the same 15 min logins to all Switches with App Telemetry active. The purpose of this logins is to get the App Telemetry statistics. It works as designed. I was able to lower the frequency setting a bit to once per hour in the DB together with GTAC.