XMC/NetSight connects to switch every 15 mins

[Stefan_K_]

Hello,

it seems that my XMC logs in to all the switches via SSH every 15 minutes.

12/30/2020 11:21:30.38 <Info:AAA.logout> Administrative account (netsight) logout from ssh (10.100.0.17)
12/30/2020 11:21:27.17 <Info:AAA.LogSsh> Msg from Master : Did password authentication for user netsight (10.100.0.17)
12/30/2020 11:21:27.17 <Info:AAA.authPass> Login passed for user netsight through ssh (10.100.0.17)
12/30/2020 11:06:31.44 <Info:AAA.logout> Administrative account (netsight) logout from ssh (10.100.0.17)
12/30/2020 11:06:28.22 <Info:AAA.LogSsh> Msg from Master : Did password authentication for user netsight (10.100.0.17)
12/30/2020 11:06:28.22 <Info:AAA.authPass> Login passed for user netsight through ssh (10.100.0.17)
12/30/2020 10:51:30.29 <Info:AAA.logout> Administrative account (netsight) logout from ssh (10.100.0.17)
12/30/2020 10:51:27.08 <Info:AAA.LogSsh> Msg from Master : Did password authentication for user netsight (10.100.0.17)
12/30/2020 10:51:27.08 <Info:AAA.authPass> Login passed for user netsight through ssh (10.100.0.17)
12/30/2020 10:36:31.33 <Info:AAA.logout> Administrative account (netsight) logout from ssh (10.100.0.17)
12/30/2020 10:36:28.11 <Info:AAA.LogSsh> Msg from Master : Did password authentication for user netsight (10.100.0.17)
12/30/2020 10:36:28.11 <Info:AAA.authPass> Login passed for user netsight through ssh (10.100.0.17)
12/30/2020 10:21:31.36 <Info:AAA.logout> Administrative account (netsight) logout from ssh (10.100.0.17)
12/30/2020 10:21:28.14 <Info:AAA.LogSsh> Msg from Master : Did password authentication for user netsight (10.100.0.17)
12/30/2020 10:21:28.14 <Info:AAA.authPass> Login passed for user netsight through ssh (10.100.0.17)
12/30/2020 10:06:30.31 <Info:AAA.logout> Administrative account (netsight) logout from ssh (10.100.0.17)
12/30/2020 10:06:27.10 <Info:AAA.LogSsh> Msg from Master : Did password authentication for user netsight (10.100.0.17)

I’m not entirely sure, but I believe that it started after updating to 8.5.3.
Does someone of you guys see the same behaviour? Or do you have any idea what could cause this login?

Best regards
Stefan

[PeterK]

xmc uses ssh logins for backups and fw-upload.

I think you know that, but have you checked that this isn’t the case?

Maybe you could set xmc logging to a higher level?

[Stefan_K_]

Hi Peter,

thanks for your anser!

No workflows.
Collector was my first guess also, so I disabled everything under “Options → Management Center Collector”. The login still happens. (And I have other installations where Collectors are enabled and I don’t see any logins - guess it’s done via SNMP.)

No way to check what triggers the login?

[PeterK]

hmm...not seen in this density yet. Could this have something to do with “collect device / port statistics”? Or do you have some workflows running?

Maybe, you can have a look for 900 sec timer in XMC options.