topic Re: IMC Alarm when device is unreachable in SSH or Telnet in IMC

IMC Alarm when device is unreachable in SSH or Telnet

fykloo — Fri, 06 Oct 2017 13:43:21 GMT

Hello everyone,

I'm currently running an iMC PLAT 7.3 (E0506) for my customer. We use iMC for supervision and administration of our Comware switches that we install site by site.

We use local authentication when we deploy our switch the first time and then we add them into our ClearPass and use Tacacs accounts. The problem I have, is that iMC doesn'f show alarm when devices are not reachable in SSH or Telnet (when the switch is added into ClearPass and tacacs become active).

And at this point, I can't use CLI script on my switches.

Is there any way to display alarm on this ?

Many thanks

Re: IMC Alarm when device is unreachable in SSH or Telnet

NeilR — Fri, 06 Oct 2017 17:50:43 GMT

Possibly by using syslog to alarm, if the change shows up in the syslog.

Or using a compliance task to periodically try and log in via ssh or telnet

Either can result in alarm of your chosen severity.

Re: IMC Alarm when device is unreachable in SSH or Telnet

LindsayHill — Fri, 06 Oct 2017 18:19:42 GMT

Do you want to check if the device is unreachable via SSH/Telnet, or if authentication is failing? (those are slightly different problems)

Re: IMC Alarm when device is unreachable in SSH or Telnet

fykloo — Mon, 09 Oct 2017 10:08:51 GMT

Hi Neilr,

I don't think this is possible because there's no configuration change on the switch.

And there's nothing on the switch that it can generate a syslog.

IMC may check regularly and generate an alarm itself.

Re: IMC Alarm when device is unreachable in SSH or Telnet

fykloo — Mon, 09 Oct 2017 10:10:11 GMT

Hi Lindsay,

you're right. I want to check if authentication is failing ;)

Re: IMC Alarm when device is unreachable in SSH or Telnet

NeilR — Mon, 09 Oct 2017 19:03:51 GMT

imc will test by ping and generate an error if no longer pingable.

Snmp will generate a blue indicator - unknown - if it was previously configured, and alarm if can't access MIB

Does not test login credentials to my knowledge. Backup failure will generate an alarm if you have periodic backups set.

yes you are right if no syslog event, then you can't generate an alarm.

But the Compliance center has a check task feature that can issue cli commands and look for return. So a cli task that can't login would generate a failure for the task and a report with a list of devices that did fail or succeed. Might work for you if you periodically schedule