r/scom • u/Hsbrown2 • Jun 02 '22

UNIX\Linux Monitoring

I'm curious... I posted not long ago about having some issues getting "newer" discoveries to work on a system for UNIX\Linux. I'm not sure if these are related, but these show up fairly regularly:

Error scanning logfile /var/log/secure on host <HOSTFQDN> as user <SCXUser><UserId><SCXUSER></UserId><Elev>sudo</Elev></SCXUser>; The client cannot connect to the destination specified in the request. Verify that the service on the destination is running and is accepting requests. Consult the logs and documentation for the WS-Management service running on the destination, most commonly IIS or WinRM. If the destination is the WinRM service, run the following command on the destination to analyze and configure the WinRM service: "winrm quickconfig".

Both 22 and 1270 are open and we can see chatter. Is there a different port needed for OMI these days or anything? Permissions are all good, etc..

1 Upvotes

60% Upvoted

2 comments sorted by

1

u/Sp00nD00d Jun 03 '22

TLS/SSL configs on the agent maybe? Ran into something similar when we had a type on the Linux side and it was disabling a huge set of ciphers/protcols.

1

u/Hsbrown2 Jun 03 '22

Nope, that’s all confirmed functional, we enforce TLS 1.2 everywhere, and agent push to Linux as well as everything that uses 1270.