openssh unix dev - Oct 2001 - Clean way to monitor status of 'sshd' remotely?

I am trying to come up with a "clean" way to check if a machine
is running 'sshd' so it can be included in a NetSaint config.
Currently, there is a NetSaint plugin called "check_ssh", but
it simply connects to port 22, looks for the SSH version response
from the daemon, and then disconnects. This results in the
syslog file where "auth" messages are sent in filling up with
messages like:

  sshd[21795]: Connection closed by 192.168.192.168

every 5 minutes (or whatever the "check" interval is).

I've tried searching for others who have run into this situation,
but have been unable to find anything either in these archives or
in Google's UseNet archives.

I've also looked at the 'sshd.c' source code, and don't see
anything
obvious that would easily permit a monitoring tool to close the SSH
connection "properly" and avoid a log-file entry.

Does anybody have any suggestions? (Besides disabling logging at
the .info level, which is useful for other messages.)

Thanks for any insight!
Eddy


__________________________________________________
Do You Yahoo!?
Make a great connection at Yahoo! Personals.
http://personals.yahoo.com

On Fri, Oct 26, 2001 at 05:36:50AM -0700, Eddy Geez
wrote:
> I've also looked at the 'sshd.c' source code, and don't see
anything
> obvious that would easily permit a monitoring tool to close the SSH
> connection "properly" and avoid a log-file entry.
1) why on earth would it be a feature to have a mechanism that allows
one to connect to ssh without leaving a log entry. (seems like it would
offer a great way to do covert scans.)

2) how often do your sshd's disappear? is this actually something that
needs to be monitored?

-- 
Mike Stone