Hello,

I am getting this error in my /var/log/messages file regularly. Can you please explain me the reason of this alert and how to fix this.

sshd fatal read from socket failed connection timed out

This basically says that sshd polled a file descriptor which was a socket that had an established connection to somewhere and it had an error with the read poll on that file descriptor.


Best guess, you have someone who has an ssh connection to the server and either their network or their system is configued with a timeout that drops the connection after a condition is met, like an amount of time with no activity or something of that nature.


Unless you are having an actual problem or have you users that are reporting issues I would ignore it as its probably more of a pain to figure out than whats it worth.


If you wanted to try and diagnose, you could strace your sshd processes and do a tcpdump on the interface it uses to see in excruciating detail what is happening at the time the error occurs and work backwards from there.

There is a ssh option (TCPKeepAlive) that might help. Check your ssh manpage.

TCPKeepAlive didn't helped me out...

sshd has more then just one timeout settings. Well i assume that you talk about the server side of the connection.


http://linux.die.net/man/5/sshd_config

Here you can find all the configuration options that control the time out.

Are you ACTUALLY having an issue here? If not just ignore the message in your log file. This could be something that is by design from your network switches/firewalls, etc..

Actually we are receiving this alert in log file and the same was generating as a ticket through monitoring tool.. so we are getting tickets regularly for this issue... would like to fix this...

Chaitu4u, monitoring and tickets being created would be the problem I would correct in my mind. An ssh timeout can occur for many various reasons, in almost every network ive been in there have been inactivity drops on connections on the network layer. Feel free to keep digging around but because you don't actually have a problem it will be very hard to find the solution.

Thanks @Kustom42 for your analysis and feedback..