SSL error in ntevl probe log

book

Article ID: 222456

calendar_today

Updated On:

Products

DX Infrastructure Management

Issue/Introduction

We are seeing the following SSL error on ntevl probe log. Should we be concerned?


Aug 23 22:32:01:747 [4924] ntevl: SSL - SSL_accept error (1) on new SSL connection 
Aug 23 22:32:01:747 [4924] ntevl: SSL - accept failed for 11.22.33.44/58426 

 

Environment

Release : 20.3

Component : UIM - NTEVL

Resolution

This is a sign that "something" is attempting to connect to the open port that the probe listens on and initiate an SSL connection.

The most common cause of this is a vulnerability scan, which is attempting to find outdated/vulnerable SSL versions.

This is benign in terms of probe operation and can be ignored from the UIM point of view.

From a security point of view, it might be a good idea to identify the IP address in the log message and make sure it's something you expect to be connecting to other systems in your network.