Remote Login and Remote Access let someone connect to a Mac's command line or screen from outside the device — useful for remote support, but a potential security risk if left enabled without your knowledge. Addigy's Monitoring feature lets you track whether these services are turned on across your fleet, so you can catch and address unauthorized access quickly.
Overview
There are two ways to monitor Remote Login and Remote Access with Addigy:
- Use the Device Facts Addigy already provides for each service — the fastest option, with no scripting required.
- Create a single Custom Fact that checks both services at once, if you'd rather monitor them together with one Monitoring Item.
Prerequisites
- Create a Monitoring Item
- Create a Custom Fact (only required for the combined-check method below)
How to Monitor Using Existing Device Facts
Addigy already tracks both services as built-in Device Facts, so you can create a Monitoring Item directly from each fact without writing any code.
- Follow the steps in Create a Monitoring Item.
- For Remote Login, select the Remote Login Enabled Device Fact.
- For Remote Access, select the Remote Desktop Enabled Device Fact.
Each fact requires its own Monitoring Item, so create two if you want to track both services separately.
How to Monitor Both with a Single Custom Fact
If you'd rather track Remote Login and Remote Access together in one Monitoring Item, combine both checks into a Custom Fact.
-
Check Remote Login status with:
/usr/sbin/systemsetup getremotelogin
-
Check Remote Access status with:
ps ax | grep -v grep | grep ARDAgent
- Combine both commands into a single script and use it to create a Custom Fact.
- Use that Custom Fact to create a Monitoring Item.
Note: A Monitoring Item that checks for Remote Access by process (
ARDAgent) can produce false alerts, since the process doesn't run continuously and may stop and restart on its own. Keep this in mind before relying on it for alerting.