08-20-2008 01:50 AM
Hello,
This morning a "Cisco Configuration Management Trap" email message was generated:
EVENT ID = 0002VPH
ALERT ID = 00002ZT
TIME = Wed 20-Aug-2008 08:35:38 CEST
STATUS = Active
SEVERITY = Informational
MANAGED OBJECT = 6506switch.domain.local
MANAGED OBJECT TYPE = Switches and Hubs
EVENT DESCRIPTION = InformAlarm::Component=6506switch.domain.local: Cisco Configuration Management Trap;
CUSTOMER IDENTIFICATION = All devices
CUSTOMER REVISION = 1
When I try to isolate this message in ACS server or in a CW change audit report, no results pop-up.
Also when I run a Syslog Analyzer Configuration Changes Report, no results for that specific time (08:35:38) seem to be there (see attachment).
I can not explain this message, I edited the switch name and username, but all the rest is genuine.
How is this possible, is this a bug in CW or could this be some kind of virus or else that configures the switch? Please help me out here, 1000 thankx ;-))
08-20-2008 03:53 AM
Could this be the result of a sync job?
With some snmp sets the device can sync it's running to it's startup config and generate such a trap.
Cheers,
Michel
08-20-2008 04:02 AM
Hello Michel,
Thanks for your reply.
No, no sync job has been ran for this device.
I can't trace this back, because no timestamp is available on the nvram for the startup and the running config.
But why would this happen if there are no changes to the running or startup config, and no obvious other reason for a sync exists?
Best,
Orson
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: