cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1453
Views
0
Helpful
2
Replies

Unexplainable "Cisco Configuration Management Trap"

orsonjoon
Level 1
Level 1

Hello,

This morning a "Cisco Configuration Management Trap" email message was generated:

EVENT ID = 0002VPH

ALERT ID = 00002ZT

TIME = Wed 20-Aug-2008 08:35:38 CEST

STATUS = Active

SEVERITY = Informational

MANAGED OBJECT = 6506switch.domain.local

MANAGED OBJECT TYPE = Switches and Hubs

EVENT DESCRIPTION = InformAlarm::Component=6506switch.domain.local: Cisco Configuration Management Trap;

CUSTOMER IDENTIFICATION = All devices

CUSTOMER REVISION = 1

When I try to isolate this message in ACS server or in a CW change audit report, no results pop-up.

Also when I run a Syslog Analyzer Configuration Changes Report, no results for that specific time (08:35:38) seem to be there (see attachment).

I can not explain this message, I edited the switch name and username, but all the rest is genuine.

How is this possible, is this a bug in CW or could this be some kind of virus or else that configures the switch? Please help me out here, 1000 thankx ;-))

2 Replies 2

miheg
Level 5
Level 5

Could this be the result of a sync job?

With some snmp sets the device can sync it's running to it's startup config and generate such a trap.

Cheers,

Michel

Hello Michel,

Thanks for your reply.

No, no sync job has been ran for this device.

I can't trace this back, because no timestamp is available on the nvram for the startup and the running config.

But why would this happen if there are no changes to the running or startup config, and no obvious other reason for a sync exists?

Best,

Orson

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: