Actually we did open a TAC. Cisco was not able to make a recommendation because the issue is intermittent and we cannot leave tracing on indefinitely. Because of this they instead recommended installing a packet sniffer. However our network support team came back with a similar response - cannot leave packet sniffing turned on indefinitely.

This is a difficult situation in which we cannot reproduce the issue, we don't know when it will happen again. And we cannot take any proactive action to ensure that we capture the logs on the next occurrence.

So, has anyone else been through something like this?

Thanks!

Joe

For a lot of issues I've found that the packet capture is the best way to go.  Assuming you don't have a "proper" sniffer, you can always put an old PC with a big harddrive and have it sniff only the IP range you need, this should easily give you a few weeks of capture.  The other option is to spend a day or two trying to recreate the issue, it might take a few hours, but at the end if mithgt be worth spending the time.

david