WS-C6506-E Show Time Updated and Rebooted

[John Stevens]

On my WS-C6506 i show where it udpated the clock over the weekend and rebooted.

*Jan 11 08:30:30.419: %SYS-6-CLOCKUPDATE: System clock has been updated from 14:30:30 UTC Sat Jan 11 2014 to 08:30:30 CST Sat Jan 11 2014, configured from console by console.

*Jan 11 08:30:30.419: %SYS-6-CLOCKUPDATE: System clock has been updated from 08:30:30 CST Sat Jan 11 2014 to 08:30:30 CST Sat Jan 11 2014, configured from console by console.

*Jan 11 08:30:30.539: %SPANTREE-5-EXTENDED_SYSID: Extended SysId enabled for type vlan. The Bridge IDs of all active STP instances have been updated, which might change the spanning tree topology

*Jan 11 08:30:38.403: %SYS-5-CONFIG_I: Configured from memory by console

*Jan 11 08:30:44.752: %SYS-5-RESTART: System restarted --

This is the first time i have seen a switch update the time itself and then restart.

Just wondering if this is normal?  Is there a way to prevent it from rebooting so it doesnt cause down time?

thanks

[Reza Sharifi]

It is not clear from the log that the clock update caused the restart.

Can you check to make sure that the switch actually restarted?  sh ver will tell you the switch up time

Also, can you check your flash for a crash file?

HTH

[John Stevens]

it did reboot.  I show its only been up a few days.  I will check to see if there is a crash log.  I just thought it was due to the time update since it happen right after that in the logs.

[John Blakley]

This log isn't due to the system updating the system clock and then restarting. When the system restarts, it restarts with a UTC timezone. When the config loads, if it finds a different timezone in the config file, it updates the system time. The next couple of lines that you see are the completion of the boot with the finality "System restarted" message when the system is fully up and operational.

As Reza stated, the problem from this log can't be determined as to why the system restarted and a crash dump is better if it's there. Do you log information to a syslog server? If so,  you could also check there for clues.....

HTH,
John

*** Please rate all useful posts ***

[John Stevens]

Thanks for the information, makes since now.

I perfromed a dir and i dont see any crash log for Jan 11 2014

HSVC-SW-015-HOTH#dir
Directory of sup-bootdisk:/

    1  -rw-    68626576  Aug 11 2007 23:52:36 -05:00  s3223-advipservicesk9_wan-                                                  vz.122-18.SXF10.bin
    2  -rw-    26843548   Feb 6 2008 17:41:46 -06:00  sea_log.dat
    3  -rw-    58730500   Feb 6 2008 22:29:40 -06:00  s3223-advipservicesk9_wan-                                                  mz.122-33.SXH1.bin
    4  -rw-           0   Feb 2 2010 00:03:46 -06:00  crashinfo_20100202-050346

255938560 bytes total (101732352 bytes free)
HSVC-SW-015-HOTH#

Is there anything else i can check to try and find out why it rebooted?

[Jon Marshall]

John

Can you have a look at "sh log" or post it here. Sometimes there are clues in there as to why your switch rebooted.

Jon

[Richard Burts]

Unfortunately the show log command uses logs stored in memory of the switch - and that memory is erased when the switch restarts. So show log will not have much useful about the cause of the restart. Do you perhaps also send logs to a syslog server? If so you might get helpful information in the logs stored on the server.

I have occasionally seen helpful information in the output of show version. Perhaps you can post the show version output?

Could this have been the result of a power fluctuation? Are there other devices plugged into the same power source? Did any of those devices also restart at about the same time as this switch?

HTH

Rick

[Jon Marshall]

Rick

You are right. I was thinking of CatOS where the "sh log" could actually provide some useful information such as software exceptions etc.

Jon

[John Stevens]

Thanks all, i dont have the logs from before the reboot.  This switch has two power supplies which is hardwired to a UPS that is on back up power, so it had power.  I checked the show version, not any information in there about issues or reason for restart.

Might be out of luck on this one.

[John Blakley · Accepted solution]

I know this is a long shot, but was this in operation without anyone modifying the config at the time of the reboot? I found this that you may want to take a look at to see if anything stands out:

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/release/notes/caveats_SXH_rebuilds.html#wp4052171

HTH,
John

*** Please rate all useful posts ***

[Richard Burts]

Jon

Yes CatOS was very nice in that sense.

HTH

Rick

[Leo Laohoo]

*Jan 11 08:30:30.419: %SYS-6-CLOCKUPDATE: System clock has been updated from 14:30:30 UTC Sat Jan 11 2014 to 08:30:30 CST Sat Jan 11 2014, configured from console by console.
 
*Jan 11 08:30:30.419: %SYS-6-CLOCKUPDATE: System clock has been updated from 08:30:30 CST Sat Jan 11 2014 to 08:30:30 CST Sat Jan 11 2014, configured from console by console.

Someone changed the time from UTC to CST.  Notice the start of each line is a "*".  This means that the chassis' time and date is hard-coded and not based of NTP/SNTP.

*Jan 11 08:30:38.403: %SYS-5-CONFIG_I: Configured from memory by console
*Jan 11 08:30:44.752: %SYS-5-RESTART: System restarted --

8 seconds later, you'll see this.  However, you notice that configuration was done by CONSOLE?  What I'd like to know is if you have any TACACs server.  I would like to know what commands were entered between 08:30.38 and 08:30.44.  It looks like a crash but it also looks like a "reload" command was invoked.

However, there could be a possibility that the supervisor card was ejected.

[John Stevens]

Thanks for the info Leo.

No one was onsite at the time this happend, so i know that no one ejected to the SUP card.  We dont ahve a TACAC server.

[Richard Burts]

The messages about changing time are a very common part of the output of the boot process when the configuration has set a time zone and/or support for daylight savings time. I am confident that there was not anyone typing commands about the clock that generated these messages. I think it is clear that the switch restarted for some reason and that the restart caused the messages about changing time (and changing time did not cause the switch restart).

Unfortunately I can not come up with any other suggestions to try to figure out what did cause the switch restart. So it may remain a mystery.

HTH

Rick

[John Stevens]

I just looked that the following that John provided.

I know this is a long shot, but was this in operation without anyone modifying the config at the time of the reboot? I found this that you may want to take a look at to see if anything stands out:

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/release/notes/caveats_SXH_rebuilds.html#wp4052171

From this article above, i think the following happened.  My MPLS router internal port between it and the my switch reset, this kicked off my ASA IPSec tunnels.  Then a few minutes later, my switch reset due to the know issues with the IKE message.  Its a long shot but it makes since.