Hello,
this is the official Cisco explanation:
%MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec
Problem: Sporadic or constant %MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec syslog messages are generated on the switch.
Description: The following is an example of the syslog output you will see when this error occurs:
%MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec(20000000)
%MLS-4-RESUMESC:Resume MLS after detecting too many moves
%MLS-4-MOVEOVERFLOW:Too many moves, stop MLS for 5 sec(20000000)
%MLS-4-RESUMESC:Resume MLS after detecting too many moves
These syslog messages indicate that the switch is relearning one or more MAC addresses on multiple ports in rapid succession. For example, on an access switch with two uplinks to the core of the network, the switch might learn a given MAC address first on one uplink and then on the other very rapidly.
If you see these messages infrequently, it is most likely a transitory L2 (spanning-tree) loop, resulting in packet flooding in one or more VLANs.
If you are seeing an excessive number of these messages (for example, if your syslog server log file or your switch console are being flooded with these messages), the problem might be due to the following reasons:
a permanent L2 (spanning-tree) loop
one or more faulty switch ports
a bad cable (for example, a unidirectional fiber link)
other bad hardware (not necessarily on the switch generating the messages)
misconfigured device (for example, a traffic generator sending traffic to two switch ports using the same MAC address)
If you are confident that there is no L2 loop or faulty hardware, you are not using MLS on the switch, and you want to eliminate these messages, you can disable MLS on the switch by issuing the set mls disable command. Alternately, you can modify the logging level for the MLS facility to three or lower by issuing the set logging level mls 3 default command . However, these solutions simply mask the problem.
If you get these messages after issuing the set mls disable command, open a case with the Cisco Technical Assistance Center (TAC).
here is what the Error Message Decoder says:
%MLS-4-RESUMESC: Resume MLS after detecting too many moves
This message indicates that MLS has resumed after being stopped due to too many Layer 2 source address changes being detected in a short period of time.
Recommended Action: No action is necessary. This message is provided for information only.
---
%MLS-4-MOVEOVERFLOW: Too many moves, stop MLS for [dec] sec ([hex])
This message indicates that there have been too many Layer 2 source address changes during a short period of time. This message might be caused by topology changes or spanning tree loops. MLS is stopped for a specified number of seconds and all entries are purged. [dec] is the number of seconds and [hex] is the event code for moves.
Recommended Action: Check the topology for any loops. Call your technical support representative.
HTH,
GP
