topic The message you cite is in Network Security

Cisco ASA User or system password changed

shalendra2 — Tue, 12 Mar 2019 05:54:56 GMT

Hi Team,

What is the syslog message id for User or system password changed event. I have this message %ASA-5-766009: CTS SXP: password changed. I'm not getting user name and who has changed password information.

Any other message do we have?

Regards,

Shalendra

The message you cite is

Marvin Rhoads — Tue, 12 May 2015 01:47:53 GMT

The message you cite is specific to CTS SXP (Cisco Trustsec Security Exchange Protocol). It would normally be due to a downstream device being reconfigured to attempt to setup SXP with the ASA (or change an existing SXP setup).

I'm not sure a local user changing their password will cause a syslog event.

Thanks Marvin, Can you please

shalendra2 — Tue, 12 May 2015 05:08:23 GMT

Thanks Marvin, Can you please confirm it.

Regards,

Shalendra