Cisco ASA User or system password changed

[shalendra2]

Hi Team,

               What is the syslog message id for User or system password changed event. I have this message %ASA-5-766009: CTS SXP: password changed. I'm not getting user name and who has changed password information.

Any other message do we have?

Regards,

Shalendra

[Marvin Rhoads]

The message you cite is specific to CTS SXP (Cisco Trustsec Security Exchange Protocol). It would normally be due to a downstream device being reconfigured to attempt to setup SXP with the ASA (or change an existing SXP setup).

I'm not sure a local user changing their password will cause a syslog event.

[shalendra2]

Thanks Marvin, Can you please confirm it.

Regards,

Shalendra