Core issue
The error message format can also look like this:
%SYS-5-SPAN_CFGSTATECHG: [chars] session [chars]active for [chars].
This message indicates whether a session is active or inactive. The first [chars] specifies a local or remote Switched Port Analyzer (SPAN) session. The second [chars] specifies whether the session is active or inactive, and the third [chars] specifies the destination port or Remote SPAN (RSPAN) Virtual Local Area Network (VLAN).
Resolution
This is an informational message only.
The main reason the message appears is link flapping issues at the SPAN destination. These occur when the sniffer port is connected and then disconnected.
You can also change the logging level for the system messages if you do not want them to be displayed on the log file. Use the set logging level sys 1 command in order to do this.
Another possible cause is a problem with either the source or destination ports, most likely due to a Layer 1 issue. This can be the cause if the message is logged too frequently.
For further assistance and support, use the TAC Service Request Tool in order to open a case with Cisco Technical Support.
