User 'Config', running 'N/A' from IP 0.0.0.0, executed

[sangeeth.n191]

Hi 

i am getting log which is mentioned below in ASA 5510 :

---------------------------------------------------------------------------------

" User 'Config', running 'N/A' from IP 0.0.0.0, executed "

"subscribe-to-alert-group telemetry periodic daily"

---------------------------------------------------------------------------------

Did anyone have idea about what is the cause for occurrence of this log and  what is happening in the background ....

Please share me your valuable information regarding the same ..

[Thomas Kerley]

Not that it helps but I also see this. We have an ASA (active- Standby pair) 5515X running 9.4(2)11. We saw this log message happen about 100 times within a second then the device suddenly reloaded after complaining about HA sync.

Thankfully it happened on the redundant ASA causing no downtime. 

Aug 25 2016 16:39:25 111010 User 'Config', running 'N/A' from IP 0.0.0.0, executed '<cr>'

Aug 25 2016 16:39:25 111008 User 'Config' executed the '<cr>' command.

[Thomas Kerley]

After further research the user "config" is the ASA. The Firewall applies commands from the startup configuration as the user "config". 

[Nerka]

It is failover function. "show failover"

If failover  disabled also requires additional disable system configuration

conf ter
failover
failover standby config-lock
no failover
end