Router configured by SNMP or Syslog server?

[Pradeep H A]

Hi

Iam seeing these logs on the router: (Replaced IP address with x.x.x.x)

Nov  1 09:41:42: %SYS-5-CONFIG_I: Configured from tftp://x.x.x.x/R1-83137.conf by console

R1#sh run | i x.x.x.x

logging x.x.x.x

snmp-server host x.x.x.x gps21P28S19J17JH

ntp server x.x.x.x

R1#sh run

Building configuration...

Current configuration : 33705 bytes

!

! Last configuration change at 09:41:42 GMT Thu Nov 1 2012

! NVRAM config last updated at 02:18:44 GMT Thu Nov 1 2012

!

R1#show startup-config

Using 12816 out of 262136 bytes, uncompressed size = 33706 bytes

Uncompressed configuration from 12816 bytes to 33706 bytes

!

! Last configuration change at 09:42:50 GMT Wed Oct 31 2012

! NVRAM config last updated at 02:18:44 GMT Thu Nov 1 2012

!

My Question:

1. The log says tftp server @ x.x.x.x configured the router & show run shows the config was indeed changed at the same time! Can someone tell me Why this is happening?

2. However the log seem to have affected only the running-config not startup-config! Why?

Thanks a lot in advance!

[Jeff Van Houten]

The running config was overwritten by someone using a config from a Tftp server. The reason the startup config hasn't been written is because it wasn't saved.

Sent from Cisco Technical Support iPad App

[Pradeep H A]

Hi Jeff,

I wonder how that could have happened? because we have TACACS+ configured on all our routers & in case anybody chages or updates configuration it should show the user id like the one below:

Nov 1 18:40:25: %SYS-5-CONFIG_I: Configured from console by on vty0

But the logs shown above doesnt show any user id which makes me think it must be some automated feature of SNMP or Syslog or NTP?

Regards

Pradeep H A

[Pradeep H A]

One more related log & SNMP information. hope this might help:

From Cisco Error message decoder:

%SYS-4-SNMP_HOSTCONFIGSET: SNMP hostConfigSet request. Loading configuration from [IP_address]

SNMP is reading the host configuration from a network host.

Recommended Action: This is an informational message only. No action is required.

Related documents- No specific documents apply to this error message.

From SNMP Object Navigator:

Specific Object Information

Object	hostConfigSet
OID	1.3.6.1.4.1.9.2.1.53
Type	DisplayString
Permission	write-only
Status	obsolete
MIB	OLD-CISCO-SYS-MIB ;                                   -                                                                                                                                                                                                                                                        View Supporting Images
Description	"Cause the loading of a new host-confg file using TFTP."

----------------------------------------------------------------------------------------------

Well that would mean indeed our SNMP server uploaded configuration to our router.

But still want to know whether its a automated scheduled task & what would be the purpose one would implement it in real networks?