configuration modified by unknown entity on WS-C4510R+E

[tachyon05]

I had an issue where radius / 802.1x configuration (key) changed and prevented users and devices from getting on the network.  The switch is a C4510R+E, and it looks like the configuration was modified hours earlier.  The fix was to reconfigure the switch with the correct radius and TACACS KEYs.

SHOW RUN displays

"Last configuration change at 06:07:59 PDT Wed Jun 9 2021"

Normally, if the configuration was modified by a human it would show the username like -

Last configuration change at 06:07:59 PDT Wed Jun 9 2021 by Peter

If the configuration was modified by a tool, like Solarwinds, it would show -

Last configuration change at 06:07:59 PDT Wed Jun 9 2021 by solarwinds

In the logs, it there are no entries of anything logging on during that time frame.

Any ideas?

[Reza Sharifi]

Take a look at the logs for that timeframe (show logging). You may see a username associated with that.

sh logging | include  06:07:59

HTH

[tachyon05]

In the logs, there are no entries of anything during that time frame.

[Reza Sharifi]

Do you have any scripts running that can make changes to the config?

[tachyon05]

No.  And if any script was running that made configuration changes, SHOW RUN output would display -

Last configuration change at 06:07:59 PDT Wed Jun 9 2021 by solarwinds