06-10-2021 02:38 PM - edited 06-10-2021 02:38 PM
I had an issue where radius / 802.1x configuration (key) changed and prevented users and devices from getting on the network. The switch is a C4510R+E, and it looks like the configuration was modified hours earlier. The fix was to reconfigure the switch with the correct radius and TACACS KEYs.
SHOW RUN displays
"Last configuration change at 06:07:59 PDT Wed Jun 9 2021"
Normally, if the configuration was modified by a human it would show the username like -
Last configuration change at 06:07:59 PDT Wed Jun 9 2021 by Peter
If the configuration was modified by a tool, like Solarwinds, it would show -
Last configuration change at 06:07:59 PDT Wed Jun 9 2021 by solarwinds
In the logs, it there are no entries of anything logging on during that time frame.
Any ideas?
06-10-2021 02:58 PM
Take a look at the logs for that timeframe (show logging). You may see a username associated with that.
sh logging | include 06:07:59
HTH
06-10-2021 03:26 PM
In the logs, there are no entries of anything during that time frame.
06-10-2021 06:46 PM
Do you have any scripts running that can make changes to the config?
06-10-2021 08:43 PM
No. And if any script was running that made configuration changes, SHOW RUN output would display -
Last configuration change at 06:07:59 PDT Wed Jun 9 2021 by solarwinds
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide