cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Join Customer Connection to register!
325
Views
0
Helpful
4
Replies
tachyon05
Beginner

configuration modified by unknown entity on WS-C4510R+E

I had an issue where radius / 802.1x configuration (key) changed and prevented users and devices from getting on the network.  The switch is a C4510R+E, and it looks like the configuration was modified hours earlier.  The fix was to reconfigure the switch with the correct radius and TACACS KEYs.

 

SHOW RUN displays

"Last configuration change at 06:07:59 PDT Wed Jun 9 2021"

 

Normally, if the configuration was modified by a human it would show the username like -

Last configuration change at 06:07:59 PDT Wed Jun 9 2021 by Peter

 

If the configuration was modified by a tool, like Solarwinds, it would show -

Last configuration change at 06:07:59 PDT Wed Jun 9 2021 by solarwinds

 

In the logs, it there are no entries of anything logging on during that time frame.

 

Any ideas?

4 REPLIES 4
Reza Sharifi
Hall of Fame Expert

Take a look at the logs for that timeframe (show logging). You may see a username associated with that.

sh logging | include  06:07:59

HTH

In the logs, there are no entries of anything during that time frame.

Do you have any scripts running that can make changes to the config?

 

No.  And if any script was running that made configuration changes, SHOW RUN output would display -

Last configuration change at 06:07:59 PDT Wed Jun 9 2021 by solarwinds