Good morning everyone,
I searched on the bug toolkit for this issue but I did not find anything, so I wanted to post my experience on the forums (our support contract does not allow us to open a TAC case by ourselves).
I found a bug in Embedded Event Manager, on Catalyst 4500-E platform with supervisor V-10GE, on various IOS releases (in particular 12.2-50-SG IP BASE w/o crypto, 12.2-54-SG1 IP BASE w/o crypto, but also other releases included latest 15.0-2-SG1 ENTERPRISE SERVICES SSH).
The problem is that when you set up a EEM applet that monitors syslog pattern matching, and you also configure remote host logging *with* the option "sequence-num-session", when the match occurs, the switch reboots with message:
Sw (sometimes prints a number instead)
VECTOR D00
and in some cases performs a second reboot with message:
VECTOR 0
DOUBLE FAULT
The reload reason message is:
System returned to ROM by abort at PC 0x0
The problem does *not* occur if remote logging has not the option "sequence-num-session". I verified this behavior on various configurations (included our production 130K long *and* factory defaults after erase startup-config).
The configuration statements that cause reload are, for expample:
event manager applet prova
event syslog pattern %SYS-5-CONFIG_I
action 1.0 puts "configurazione modificata"
!
logging host 172.30.10.1 sequence-num-session
Hope this could be useful to someone, maybe this is a bug worth opening a case.
Massimo Malabotta
University of Trieste (Italy)
