Spanning tree problem

[cthca2]

oct 19 01:21:37.326 GMT-3: %SPANTREE-5-TOPOTRAP: Topology Change Trap for vlan 40
Oct 19 01:21:37.326 GMT-3: %SPANTREE-5-ROOTCHANGE: Root Changed for vlan 40: New Root Port is GigabitEthernet1/0/21. New Root Mac Address is f09e.63cd.f580
Oct 19 01:21:39.294 GMT-3: %SPANTREE-5-ROOTCHANGE: Root Changed for vlan 40: New Root Port is GigabitEthernet1/0/17. New Root Mac Address is f09e.63f6.1780
Oct 19 01:21:39.297 GMT-3: %SPANTREE-5-TOPOTRAP: Topology Change Trap for vlan 40
Oct 19 16:04:28.476 GMT-3: %SYS-5-CONFIG_I: Configured from console by hcamargo on vty0 (192.168.31.175)
Oct 20 01:19:46.450 GMT-3: %SPANTREE-5-TOPOTRAP: Topology Change Trap for vlan 40
Oct 20 01:19:46.450 GMT-3: %SPANTREE-5-ROOTCHANGE: Root Changed for vlan 40: New Root Port is GigabitEthernet1/0/26. New Root Mac Address is 00da.5543.7400
Oct 20 01:19:47.673 GMT-3: %SPANTREE-5-TOPOTRAP: Topology Change Trap for vlan 40
Oct 20 01:19:47.673 GMT-3: %SPANTREE-5-ROOTCHANGE: Root Changed for vlan 40: New Root Port is GigabitEthernet1/0/17. New Root Mac Address is f09e.63f6.1780
Oct 20 01:22:27.643 GMT-3: %SPANTREE-5-TOPOTRAP: Topology Change Trap for vlan 40

Hi 

This problem is happening every day ate same time. I am trying to do the Tshoot to resolve the cause of this issue. Someone can help please?

[MHM Cisco World]

Every day at same time. 

I this time did any SW add to your network or any link active?

Did you check cpu in old stp root SW in this time? 

[cthca2]

CPU is fine in both switches.

But what I see here is that one of this root port is a router that is connected to the office. 

Gi1/0/21            Desg FWD 4         128.21   P2p  - switch 
Gi1/0/26            Desg FWD 4         128.26   P2p   - link

[MHM Cisco World]

This router have l2vpn. 

So root know is HQ office not in your network.

Check l2vpn

[cthca2]

No.  The root is g1 1/0/17 that is other switch.

But all day at the same time (1 am ) there is the event bellow but the root continue to be 1/0/17

GigabitEthernet1/0/21. New Root Mac Address is f09e.63cd.f580
Oct 19 01:21:39.294 GMT-3: %SPANTREE-5-ROOTCHANGE: Root Changed for vlan 40: New Root Port is GigabitEthernet1/0/17. New Root Mac Address is f09e.63f6.1780

Gi1/0/17 Root FWD 19 128.17 P2p Peer(STP)
Gi1/0/21 Desg FWD 4 128.21 P2p
Gi1/0/26 Desg FWD 4 128.26 P2p

[MHM Cisco World]

In simple words 

Root change if 

1- the SW recieve better bpdu from other SW

2- the SW not receive any bpdu from router

Since it temporally then I think SW not recieve bpdu' and why that 

1- cpu

2- link utilize 

So check these two when it happened again.

[cthca2]

thanks

When you suggest to check CPU, which specific process I need to check? 

CPU utilization for five seconds: 23%/0%; one minute: 24%; five minutes: 24%
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
1 436 7766 56 0.00% 0.00% 0.00% 0 Chunk Manager
2 239491 33562419 7 0.00% 0.00% 0.00% 0 Load Meter
3 157 60645 2 0.00% 0.00% 0.00% 0 hulc_entropy_thr
4 1196 1445010 0 0.00% 0.00% 0.00% 0 DHCPD Timer
5 0 1 0 0.00% 0.00% 0.00% 0 Retransmission o
6 0 1 0 0.00% 0.00% 0.00% 0 IPC ISSU Dispatc
7 409292985 36778211 11128 0.00% 0.27% 0.20% 0 Check heaps
8 28239 32733 862 0.00% 0.00% 0.00% 0 Pool Manager
9 0 1 0 0.00% 0.00% 0.00% 0 DiscardQ Backgro
10 0 2 0 0.00% 0.00% 0.00% 0 Timers
11 861 91226 9 0.00% 0.00% 0.00% 0 WATCH_AFS
12 665798 670827037 0 0.00% 0.00% 0.00% 0 HUSB Console
13 0 1 0 0.00% 0.00% 0.00% 0 License Client N
14 28582 2793998 10 0.00% 0.00% 0.00% 0 IPC Dynamic Cach
15 0 1 0 0.00% 0.00% 0.00% 0 Image License br
16 82248918 2793951 29438 0.00% 0.02% 0.00% 0 Licensing Auto U
17 222479438 532049172 418 0.17% 0.17% 0.14% 0 ARP Input
18 333744 174762247 1 0.00% 0.00% 0.00% 0 ARP Background
19 0 8 0 0.00% 0.00% 0.00% 0 AAA_SERVER_DEADT
20 0 1 0 0.00% 0.00% 0.00% 0 Policy Manager
21 17 77 220 0.00% 0.00% 0.00% 0 Entity MIB API
22 0 1 0 0.00% 0.00% 0.00% 0 IFS Agent Manage

[MHM Cisco World]

Show processes cpu sorted 5sec

Share this 

[cthca2]

CPU utilization for five seconds: 25%/0%; one minute: 24%; five minutes: 24%
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
161 1910435158 4190661454 0 7.51% 7.47% 7.51% 0 Hulc LED Process
7 409310979 36779827 11128 1.14% 0.29% 0.20% 0 Check heaps
219 840176483 3760959675 0 0.29% 0.35% 0.46% 0 Spanning Tree
130 686154734 167819263 4088 0.29% 0.30% 0.29% 0 hpm counter proc
17 222490801 532078785 418 0.24% 0.16% 0.12% 0 ARP Input
354 204055321 802357033 254 0.17% 0.12% 0.15% 0 IP SNMP
193 64311213 101075711 636 0.12% 0.03% 0.00% 0 CDP Protocol
172 264516088 33493878 7897 0.12% 0.12% 0.12% 0 HQM Stack Proces
92 59839487 3569192368 0 0.12% 0.03% 0.00% 0 RedEarth Tx Mana
182 197798115 55939755 3535 0.12% 0.09% 0.11% 0 Power RPS Proces
356 298299739 407570156 731 0.05% 0.11% 0.11% 0 SNMP ENGINE
173 66711089 66987918 995 0.05% 0.02% 0.05% 0 HRPC qos request
206 113615918 524497946 216 0.05% 0.10% 0.11% 0 IP Input

I will try to run this command the same time that have the event (1 am)

Also is a good idea to enable spanning-tree loging to get more specifics logs?

thanks