Stealthwatch Error 17.15.03

[casey-babel]

Upgraded this morning from IOS-XE 17.12.03 -> 17.15.03 (C9300-48UXM). I am now getting these messages in the logs:

Apr 18 2025 08:45:34.943 CST: %IOSXE-3-PLATFORM: Switch 1 R0/0: fed: Stealthwatch Cloud is not initialized.Please configure to use this CLI 
Apr 18 2025 08:59:48.286 CST: %IOSXE-3-PLATFORM: Switch 1 R0/0: fed: Stealthwatch Cloud is not initialized.Please configure to use this CLI 
Apr 18 2025 09:19:59.948 CST: %IOSXE-3-PLATFORM: Switch 1 R0/0: fed: Stealthwatch Cloud is not initialized.Please configure to use this CLI 
Apr 18 2025 09:25:07.656 CST: %IOSXE-3-PLATFORM: Switch 1 R0/0: fed: Stealthwatch Cloud is not initialized.Please configure to use this CLI 

We do not nor have ever used Stealthwatch. I could not find a bug when searching Cisco BST.

I found this reference document: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/17-15/configuration_guide/nmgmt/b_1715_nmgmt_9300_cg/configuring_network_detection_and_response.html#t-configuring-stealthwatch-cloud

It did not really assist with the syslog message. Thoughts?

[Nathan_Lee · Accepted solution]

Is the switch being monitored by Catalyst Center? As part of the Assurance function on Catalyst Center, one of the commands that is issued is "show stealthwatch-cloud connection" to monitor the health of the device's connection to SWC. If the device is not configured for SWC, the indicated log message will appear.

[casey-babel]

It is being monitored by Catalyst Center, I guess that explains it. Since this generates an "Error" log, it is something we now have to filter out of our alerts.

[Leo Laohoo]

@Nathan_Lee, 

Is this a bug (undocumented features)?

Without using logging discriminator, how do I disable this error from spamming our logs?

[mwalsleben]

I'm also interested in a solution.

We updated from 17.12.4 to 17.12.5 and these error logs showed up.

[Leo Laohoo]

Try this logging discriminator: 

 logging discriminator FO_STEALTHWATCH_SPAM facility drops SMART_LIC msg-body drops dnac|hmac-sha|EPM|Stealthwatch
 logging buffered discriminator FO_STEALTHWATCH_SPAM 40960
 logging  console discriminator FO_STEALTHWATCH_SPAM
 logging  monitor discriminator FO_STEALTHWATCH_SPAM