understanding the flash:version file

[Waterbird]

On most catalyst switches when I run the dir flash: command, there is a file there called version.  When I run the command more flash:version I can see it has some personalized configuration content such as the hostname of the device, as well as show verision information.  Since it contains the hostname of the device, I have been running the command delete flash:version to remove this file, so that that information is not released when the device is sold.

However, I'm unclear on what the purpose of the version file is, and what the conseqences are of deleting it as I have been doing. Will deleting it cause a problem for the future user of the device?  Also, I'm just curious what the purpose of this file is if anyone can answer that.

[Leo Laohoo]

I have never seen a file called "version" before.  
Please post the complete output to the command "dir".

[Mohsin Alam]

Can you post the full output of dir flash:

also can you most the output of more flash:version ( cropping out sensitive information )

## Make sure to mark post as helpful, If it resolved your issue. ##

[Waterbird]

dir flash: 

vlan.dat

x.bin

SNMP-USER

ver-output

version

multiple-fs

private-config.text

config.text

more flash:version

This gives almost the same output as running the show version command would give.

It adds a few additional information such as the hostname and uptime, but mostly the same as show version ouput.

[Mohsin Alam · Accepted solution]

my best bet someone who had access to the switch did this:

show version | redirect flash:version

which basically saves the output of the show version in flash with file name version, you can safely delete it !

## Make sure to mark post as helpful, If it resolved your issue. ##

[Waterbird]

Good theory, though it is on all the switches in the network, so that is surprising if somone manually went in to each switch and did this.  Not sure why they would go to that trouble.

[Leo Laohoo · Accepted solution]

---

@Waterbird wrote:

I see this on Catalyst 3750, and I think also on 9300 and 3850.

---

Look at the config.  See if there are any EEM scripts.  Aside from the "version" there are also two other files, SNMP-USER and ver-output, that are not "ordinary".  

If there are no EEM scripts then someone may have ran commands and concat the output to these files.  Look at the time and date stamps when the files were generated.

I have 3750, 3850 and 9300 and I do not see this file at all. 

[Waterbird]

I don't see any EEM scripts, so it seems like it must have been done by a command manually entered on each switch, but not sure for what purpose someone would do that.

The dates of the version file and SNMP-USER files are the same, and not recent.  The ver-output is from an even earlier time.  

Thanks

[Leo Laohoo]

What is the model of the switch? 

I cannot believe you "edited" the IOS filename.  

[Waterbird]

I see this on Catalyst 3750, and I think also on 9300 and 3850.

[Leo Laohoo]

If these switches are in "highly confidential" network, then the most safest option to decommission them is to engage the Cisco AM about Cisco Takeback & Reuse Program.