VG224 SHUT NO SHUT Configured from Console by Console

[Tom W.]

Hi Cisco Community Members,

We ran into these interesting logs on one of our VG224s and was wondering if anyone knows what this is? Is someone or something actually shutting down and then immediately bringing these ports back online?

xxx-xxx-xxx#sh history all | begin 17:59:27
CMD: 'voice-port 2/3 ' 17:59:27 UTC Wed Feb 12 2020
CMD: ' shut ' 17:59:27 UTC Wed Feb 12 2020
000494: Feb 12 17:59:27.493 UTC: %LINK-3-UPDOWN: Interface Foreign Exchange Station 2/3, changed state to Administrative Shutdown
CMD: 'end' 17:59:27 UTC Wed Feb 12 2020
000495: Feb 12 17:59:27.493 UTC: %SYS-5-CONFIG_I: Configured from console by console
CMD: 'voice-port 2/3 ' 17:59:27 UTC Wed Feb 12 2020
CMD: ' no shut ' 17:59:27 UTC Wed Feb 12 2020
000496: Feb 12 17:59:27.897 UTC: %LINK-3-UPDOWN: Interface Foreign Exchange Station 2/3, changed state to up
CMD: 'end' 17:59:27 UTC Wed Feb 12 2020
000497: Feb 12 17:59:27.897 UTC: %SYS-5-CONFIG_I: Configured from console by console

Thanks,

Tom

[Vaijanath Sonvane]

Yes, the voice-port 2/3 is administratively shut down by someone who has console access to VG224 and brought it back.

[Tom W.]

Are you 100% certain? Could it be a bug instead, because nobody in my team did this for sure. If you are 100% certain then we have a potential break in!

Thanks,

Tom

[Vaijanath Sonvane]

Hi,

I was able to check on VG310 (don't have VG224 ). When I perform shut and no shut commands via SSH session, it shows exactly same output for "show history all" except it shows console by admin on vty0 as I was connected via SSH:

CMD: 'config t' 16:47:11 EST Thu Feb 13 2020
CMD: 'voice-port 0/0/23' 16:47:15 EST Thu Feb 13 2020
CMD: 'shut' 16:47:17 EST Thu Feb 13 2020
Feb 13 20:47:17.681: %LINK-3-UPDOWN: Interface Foreign Exchange Station 0/0/23, changed state to Administrative Shutdown
CMD: 'end' 16:47:25 EST Thu Feb 13 2020
Feb 13 20:47:25.537: %SYS-5-CONFIG_I: Configured from console by admin on vty0
CMD: 'config t' 16:47:53 EST Thu Feb 13 2020
CMD: 'voice-port 0/0/23' 16:47:56 EST Thu Feb 13 2020
CMD: 'no shutdown ' 16:47:59 EST Thu Feb 13 2020
Feb 13 20:47:59.213: %LINK-3-UPDOWN: Interface Foreign Exchange Station 0/0/23, changed state to up
Feb 13 20:48:01.881: %SYS-5-CONFIG_I: Configured from console by admin on vty0

When I did voice port reset from CUCM, it doesn't show any output for shut/no shut on VG310 logs. 

How are you checking the logs on VG224? (SSH or Console)

[Tom W.]

We're checking logs via SSH and Show History All.

Thanks,

Tom

[davisjaron]

You may get this message if you reset the port from CUCM.

[Tom W.]

Ok, this would make more sense as if someone was configuring this port in CUCM and reset it.

Thanks,

Tom