C9800 spam in the log

[Clem58]

Hello,

We have a cluster of 2xC9800-CL and one C9800-40 WLCs, and both face some spam into the logs :

%SYS-5-CONFIG_P: Configured programmatically by process SEP_webui_wsma_http from console as xx on vty0
%SYS-5-CONFIG_P: Configured programmatically by process SEP_webui_wsma_http from console as xx on vty0
%SYS-5-CONFIG_P: Configured programmatically by process SEP_webui_wsma_http from console as xx on vty0

I did not find anything relevant in the Cisco bugs articles, do you know how we can have this informational spams to be stopped ?

[marce1000]

  - This could be due to a (the)  security bug in IOS-XE ; you need to upgrade to at minimum 17.9.4a to mitigate it , will post more details soon, 

 M.

[marce1000]

  - Added reply : 
              https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-xe-dublin-17121/221128-software-fix-availability-for-cisco-ios.html
                  https://tools.cisco.com/bugsearch/bug/CSCwh87343

             An 'external article' : https://thesecmaster.com/protect-your-cisco-devices-from-cve-2023-20198-a-critical-privilege-escalation-vulnerability-in-cisco-ios-xe/

 M.

[Clem58]

They are on the latest 17.13.1 version

[marce1000]

                      >...They are on the latest 17.13.1 version
 - Following the bug report that release is fixed : check administrative users configured in the controller anyway (running config and check if they are all authorized and known admins) . Meaning to check if the controller is not compromised.
                          If you 'like' checkout : https://github.com/smokeintheshell/CVE-2023-20198     (e.g.!)

 M.

[Clem58]

We are using TACACS and I'm using a user will all privileges

[marce1000]

  Ok; but that isn't exactly what I asked to verify : whether no local malicious users have been created ,

 M;

[Rich R]

You'll see that every time anybody logs in to the GUI. 
If those logins correspond with your TACACS logs of authorised users then they are completely normal.
If you don't want to see them in the log then define a logging buffer filter to exclude them.
logging discriminator ...
logging buffered discriminator ...

[Clem58]

Thanks Rich, we don't have these spams in our other IOS-XE switches, isn't there a command to specifically disable them ?

[marce1000]

  - You may want to configure a logging discriminator as explained in https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/esm/configuration/xe-16-5/esm-xe-16-5-book/reliable-del-filter.html

 M.

[Rich R · Accepted solution]

> You may want to configure a logging discriminator 
Already suggested that in previous reply <smile>

> we don't have these spams in our other IOS-XE switches, isn't there a command to specifically disable them ?
Compare the configs?  Maybe you have a different logging level set or are already using a logging discriminator.
We've always seen those logs on all our 9800.