WLC9800 Reload by Command RIF

[maverick0]

Guys,

I have a Catalyst WLC 9800 that was reload by itself and in the log message I've found the following reason:

Last reload reason: Reload Command by RIF"

Anyone here already take this issue? Would know what is it mean?

[Leo Laohoo]

Post the complete output to the following commands: 

• sh version
• dir bootflash:

[maverick0]

@Leo Laohoo 

Let me take the dir bootflash: output for you.

------------------ show version ------------------

Cisco IOS XE Software, Version 17.03.03
Cisco IOS Software [Amsterdam], C9800 Software (C9800_IOSXE-K9), Version 17.3.3, RELEASE SOFTWARE (fc7)
Technical Support: cisco.com
Copyright (c) 1986-2021 by Cisco Systems, Inc.
Compiled Thu 04-Mar-21 12:37 by mcpre

Cisco IOS-XE software, Copyright (c) 2005-2021 by cisco Systems, Inc.
All rights reserved. Certain components of Cisco IOS-XE software are
licensed under the GNU General Public License ("GPL") Version 2.0. The
software code licensed under GPL Version 2.0 is free software that comes
with ABSOLUTELY NO WARRANTY. You can redistribute and/or modify such
GPL code under the terms of GPL Version 2.0. For more details, see the
documentation or "License Notice" file accompanying the IOS-XE software,
or the applicable URL provided on the flyer accompanying the IOS-XE
software.

ROM: 16.10(2r)

WLC9800NYC20 uptime is 4 hours, 30 minutes
Uptime for this control processor is 4 hours, 32 minutes
System returned to ROM by Reload Command by RIF at 17:20:48 UTC Tue Oct 26 2022
System restarted at 20:34:49 UTC Tue Oct 25 2022
System image file is "bootflash:packages.conf"
Last reload reason: Reload Command by RIF

[Scott Fella]

My thing is, if you can't find the error on the internet, your best bet is to also open a TAC case.  This way folks here can chime in and TAC can investigate and provide the reason for the reboot.

[maverick0]

I got it, but I am just looking for more information about the RIF before open a TAC and heard from the engineer that is a normal behavior and there is no solution.

[Rich R]

Who told that's normal behaviour?
I've never seen that!
Also note you're running old IOS - refer to link below for TAC recommended versions which is probably the first thing TAC will tell you to do.

[Rich R]

At first glance that would suggest that a person or server/process or event manager script (using user id RIF), with enable access to your WLC, reloaded it.
So what eem or kron scripts are configured on your WLC?
Who and what has access to your WLC?
9800 has continuous and persistent logging so TAC will be able to tell you from the trace logs exactly how the reload was initiated.

[Leo Laohoo]

Forgot another command:  sh history

[Mark Elsen]

 - Might be related to HA state change(s) , check this paragraph and or execute the mentioned commands : https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-7/config-guide/b_wl_17_7_cg/m_vewlc_high_availability.html#id_135569

 M.

[Rich R]

HA switchover would usually show 2 different uptimes - 1 for the HA pair and 1 for the active chassis eg:
WLC uptime is 11 weeks, 6 days, 23 hours, 58 minutes
Uptime for this control processor is 12 weeks, 0 minutes
But good spot @Mark Elsen 
@maverick0 if it is an HA pair then take a good look at those rif-mgr outputs as well as all the show redundancy outputs.