Symptom

Some monitoring tools have the capability to push changes (such as hostname changes) to the Nexus. These changes are not recorded in the accounting log, thus it is difficult to track the source of the change.

Conditions

On large environments, multiple monitoring tools can be enabled at once. If changes are made it's difficult to identify which monitoring tool created the set request. Administrative config changes via SNMPSET are not logged in the accounting log.

Workaround

Review SNMP logs, however they can rotate too quickly. Details can be found with the following commands: `show system internal snmp event-history pktdump` 1) Event:E_DEBUG, length:160, at 471550 usecs after Wed Oct 2 00:22:48 2019 <---- Contains IP address of remote host where set request originated [107] SNMPPKTSTRT: 1.000000 162 972405127.000000 0.000000 0.000000 0.000000 0 0 2 1 0 ******** 8 remote ip,v4: snmp_44765_10.122.x.x 0 0 0 0 0 0 0 15 2) Event:E_DEBUG, length:83, at 471522 usecs after Wed Oct 2 00:22:48 2019 [107] 972405127.000000:iso.3.6.1.2.1.1.5.0 = STRING: "new-n9k-hostname" SNMPPKTEND <----- New hostname value `show snmp nms-statistics` <--- Shows number of set requests sent and the source - SNMP NMS OID Stats - NMS IP Address GET GET GET SET First Poll Last Poll NEXT BULK ------------------------------------------------------------------------------------------------------------------------ 10.122.x.x 2 344 0 [[13]] 23:40:49:963 Oct 01 2019 00:22:48:464 Oct 02 2019

Further Problem Description