Cisco switch renaming own config files?

[Shadowspawn]

Ladies and Gentlemen,

A Google of the intertubes turned up nothing on this subject. Is it possible for a Cisco switch to rename its own "config.text" file to "config.text.renamed" for any reason? I have a remote site that this has happened on, twice within the last week. I'm trying to decide if I have a wannabe hacker on the site or some glitch that I've never seen before.

Oh, and yes, you're right, there should be a log of the event - however my company hasn't seen fit to purchase the needed logging software.

Thanks.

 

[Fint]

kiwi syslogd is free, and so is RANCID.

As far as your question, I've never seen it (6 years exp as a Cisco guy)

 

[Boscoh]

I've seen this before, but only when someone holds down the Mode button on the switch for a while. If the switch can do Express Setup, holding down the Mode button resets it to factory defaults, and I believe it also appends .renamed to the current config and vlan.dat.

Go into config mode and type 'no setup express' and it should take care of the problem if this is what's going on. If it happens again, call Cisco TAC immediately. If the switch doesn't have a mode button, then I'm not sure what the problem would be.

 

[Shadowspawn]

I've not heard of Express Setup, I'm going to go search on it after I reply...but I am wondering if it has anything to do with the "do you want to stop auto setup" prompt I received upon consoling in.

And thanks for the syslog info...I've purchased a Kiwi syslog package before, I wonder if its similiar.

 

[Boscoh]

Express Setup is a web gui that is installed on Cat 500, 2940, 2950, 2960, 2970, 3560/E, and 3750/E switches. It's a way to allow you to quickly get a switch up and running if you don't have a console cable by plugging your PC into an ethernet port on the front and letting it get a DHCP address from the switch.