Wired Intelligent Edge

Hello,

I have 6100s and 6300s that I just upgraded to 10.10.1000 from some 10.09 release.

Since then, I have 2 new problems, across all 6100s and 6300s.

First problem is NTP log spam. Following report is from a 6300 (copy-pasted from a remote syslog server):

Sep  5 19:53:45 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:53:45 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41
Sep  5 19:53:56 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:53:56 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41
Sep  5 19:54:06 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:54:06 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41

So I ran tcpdump on the ntp server and the only relevant traffic is a request/reply every ~64s, while the switch logs a connection lost/established event pair every ~10s. It makes no sense, as the switch report a connection lost/established pair while no traffic is even exchanged with the ntp server!

Relevant config:

ntp server 10.1.1.41 minpoll 4 maxpoll 7 iburst prefer
ntp server 10.1.1.42 minpoll 4 maxpoll 7 iburst
ntp server pool.ntp.org minpoll 4 maxpoll 8 iburst
ntp server redacted1 minpoll 4 maxpoll 7 iburst
ntp server redacted2 minpoll 4 maxpoll 7 iburst
ntp server redacted3 minpoll 4 maxpoll 7 iburst
ntp server redacted4 minpoll 4 maxpoll 7 iburst

The other problem, may be related or not:

Sep  5 19:58:32 cx632 log-mgmtd[3245] Event|1231|LOG_INFO|CDTR|1|Syslog client restarted due to configuration change.
Sep  5 19:58:33 cx632 log-proxyd[770] Event|1233|LOG_INFO|CDTR|1|Starting System Logging Service.
Sep  5 19:58:33 cx632 log-proxyd[770] Event|1234|LOG_INFO|CDTR|1|Started System Logging Service.

It happens every few minutes, not a definite/identifiable frequency. What "configuration" is this "configuration change" referring to? Because I'm not making any change to the running-configuration (or startup-configuration) and there is only an idle ssh connection to the switch, which is not doing anything fancy.

Despite the log spam, it seems the time is synchronized and I see no adverse effect due to the "Syslog client restarted due to configuration change"

Thanks in advance

Experiencing exact same issue on 6300 switches running 10.08.1080.
Original Message:
Sent: Sep 05, 2022 02:10 PM
From: Alexandre Maret
Subject: NTP log spam on 10.10.1000

Hello,

I have 6100s and 6300s that I just upgraded to 10.10.1000 from some 10.09 release.

Since then, I have 2 new problems, across all 6100s and 6300s.

First problem is NTP log spam. Following report is from a 6300 (copy-pasted from a remote syslog server):

Sep  5 19:53:45 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:53:45 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41
Sep  5 19:53:56 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:53:56 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41
Sep  5 19:54:06 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:54:06 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41

So I ran tcpdump on the ntp server and the only relevant traffic is a request/reply every ~64s, while the switch logs a connection lost/established event pair every ~10s. It makes no sense, as the switch report a connection lost/established pair while no traffic is even exchanged with the ntp server!

Relevant config:

ntp server 10.1.1.41 minpoll 4 maxpoll 7 iburst prefer
ntp server 10.1.1.42 minpoll 4 maxpoll 7 iburst
ntp server pool.ntp.org minpoll 4 maxpoll 8 iburst
ntp server redacted1 minpoll 4 maxpoll 7 iburst
ntp server redacted2 minpoll 4 maxpoll 7 iburst
ntp server redacted3 minpoll 4 maxpoll 7 iburst
ntp server redacted4 minpoll 4 maxpoll 7 iburst

The other problem, may be related or not:

Sep  5 19:58:32 cx632 log-mgmtd[3245] Event|1231|LOG_INFO|CDTR|1|Syslog client restarted due to configuration change.
Sep  5 19:58:33 cx632 log-proxyd[770] Event|1233|LOG_INFO|CDTR|1|Starting System Logging Service.
Sep  5 19:58:33 cx632 log-proxyd[770] Event|1234|LOG_INFO|CDTR|1|Started System Logging Service.

It happens every few minutes, not a definite/identifiable frequency. What "configuration" is this "configuration change" referring to? Because I'm not making any change to the running-configuration (or startup-configuration) and there is only an idle ssh connection to the switch, which is not doing anything fancy.

Despite the log spam, it seems the time is synchronized and I see no adverse effect due to the "Syslog client restarted due to configuration change"

Thanks in advance

In release notes from 10.09.1050 released this week, under "fixed issues" there is bug ID 233678:

Symptom: Frequent event logs are generated for NTP with the message NTP primary server connection lost.
Scenario:When two or more NTP servers are configured and connected the event logs will generate the error.
Workaround:None. These event logs are misleading and can be ignored. The NTP server connection is stable can be verified using show ntp associations.

Original Message:
Sent: Sep 05, 2022 02:10 PM
From: Alexandre Maret
Subject: NTP log spam on 10.10.1000

Hello,

I have 6100s and 6300s that I just upgraded to 10.10.1000 from some 10.09 release.

Since then, I have 2 new problems, across all 6100s and 6300s.

First problem is NTP log spam. Following report is from a 6300 (copy-pasted from a remote syslog server):

Sep  5 19:53:45 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:53:45 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41
Sep  5 19:53:56 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:53:56 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41
Sep  5 19:54:06 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:54:06 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41

So I ran tcpdump on the ntp server and the only relevant traffic is a request/reply every ~64s, while the switch logs a connection lost/established event pair every ~10s. It makes no sense, as the switch report a connection lost/established pair while no traffic is even exchanged with the ntp server!

Relevant config:

ntp server 10.1.1.41 minpoll 4 maxpoll 7 iburst prefer
ntp server 10.1.1.42 minpoll 4 maxpoll 7 iburst
ntp server pool.ntp.org minpoll 4 maxpoll 8 iburst
ntp server redacted1 minpoll 4 maxpoll 7 iburst
ntp server redacted2 minpoll 4 maxpoll 7 iburst
ntp server redacted3 minpoll 4 maxpoll 7 iburst
ntp server redacted4 minpoll 4 maxpoll 7 iburst

The other problem, may be related or not:

Sep  5 19:58:32 cx632 log-mgmtd[3245] Event|1231|LOG_INFO|CDTR|1|Syslog client restarted due to configuration change.
Sep  5 19:58:33 cx632 log-proxyd[770] Event|1233|LOG_INFO|CDTR|1|Starting System Logging Service.
Sep  5 19:58:33 cx632 log-proxyd[770] Event|1234|LOG_INFO|CDTR|1|Started System Logging Service.

It happens every few minutes, not a definite/identifiable frequency. What "configuration" is this "configuration change" referring to? Because I'm not making any change to the running-configuration (or startup-configuration) and there is only an idle ssh connection to the switch, which is not doing anything fancy.

Despite the log spam, it seems the time is synchronized and I see no adverse effect due to the "Syslog client restarted due to configuration change"

Thanks in advance

Thanks! Time to test out 10.09.1050 in the lab!
Original Message:
Sent: Sep 16, 2022 12:21 PM
From: John Kupski
Subject: NTP log spam on 10.10.1000

In release notes from 10.09.1050 released this week, under "fixed issues" there is bug ID 233678:

Symptom: Frequent event logs are generated for NTP with the message NTP primary server connection lost.
Scenario:When two or more NTP servers are configured and connected the event logs will generate the error.
Workaround:None. These event logs are misleading and can be ignored. The NTP server connection is stable can be verified using show ntp associations.

Original Message:
Sent: Sep 05, 2022 02:10 PM
From: Alexandre Maret
Subject: NTP log spam on 10.10.1000

Hello,

I have 6100s and 6300s that I just upgraded to 10.10.1000 from some 10.09 release.

Since then, I have 2 new problems, across all 6100s and 6300s.

First problem is NTP log spam. Following report is from a 6300 (copy-pasted from a remote syslog server):

Sep  5 19:53:45 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:53:45 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41
Sep  5 19:53:56 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:53:56 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41
Sep  5 19:54:06 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:54:06 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41

So I ran tcpdump on the ntp server and the only relevant traffic is a request/reply every ~64s, while the switch logs a connection lost/established event pair every ~10s. It makes no sense, as the switch report a connection lost/established pair while no traffic is even exchanged with the ntp server!

Relevant config:

ntp server 10.1.1.41 minpoll 4 maxpoll 7 iburst prefer
ntp server 10.1.1.42 minpoll 4 maxpoll 7 iburst
ntp server pool.ntp.org minpoll 4 maxpoll 8 iburst
ntp server redacted1 minpoll 4 maxpoll 7 iburst
ntp server redacted2 minpoll 4 maxpoll 7 iburst
ntp server redacted3 minpoll 4 maxpoll 7 iburst
ntp server redacted4 minpoll 4 maxpoll 7 iburst

The other problem, may be related or not:

Sep  5 19:58:32 cx632 log-mgmtd[3245] Event|1231|LOG_INFO|CDTR|1|Syslog client restarted due to configuration change.
Sep  5 19:58:33 cx632 log-proxyd[770] Event|1233|LOG_INFO|CDTR|1|Starting System Logging Service.
Sep  5 19:58:33 cx632 log-proxyd[770] Event|1234|LOG_INFO|CDTR|1|Started System Logging Service.

It happens every few minutes, not a definite/identifiable frequency. What "configuration" is this "configuration change" referring to? Because I'm not making any change to the running-configuration (or startup-configuration) and there is only an idle ssh connection to the switch, which is not doing anything fancy.

Despite the log spam, it seems the time is synchronized and I see no adverse effect due to the "Syslog client restarted due to configuration change"

Thanks in advance

...and/or wait for an updated build of the ArubaOS-CX 10.10 software release too (say with a new ArubaOS-CX 10.10.10xx): indeed this issue is hitting the 10.10 along with the 10.08 and 10.09.

P.S. Also, the ArubaOS-CX 10.08.1090 fixes the reported issue (Bug ID 233678 - NTP).
Original Message:
Sent: Sep 16, 2022 12:26 PM
From: Vishal Malli
Subject: NTP log spam on 10.10.1000

Thanks! Time to test out 10.09.1050 in the lab!
Original Message:
Sent: Sep 16, 2022 12:21 PM
From: John Kupski
Subject: NTP log spam on 10.10.1000

In release notes from 10.09.1050 released this week, under "fixed issues" there is bug ID 233678:

Symptom: Frequent event logs are generated for NTP with the message NTP primary server connection lost.
Scenario:When two or more NTP servers are configured and connected the event logs will generate the error.
Workaround:None. These event logs are misleading and can be ignored. The NTP server connection is stable can be verified using show ntp associations.

Original Message:
Sent: Sep 05, 2022 02:10 PM
From: Alexandre Maret
Subject: NTP log spam on 10.10.1000

Hello,

I have 6100s and 6300s that I just upgraded to 10.10.1000 from some 10.09 release.

Since then, I have 2 new problems, across all 6100s and 6300s.

First problem is NTP log spam. Following report is from a 6300 (copy-pasted from a remote syslog server):

Sep  5 19:53:45 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:53:45 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41
Sep  5 19:53:56 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:53:56 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41
Sep  5 19:54:06 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:54:06 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41

So I ran tcpdump on the ntp server and the only relevant traffic is a request/reply every ~64s, while the switch logs a connection lost/established event pair every ~10s. It makes no sense, as the switch report a connection lost/established pair while no traffic is even exchanged with the ntp server!

Relevant config:

ntp server 10.1.1.41 minpoll 4 maxpoll 7 iburst prefer
ntp server 10.1.1.42 minpoll 4 maxpoll 7 iburst
ntp server pool.ntp.org minpoll 4 maxpoll 8 iburst
ntp server redacted1 minpoll 4 maxpoll 7 iburst
ntp server redacted2 minpoll 4 maxpoll 7 iburst
ntp server redacted3 minpoll 4 maxpoll 7 iburst
ntp server redacted4 minpoll 4 maxpoll 7 iburst

The other problem, may be related or not:

Sep  5 19:58:32 cx632 log-mgmtd[3245] Event|1231|LOG_INFO|CDTR|1|Syslog client restarted due to configuration change.
Sep  5 19:58:33 cx632 log-proxyd[770] Event|1233|LOG_INFO|CDTR|1|Starting System Logging Service.
Sep  5 19:58:33 cx632 log-proxyd[770] Event|1234|LOG_INFO|CDTR|1|Started System Logging Service.

It happens every few minutes, not a definite/identifiable frequency. What "configuration" is this "configuration change" referring to? Because I'm not making any change to the running-configuration (or startup-configuration) and there is only an idle ssh connection to the switch, which is not doing anything fancy.

Despite the log spam, it seems the time is synchronized and I see no adverse effect due to the "Syslog client restarted due to configuration change"

Thanks in advance

I'll wait for the 10.10 build, good to see it is confirmed elsewhere. Thanks.

What isn't clear though is whether the second issue ("Syslog client restarted due to configuration change") is related and expected to be fixed along the NTP bug.
Original Message:
Sent: Sep 20, 2022 06:00 AM
From: Davide Poletto
Subject: NTP log spam on 10.10.1000

...and/or wait for an updated build of the ArubaOS-CX 10.10 software release too (say with a new ArubaOS-CX 10.10.10xx): indeed this issue is hitting the 10.10 along with the 10.08 and 10.09.

P.S. Also, the ArubaOS-CX 10.08.1090 fixes the reported issue (Bug ID 233678 - NTP).
Original Message:
Sent: Sep 16, 2022 12:26 PM
From: Vishal Malli
Subject: NTP log spam on 10.10.1000

Thanks! Time to test out 10.09.1050 in the lab!
Original Message:
Sent: Sep 16, 2022 12:21 PM
From: John Kupski
Subject: NTP log spam on 10.10.1000

In release notes from 10.09.1050 released this week, under "fixed issues" there is bug ID 233678:

Symptom: Frequent event logs are generated for NTP with the message NTP primary server connection lost.
Scenario:When two or more NTP servers are configured and connected the event logs will generate the error.
Workaround:None. These event logs are misleading and can be ignored. The NTP server connection is stable can be verified using show ntp associations.

Original Message:
Sent: Sep 05, 2022 02:10 PM
From: Alexandre Maret
Subject: NTP log spam on 10.10.1000

Hello,

I have 6100s and 6300s that I just upgraded to 10.10.1000 from some 10.09 release.

Since then, I have 2 new problems, across all 6100s and 6300s.

First problem is NTP log spam. Following report is from a 6300 (copy-pasted from a remote syslog server):

Sep  5 19:53:45 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:53:45 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41
Sep  5 19:53:56 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:53:56 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41
Sep  5 19:54:06 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:54:06 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41

So I ran tcpdump on the ntp server and the only relevant traffic is a request/reply every ~64s, while the switch logs a connection lost/established event pair every ~10s. It makes no sense, as the switch report a connection lost/established pair while no traffic is even exchanged with the ntp server!

Relevant config:

ntp server 10.1.1.41 minpoll 4 maxpoll 7 iburst prefer
ntp server 10.1.1.42 minpoll 4 maxpoll 7 iburst
ntp server pool.ntp.org minpoll 4 maxpoll 8 iburst
ntp server redacted1 minpoll 4 maxpoll 7 iburst
ntp server redacted2 minpoll 4 maxpoll 7 iburst
ntp server redacted3 minpoll 4 maxpoll 7 iburst
ntp server redacted4 minpoll 4 maxpoll 7 iburst

The other problem, may be related or not:

Sep  5 19:58:32 cx632 log-mgmtd[3245] Event|1231|LOG_INFO|CDTR|1|Syslog client restarted due to configuration change.
Sep  5 19:58:33 cx632 log-proxyd[770] Event|1233|LOG_INFO|CDTR|1|Starting System Logging Service.
Sep  5 19:58:33 cx632 log-proxyd[770] Event|1234|LOG_INFO|CDTR|1|Started System Logging Service.

It happens every few minutes, not a definite/identifiable frequency. What "configuration" is this "configuration change" referring to? Because I'm not making any change to the running-configuration (or startup-configuration) and there is only an idle ssh connection to the switch, which is not doing anything fancy.

Despite the log spam, it seems the time is synchronized and I see no adverse effect due to the "Syslog client restarted due to configuration change"

Thanks in advance

"...good to see it is confirmed elsewhere" Where? mine was just a guess since Aruba released new build on 10.08 and 10.09 and not on 10.10 yet.
Original Message:
Sent: Sep 20, 2022 08:16 AM
From: Alexandre Maret
Subject: NTP log spam on 10.10.1000

I'll wait for the 10.10 build, good to see it is confirmed elsewhere. Thanks.

What isn't clear though is whether the second issue ("Syslog client restarted due to configuration change") is related and expected to be fixed along the NTP bug.
Original Message:
Sent: Sep 20, 2022 06:00 AM
From: Davide Poletto
Subject: NTP log spam on 10.10.1000

...and/or wait for an updated build of the ArubaOS-CX 10.10 software release too (say with a new ArubaOS-CX 10.10.10xx): indeed this issue is hitting the 10.10 along with the 10.08 and 10.09.

P.S. Also, the ArubaOS-CX 10.08.1090 fixes the reported issue (Bug ID 233678 - NTP).
Original Message:
Sent: Sep 16, 2022 12:26 PM
From: Vishal Malli
Subject: NTP log spam on 10.10.1000

Thanks! Time to test out 10.09.1050 in the lab!
Original Message:
Sent: Sep 16, 2022 12:21 PM
From: John Kupski
Subject: NTP log spam on 10.10.1000

In release notes from 10.09.1050 released this week, under "fixed issues" there is bug ID 233678:

Symptom: Frequent event logs are generated for NTP with the message NTP primary server connection lost.
Scenario:When two or more NTP servers are configured and connected the event logs will generate the error.
Workaround:None. These event logs are misleading and can be ignored. The NTP server connection is stable can be verified using show ntp associations.

Original Message:
Sent: Sep 05, 2022 02:10 PM
From: Alexandre Maret
Subject: NTP log spam on 10.10.1000

Hello,

I have 6100s and 6300s that I just upgraded to 10.10.1000 from some 10.09 release.

Since then, I have 2 new problems, across all 6100s and 6300s.

First problem is NTP log spam. Following report is from a 6300 (copy-pasted from a remote syslog server):

Sep  5 19:53:45 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:53:45 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41
Sep  5 19:53:56 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:53:56 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41
Sep  5 19:54:06 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:54:06 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41

So I ran tcpdump on the ntp server and the only relevant traffic is a request/reply every ~64s, while the switch logs a connection lost/established event pair every ~10s. It makes no sense, as the switch report a connection lost/established pair while no traffic is even exchanged with the ntp server!

Relevant config:

ntp server 10.1.1.41 minpoll 4 maxpoll 7 iburst prefer
ntp server 10.1.1.42 minpoll 4 maxpoll 7 iburst
ntp server pool.ntp.org minpoll 4 maxpoll 8 iburst
ntp server redacted1 minpoll 4 maxpoll 7 iburst
ntp server redacted2 minpoll 4 maxpoll 7 iburst
ntp server redacted3 minpoll 4 maxpoll 7 iburst
ntp server redacted4 minpoll 4 maxpoll 7 iburst

The other problem, may be related or not:

Sep  5 19:58:32 cx632 log-mgmtd[3245] Event|1231|LOG_INFO|CDTR|1|Syslog client restarted due to configuration change.
Sep  5 19:58:33 cx632 log-proxyd[770] Event|1233|LOG_INFO|CDTR|1|Starting System Logging Service.
Sep  5 19:58:33 cx632 log-proxyd[770] Event|1234|LOG_INFO|CDTR|1|Started System Logging Service.

It happens every few minutes, not a definite/identifiable frequency. What "configuration" is this "configuration change" referring to? Because I'm not making any change to the running-configuration (or startup-configuration) and there is only an idle ssh connection to the switch, which is not doing anything fancy.

Despite the log spam, it seems the time is synchronized and I see no adverse effect due to the "Syslog client restarted due to configuration change"

Thanks in advance

Where? bug ID 233678.

Without access to either bug tracker or source code, I can only make assumptions.... in particular the assumption that this bug with an identical description affecting 10.08 and 10.09 is also the one affecting 10.10. Seems fair and reasonable, right? All in all, it doesn't really affect functionality and patience will confirm whether this assumption is correct when a new 10.10 build is released.

Why bug didn't show up when I was running 10.09.1020 is not something I'll bother researching... 10.09.1050 release notes do not state when bug was introduced and with no access to the bug tracker for ID 233678, why bother?
Original Message:
Sent: Sep 20, 2022 12:04 PM
From: Davide Poletto
Subject: NTP log spam on 10.10.1000

"...good to see it is confirmed elsewhere" Where? mine was just a guess since Aruba released new build on 10.08 and 10.09 and not on 10.10 yet.
Original Message:
Sent: Sep 20, 2022 08:16 AM
From: Alexandre Maret
Subject: NTP log spam on 10.10.1000

I'll wait for the 10.10 build, good to see it is confirmed elsewhere. Thanks.

What isn't clear though is whether the second issue ("Syslog client restarted due to configuration change") is related and expected to be fixed along the NTP bug.
Original Message:
Sent: Sep 20, 2022 06:00 AM
From: Davide Poletto
Subject: NTP log spam on 10.10.1000

...and/or wait for an updated build of the ArubaOS-CX 10.10 software release too (say with a new ArubaOS-CX 10.10.10xx): indeed this issue is hitting the 10.10 along with the 10.08 and 10.09.

P.S. Also, the ArubaOS-CX 10.08.1090 fixes the reported issue (Bug ID 233678 - NTP).
Original Message:
Sent: Sep 16, 2022 12:26 PM
From: Vishal Malli
Subject: NTP log spam on 10.10.1000

Thanks! Time to test out 10.09.1050 in the lab!
Original Message:
Sent: Sep 16, 2022 12:21 PM
From: John Kupski
Subject: NTP log spam on 10.10.1000

In release notes from 10.09.1050 released this week, under "fixed issues" there is bug ID 233678:

Symptom: Frequent event logs are generated for NTP with the message NTP primary server connection lost.
Scenario:When two or more NTP servers are configured and connected the event logs will generate the error.
Workaround:None. These event logs are misleading and can be ignored. The NTP server connection is stable can be verified using show ntp associations.

Original Message:
Sent: Sep 05, 2022 02:10 PM
From: Alexandre Maret
Subject: NTP log spam on 10.10.1000

Hello,

I have 6100s and 6300s that I just upgraded to 10.10.1000 from some 10.09 release.

Since then, I have 2 new problems, across all 6100s and 6300s.

First problem is NTP log spam. Following report is from a 6300 (copy-pasted from a remote syslog server):

Sep  5 19:53:45 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:53:45 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41
Sep  5 19:53:56 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:53:56 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41
Sep  5 19:54:06 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:54:06 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41

So I ran tcpdump on the ntp server and the only relevant traffic is a request/reply every ~64s, while the switch logs a connection lost/established event pair every ~10s. It makes no sense, as the switch report a connection lost/established pair while no traffic is even exchanged with the ntp server!

Relevant config:

ntp server 10.1.1.41 minpoll 4 maxpoll 7 iburst prefer
ntp server 10.1.1.42 minpoll 4 maxpoll 7 iburst
ntp server pool.ntp.org minpoll 4 maxpoll 8 iburst
ntp server redacted1 minpoll 4 maxpoll 7 iburst
ntp server redacted2 minpoll 4 maxpoll 7 iburst
ntp server redacted3 minpoll 4 maxpoll 7 iburst
ntp server redacted4 minpoll 4 maxpoll 7 iburst

The other problem, may be related or not:

Sep  5 19:58:32 cx632 log-mgmtd[3245] Event|1231|LOG_INFO|CDTR|1|Syslog client restarted due to configuration change.
Sep  5 19:58:33 cx632 log-proxyd[770] Event|1233|LOG_INFO|CDTR|1|Starting System Logging Service.
Sep  5 19:58:33 cx632 log-proxyd[770] Event|1234|LOG_INFO|CDTR|1|Started System Logging Service.

It happens every few minutes, not a definite/identifiable frequency. What "configuration" is this "configuration change" referring to? Because I'm not making any change to the running-configuration (or startup-configuration) and there is only an idle ssh connection to the switch, which is not doing anything fancy.

Despite the log spam, it seems the time is synchronized and I see no adverse effect due to the "Syslog client restarted due to configuration change"

Thanks in advance

Release notes for 10.10.1010 are up and are showing that 233678 is resolved in this version as well.
Original Message:
Sent: Sep 20, 2022 04:38 PM
From: Alexandre Maret
Subject: NTP log spam on 10.10.1000

Where? bug ID 233678.

Without access to either bug tracker or source code, I can only make assumptions.... in particular the assumption that this bug with an identical description affecting 10.08 and 10.09 is also the one affecting 10.10. Seems fair and reasonable, right? All in all, it doesn't really affect functionality and patience will confirm whether this assumption is correct when a new 10.10 build is released.

Why bug didn't show up when I was running 10.09.1020 is not something I'll bother researching... 10.09.1050 release notes do not state when bug was introduced and with no access to the bug tracker for ID 233678, why bother?
Original Message:
Sent: Sep 20, 2022 12:04 PM
From: Davide Poletto
Subject: NTP log spam on 10.10.1000

"...good to see it is confirmed elsewhere" Where? mine was just a guess since Aruba released new build on 10.08 and 10.09 and not on 10.10 yet.
Original Message:
Sent: Sep 20, 2022 08:16 AM
From: Alexandre Maret
Subject: NTP log spam on 10.10.1000

I'll wait for the 10.10 build, good to see it is confirmed elsewhere. Thanks.

What isn't clear though is whether the second issue ("Syslog client restarted due to configuration change") is related and expected to be fixed along the NTP bug.
Original Message:
Sent: Sep 20, 2022 06:00 AM
From: Davide Poletto
Subject: NTP log spam on 10.10.1000

...and/or wait for an updated build of the ArubaOS-CX 10.10 software release too (say with a new ArubaOS-CX 10.10.10xx): indeed this issue is hitting the 10.10 along with the 10.08 and 10.09.

P.S. Also, the ArubaOS-CX 10.08.1090 fixes the reported issue (Bug ID 233678 - NTP).
Original Message:
Sent: Sep 16, 2022 12:26 PM
From: Vishal Malli
Subject: NTP log spam on 10.10.1000

Thanks! Time to test out 10.09.1050 in the lab!
Original Message:
Sent: Sep 16, 2022 12:21 PM
From: John Kupski
Subject: NTP log spam on 10.10.1000

In release notes from 10.09.1050 released this week, under "fixed issues" there is bug ID 233678:

Symptom: Frequent event logs are generated for NTP with the message NTP primary server connection lost.
Scenario:When two or more NTP servers are configured and connected the event logs will generate the error.
Workaround:None. These event logs are misleading and can be ignored. The NTP server connection is stable can be verified using show ntp associations.

Original Message:
Sent: Sep 05, 2022 02:10 PM
From: Alexandre Maret
Subject: NTP log spam on 10.10.1000

Hello,

I have 6100s and 6300s that I just upgraded to 10.10.1000 from some 10.09 release.

Since then, I have 2 new problems, across all 6100s and 6300s.

First problem is NTP log spam. Following report is from a 6300 (copy-pasted from a remote syslog server):

Sep  5 19:53:45 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:53:45 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41
Sep  5 19:53:56 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:53:56 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41
Sep  5 19:54:06 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:54:06 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41

So I ran tcpdump on the ntp server and the only relevant traffic is a request/reply every ~64s, while the switch logs a connection lost/established event pair every ~10s. It makes no sense, as the switch report a connection lost/established pair while no traffic is even exchanged with the ntp server!

Relevant config:

ntp server 10.1.1.41 minpoll 4 maxpoll 7 iburst prefer
ntp server 10.1.1.42 minpoll 4 maxpoll 7 iburst
ntp server pool.ntp.org minpoll 4 maxpoll 8 iburst
ntp server redacted1 minpoll 4 maxpoll 7 iburst
ntp server redacted2 minpoll 4 maxpoll 7 iburst
ntp server redacted3 minpoll 4 maxpoll 7 iburst
ntp server redacted4 minpoll 4 maxpoll 7 iburst

The other problem, may be related or not:

Sep  5 19:58:32 cx632 log-mgmtd[3245] Event|1231|LOG_INFO|CDTR|1|Syslog client restarted due to configuration change.
Sep  5 19:58:33 cx632 log-proxyd[770] Event|1233|LOG_INFO|CDTR|1|Starting System Logging Service.
Sep  5 19:58:33 cx632 log-proxyd[770] Event|1234|LOG_INFO|CDTR|1|Started System Logging Service.

It happens every few minutes, not a definite/identifiable frequency. What "configuration" is this "configuration change" referring to? Because I'm not making any change to the running-configuration (or startup-configuration) and there is only an idle ssh connection to the switch, which is not doing anything fancy.

Despite the log spam, it seems the time is synchronized and I see no adverse effect due to the "Syslog client restarted due to configuration change"

Thanks in advance

hello sir, 

is issue of Syslog client restarted due to configuration change solved ?

why this issue happen ? because we dont see any changes configuration in the switch,

show history is blank

------------------------------
BR,

Hudaya
------------------------------

Original Message:
Sent: Sep 20, 2022 08:16 AM
From: aemt
Subject: NTP log spam on 10.10.1000

I'll wait for the 10.10 build, good to see it is confirmed elsewhere. Thanks.

What isn't clear though is whether the second issue ("Syslog client restarted due to configuration change") is related and expected to be fixed along the NTP bug.
Original Message:
Sent: Sep 20, 2022 06:00 AM
From: Davide Poletto
Subject: NTP log spam on 10.10.1000

...and/or wait for an updated build of the ArubaOS-CX 10.10 software release too (say with a new ArubaOS-CX 10.10.10xx): indeed this issue is hitting the 10.10 along with the 10.08 and 10.09.

P.S. Also, the ArubaOS-CX 10.08.1090 fixes the reported issue (Bug ID 233678 - NTP).
Original Message:
Sent: Sep 16, 2022 12:26 PM
From: Vishal Malli
Subject: NTP log spam on 10.10.1000

Thanks! Time to test out 10.09.1050 in the lab!
Original Message:
Sent: Sep 16, 2022 12:21 PM
From: John Kupski
Subject: NTP log spam on 10.10.1000

In release notes from 10.09.1050 released this week, under "fixed issues" there is bug ID 233678:

Symptom: Frequent event logs are generated for NTP with the message NTP primary server connection lost.
Scenario:When two or more NTP servers are configured and connected the event logs will generate the error.
Workaround:None. These event logs are misleading and can be ignored. The NTP server connection is stable can be verified using show ntp associations.

Original Message:
Sent: Sep 05, 2022 02:10 PM
From: Alexandre Maret
Subject: NTP log spam on 10.10.1000

Hello,

I have 6100s and 6300s that I just upgraded to 10.10.1000 from some 10.09 release.

Since then, I have 2 new problems, across all 6100s and 6300s.

First problem is NTP log spam. Following report is from a 6300 (copy-pasted from a remote syslog server):

Sep  5 19:53:45 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:53:45 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41
Sep  5 19:53:56 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:53:56 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41
Sep  5 19:54:06 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
Sep  5 19:54:06 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41

So I ran tcpdump on the ntp server and the only relevant traffic is a request/reply every ~64s, while the switch logs a connection lost/established event pair every ~10s. It makes no sense, as the switch report a connection lost/established pair while no traffic is even exchanged with the ntp server!

Relevant config:

ntp server 10.1.1.41 minpoll 4 maxpoll 7 iburst prefer
ntp server 10.1.1.42 minpoll 4 maxpoll 7 iburst
ntp server pool.ntp.org minpoll 4 maxpoll 8 iburst
ntp server redacted1 minpoll 4 maxpoll 7 iburst
ntp server redacted2 minpoll 4 maxpoll 7 iburst
ntp server redacted3 minpoll 4 maxpoll 7 iburst
ntp server redacted4 minpoll 4 maxpoll 7 iburst

The other problem, may be related or not:

Sep  5 19:58:32 cx632 log-mgmtd[3245] Event|1231|LOG_INFO|CDTR|1|Syslog client restarted due to configuration change.
Sep  5 19:58:33 cx632 log-proxyd[770] Event|1233|LOG_INFO|CDTR|1|Starting System Logging Service.
Sep  5 19:58:33 cx632 log-proxyd[770] Event|1234|LOG_INFO|CDTR|1|Started System Logging Service.

It happens every few minutes, not a definite/identifiable frequency. What "configuration" is this "configuration change" referring to? Because I'm not making any change to the running-configuration (or startup-configuration) and there is only an idle ssh connection to the switch, which is not doing anything fancy.

Despite the log spam, it seems the time is synchronized and I see no adverse effect due to the "Syslog client restarted due to configuration change"

Thanks in advance