How can I locate the source of a spanning tree TCN?

[jkoelker@orcsd.org]

We have S2500 MASs at our network edge. These switches connect IAPs, user wired computers, cameras, IP phones and some HVAC panels. Every so often I get notifications from Airwave that a topology change has occurred in one or another of our switch stacks. I don't know how to interpret these messages because, as far as I'm aware, no topology change has taken place. The way I understand it, there would have to be a physical or administrative breaking of a link to trigger a TCN. Is that correct? If so, I don't know why I'd be seeing these notifications when there's been no change that I can identify.

Switches are running firmware version 7.4.1.8; Airwave is version 8.2.7. Also, I see no such TCNs from our other network monitoring products (Solar Winds NPM and PRTG). Any help is appreciated.

[AFK]

Do you have PortFast, BPDU Guard and BPDU Filter configured on all edge ports on these switches?

[jkoelker@orcsd.org]

We do have those configured on user ports; however, the port that keeps flushing the MAC table because of an alleged topology change is a point-to-point link between a switch in the wiring closet and a stand-alone switch in another room. The ports on that link do not have portfast, BPDUGuard and BPDU filtering enabled.

[AFK]

Do you see any STP messages in the log on the other switch? Do the two switches have the same STP setup?