Skip to main content
Skip table of contents

Rapid/VLAN Spanning Tree Protocol Events

Vendor Documentation

Classification

Rule Name

Rule Type

Common Event

Classification

Rapid/VLAN Spanning Tree Protocol Events

Base Rule

Spanning Tree Info Msg

Information

Mapping with LogRhythm Schema

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

Event ID

<vmid>

Number

Event ID 5001, 5002, 5003, 5004, 5005, 5006, 5007, 5008, 5009, 5010, 5011, 5012, 5013

Severity

<severity>

Text/String

For All: Information
For 5004, 5008, 5009: Warning

Message

<subject>

Text/String

Event ID 5001:
This log event indicates that RPVST has been enabled on the switch.

 

<subject>

Text/String

Event ID 5002:
This log event indicates that RPVST has been disabled on the switch.

 

<subject>
<smac>
<dmac>
<object>

Text/String

Event ID 5003:
This log event indicates that RPVST root on a VLAN has changed

 

<subject>
<sport>
<object>

Text/String/Number

Event ID 5004 (Severity: Warning):
This log event informs the user BPDU received on protected port

 

<subject>
<protname>
<objecttype>
<dport>
<dmac>
<object>

Text/String/Number

Event ID 5005:
This log event informs the user that the Rx is starved in paticular port

 

<subject>
<sport>
<smac>
<object>

Text/String/Number

Event ID 5006:
This log event informs the user that the RPVST topology change is received

 

<subject>
<sport>
<object>

Text/String/Number

Event ID 5007:
This log event informs the user that the RPVST topology change is generated

 

<subject>
<sport>
<object>

Text/String/Number

Event ID 5008 (Severity: Warning):
This log event informs the user that the port is blocked on the instance

 

<subject>
<sport>
<object>

Text/String/Number

Event ID 5009 (Severity: Warning):
This log event informs the user that the port is unblocked on the instance

 

<subject>
<sport>
<dport>
<object>

Text/String/Number

Event ID 5010:
This log event informs the user that the root port is changed

 

<subject>
<dinterface>
<quantity>

Text/String/Number

Event ID 5011:
Log event when the PVID mismatches between the switch and neighbor over an interface

 

<subject>

Text/String

Event ID 5012:
This log event informs the user that the spanning tree mode is changed.

 

<subject>
<quantity>

Text/String/Number

Event ID 5013:
Log event when the current virtual port count crosses the maximum allowed value

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.