Breadcrumbs

Rapid/VLAN Spanning Tree Protocol Events

Vendor Documentation

Classification

Rule Name

Rule Type

Common Event

Classification

Rapid/VLAN Spanning Tree Protocol Events

Base Rule

Spanning Tree Info Msg

Information

Mapping with LogRhythm Schema

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

Event ID

<vmid>

Number

Event ID 5001, 5002, 5003, 5004, 5005, 5006, 5007, 5008, 5009, 5010, 5011, 5012, 5013

Severity

<severity>

Text/String

For All: Information
For 5004, 5008, 5009: Warning

Message

<subject>

Text/String

Event ID 5001:
This log event indicates that RPVST has been enabled on the switch.

 

<subject>

Text/String

Event ID 5002:
This log event indicates that RPVST has been disabled on the switch.

 

<subject>
<smac>
<dmac>
<object>

Text/String

Event ID 5003:
This log event indicates that RPVST root on a VLAN has changed

 

<subject>
<sport>
<object>

Text/String/Number

Event ID 5004 (Severity: Warning):
This log event informs the user BPDU received on protected port

 

<subject>
<protname>
<objecttype>
<dport>
<dmac>
<object>

Text/String/Number

Event ID 5005:
This log event informs the user that the Rx is starved in paticular port

 

<subject>
<sport>
<smac>
<object>

Text/String/Number

Event ID 5006:
This log event informs the user that the RPVST topology change is received

 

<subject>
<sport>
<object>

Text/String/Number

Event ID 5007:
This log event informs the user that the RPVST topology change is generated

 

<subject>
<sport>
<object>

Text/String/Number

Event ID 5008 (Severity: Warning):
This log event informs the user that the port is blocked on the instance

 

<subject>
<sport>
<object>

Text/String/Number

Event ID 5009 (Severity: Warning):
This log event informs the user that the port is unblocked on the instance

 

<subject>
<sport>
<dport>
<object>

Text/String/Number

Event ID 5010:
This log event informs the user that the root port is changed

 

<subject>
<dinterface>
<quantity>

Text/String/Number

Event ID 5011:
Log event when the PVID mismatches between the switch and neighbor over an interface

 

<subject>

Text/String

Event ID 5012:
This log event informs the user that the spanning tree mode is changed.

 

<subject>
<quantity>

Text/String/Number

Event ID 5013:
Log event when the current virtual port count crosses the maximum allowed value