Customer would like to know why they are seeing root login messages.

Customer is seeing the following messages:

Sep 16 19:30:08 xxxxx mgd[15132]: UI_LOGIN_EVENT: User 'root' login, class 'super-user' localre[15132], ssh-connection '', client-mode 'junoscript'

Sep 16 19:30:10 xxxxx mgd[15169]: UI_LOGIN_EVENT: User 'root' login, class 'super-user' localre[15169], ssh-connection '', client-mode 'junoscript'

Sep 16 19:30:19 xxxxx mgd[15222]: UI_LOGIN_EVENT: User 'root' login, class 'super-user' localre[15222], ssh-connection '', client-mode 'junoscript'

Sep 16 19:30:29 xxxxx mgd[15243]: UI_LOGIN_EVENT: User 'root' login, class 'super-user' localre[15243], ssh-connection '', client-mode 'junoscript'

From the logs:

Sep 16 19:30:08 xxxxx mgd[15132]: UI_LOGIN_EVENT: User 'root' login, class 'super-user' localre[15132], ssh-connection '', client-mode 'junoscript'

This indicates:

• User 'root' logged in.
• Class 'super-user' confirms full administrative privileges.
• localre[15132] suggests the login occurred on the local Routing Engine (RE).
• ssh-connection '' shows no remote IP was associated.
• client-mode 'junoscript' implies the login was likely initiated by an automated script or internal process, not a human via CLI.

Why Is Root Being Invoked?

> If Apstra is managing the switch. It may use scripts to interact with the device and could trigger these root logins.

> If you use JWEB, the JWeb client uses JUNOScript to log the username/password that was entered at the JWeb prompt. The username and password are authenticated thereafter.