• We see the below interactive logs on the switch continuously

Jun 1 00:00:00.729 Switch1 mgd[36810]: UI_LOGIN_EVENT: User 'root' login, class 'super-user' [36810], ssh-connection '10.251.xx.xx 64849 10.179.xx.xx 22', client-mode 'cli'

Jun 1 00:00:00.739 Switch1 mgd[36810]: UI_CMDLINE_READ_LINE: User 'root', command 'show ethernet-switching vxlan-tunnel-end-point esi | match " 0 esi" '

• But when we run the command " show system users" , the user is currently not active .

interactive Logs messages are seen

Jun 1 00:00:00.729 Switch1 mgd[36810]: UI_LOGIN_EVENT: User 'root' login, class 'super-user' [36810], ssh-connection '10.251.xx.xx 64849 10.179.xx.xx 22', client-mode 'cli'

Jun 1 00:00:00.739 Switch1 mgd[36810]: UI_CMDLINE_READ_LINE: User 'root', command 'show ethernet-switching vxlan-tunnel-end-point esi | match " 0 esi" '

ISSUE:

• We see the logs on the switch continuously
• The user "root"  is currently not active .

EXPLANATION:

• A script is configured on the switch which has to run on the switch continuously .
• The script was run with user “root” and it has root-level access and that explains the class “ super user” in the logs.
• So until the script is actively running, you would be seeing this logs.

This is an expected behaviour

version 1