I have a weird situation At one

[Almin]

I have a weird situation

At one of our remote offices I was told to check out the network for slowness and this is what I saw on the switch stack

*Mar  6 01:03:59.793: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/13, changed state to down
*Mar  6 01:04:01.807: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/13, changed state to up
*Mar  6 01:04:04.260: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/13, changed state to down
*Mar  6 01:04:05.262: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/13, changed state to down
*Mar  6 01:06:48.855: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/47, changed state to down
*Mar  6 01:06:49.878: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/47, changed state to down
*Mar  6 01:19:23.101: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet3/0/10, changed state to down
*Mar  6 01:19:24.108: %LINK-3-UPDOWN: Interface GigabitEthernet3/0/10, changed state to down
*Mar  6 01:45:33.632: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/32, changed state to down
*Mar  6 01:45:35.640: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/32, changed state to up
*Mar  6 01:45:51.337: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/32, changed state to down
*Mar  6 01:45:52.344: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/32, changed state to down
*Mar  6 02:32:30.616: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/19, changed state to down
*Mar  6 02:32:31.643: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/19, changed state to down
*Mar  6 02:32:34.197: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/19, changed state to up
*Mar  6 02:32:35.203: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/19, changed state to up

our current setup is a router on a stick connecting to this switch stack

I have not seen anything abnormal on the router. Here is the router configuratiuon that connects to the switch

interface GigabitEthernet0/0.1
 encapsulation dot1Q 1 native
 ip address 10.20.1.1 255.255.255.0
 no ip redirects
 no ip proxy-arp
 ip verify unicast reverse-path
 ip pim sparse-mode
 ip flow ingress
 ip flow egress
 ip nat inside
 ip virtual-reassembly
 ip policy route-map map-ge0-0
 no keepalive
 service-policy input MARK-INBOUND-LAN
end

Here is the configuration of the prob;lem ports on the 2960 switchstack

VSS_14#sh run int gigabitEthernet 4/0/7
Building configuration...

Current configuration : 87 bytes
!
interface GigabitEthernet4/0/7
 switchport voice vlan 2
 spanning-tree portfast
end

VSS_14#sh run int gigabitEthernet 1/0/13
Building configuration...

Current configuration : 88 bytes
!
interface GigabitEthernet1/0/13
 switchport voice vlan 2
 spanning-tree portfast
end

VSS_14#sh run int gigabitEthernet 1/0/47
Building configuration...

Current configuration : 88 bytes
!
interface GigabitEthernet1/0/47
 switchport voice vlan 2
 spanning-tree portfast
end

VSS_14#sh run int gigabitEthernet 3/0/10
Building configuration...

Current configuration : 88 bytes
!
interface GigabitEthernet3/0/10
 switchport voice vlan 2
 spanning-tree portfast
end

VSS_14#sh run int gigabitEthernet 1/0/32
Building configuration...

Current configuration : 88 bytes
!
interface GigabitEthernet1/0/32
 switchport voice vlan 2
 spanning-tree portfast
end

VSS_14#sh run int gigabitEthernet 1/0/19
Building configuration...

Current configuration : 88 bytes
!
interface GigabitEthernet1/0/19
 switchport voice vlan 2
 spanning-tree portfast
end

VSS_14#

This is a very simple setu all vlans are in vlan1 by default, and vlan 1 is configured for the switchstack

this is a 4 switch stack. Since I dont have a technical user at that location what could be causing those ports to go up and down. I had some more ports that went down but never came up and I am assuming that on those ports that went down and never went up the user took their notebook home, but what about the interfaces that go down and come right up. This has been happening all day.

Any suggestions
Thanks

 

[VinceWhirlwind]

Looks normal to me.
The single line represents somebody packing up for the day, while the triple lines represents somebody just getting started.

Why don't you identify one of these hosts, figure out its User, then ring them up and ask them what they were doing at the time the log lines were generated?

 

[TrishPel]

It looks fine to me too. If you know for a fact that a switchport is directly connected to a user's PC, you can add the no logging event link-state to that port so the normal ups and downs of users won't fill your logs.