Junos OS

Dear All,

Yesterday i had troubleshoot my customer J4350 router, they said cannot access the router. Thru console cable they access using root with blank password...my identification the it seems the router has been load factory by config button or thru cli. But they didn't anything for that. 

After i point to /config forder, didn't show any file or last config file. Thare have current config file only.

How it can be ?? 

At witch log file we can know what happned at that router ??

at the "chassisd" file i got this log 

"

Apr  8 20:46:03 button press 1239223563:157472, release 1239223563:157472
Apr  8 20:46:03 Already committing rescue config, ingnoring button event: quick release
Apr  8 20:46:03 siginfo handler: button event
Apr  8 20:46:03 Button handler
Apr  8 20:46:03 Button events pending 1
Apr  8 20:46:03 button press 1239223563:157472, release 1239223563:157472
Apr  8 20:46:03 Already committing rescue config, ingnoring button event: quick release
Apr  8 20:46:03 siginfo handler: button event
Apr  8 20:46:03 Button handler
Apr  8 20:46:03 Button events pending 1
Apr  8 20:46:03 button press 1239223563:169494, release 1239223563:169494
Apr  8 20:46:03 Already committing rescue config, ingnoring button event: quick release
Apr  8 20:46:03 siginfo handler: button event
Apr  8 20:46:03 Button handler
Apr  8 20:46:03 Button events pending 1
Apr  8 20:46:03 button press 1239223563:169494, release 1239223563:169494
Apr  8 20:46:03 Already committing rescue config, ingnoring button event: quick release
Apr  8 20:46:03 siginfo handler: button event
Apr  8 20:46:03 Button handler
Apr  8 20:46:03 Button events pending 1 Apr  8 20:46:03 button press 1239223563:174610, release 1239223563:174610
Apr  8 20:46:03 Already committing rescue config, ingnoring button event: quick release
Apr  8 20:46:03 siginfo handler: button event
Apr  8 20:46:03 Button handler
Apr  8 20:46:03 Button events pending 1
Apr  8 20:46:03 button press 1239223563:175639, release 1239223563:176670
Apr  8 20:46:03 Already committing rescue config, ingnoring button event: quick release
Apr  9 02:24:15 CHASSISD_SNMP_TRAP7: SNMP trap generated: FRU insertion (jnxFruContentsIndex 9, jnxFruL1Index 1, jnxFruL2Index 1, jnxFruL3Index 0, jnxFruName USB Hub, jnxFruType 6, jnxFruSlot 1)
Apr  9 02:24:15 re_usb_event: Failed to open USB device /dev/usb1
Apr  9 02:24:15 re_usb_event: Failed to open USB device /dev/usb2
Apr  9 02:24:15 re_usb_event: Failed to open USB device /dev/usb3
Apr  9 02:33:13 CHASSISD_SNMP_TRAP7: SNMP trap generated: FRU removal (jnxFruContentsIndex 9, jnxFruL1Index 1, jnxFruL2Index 1, jnxFruL3Index 0, jnxFruName USB Hub, jnxFruType 6, jnxFruSlot 1)
Apr  9 02:33:13 re_usb_event: Failed to open USB device /dev/usb1
Apr  9 02:33:13 re_usb_event: Failed to open USB device /dev/usb2
Apr  9 02:33:13 re_usb_event: Failed to open USB device /dev/usb3
Apr  9 02:33:24 CHASSISD_SNMP_TRAP7: SNMP trap generated: FRU insertion (jnxFruContentsIndex 9, jnxFruL1Index 1, jnxFruL2Index 1, jnxFruL3Index 0, jnxFruName USB Hub, jnxFruType 6, jnxFruSlot 1)
Apr  9 02:33:24 re_usb_event: Failed to open USB device /dev/usb1
Apr  9 02:33:24 re_usb_event: Failed to open USB device /dev/usb2
Apr  9 02:33:24 re_usb_event: Failed to open USB device /dev/usb3
Apr  9 02:48:45 CHASSISD_SNMP_TRAP7: SNMP trap generated: FRU insertion (jnxFruContentsIndex 9, jnxFruL1Index 1, jnxFruL2Index 1, jnxFruL3Index 0, jnxFruName USB Hub, jnxFruType 6, jnxFruSlot 1)
Apr  9 02:48:45 re_usb_event: Failed to open USB device /dev/usb1
Apr  9 02:48:45 re_usb_event: Failed to open USB device /dev/usb2
Apr  9 02:48:45 re_usb_event: Failed to open USB device /dev/usb3
Apr  9 02:49:12 CHASSISD_SNMP_TRAP7: SNMP trap generated: FRU removal (jnxFruContentsIndex 9, jnxFruL1Index 1, jnxFruL2Index 1, jnxFruL3Index 0, jnxFruName USB Hub, jnxFruType 6, jnxFruSlot 1) "

What that's mean ?

Hi ND

It seemsthat someone has pressed the rescue button

You have toknow that the rescue button can be used in two ways:

If youpress it and release immediately you only load the rescue config

If youpress it for about 15 seconds you will have the config led blinking and therouter will erase all saved configurations (even the rollback ones) and returnto factory default.

It seemthat this has happened on you router, I am not sure that someone has pressedthe rescue button such a long time but it seems it has been pressed 6 times.

we can see that also the day after, someone has plugged in a USB card

I think youwould rather control precisely the access to your network room.

I would say it appears that someone may have pressed the config button on the router. Refer to the below link for details of the config button on J-Series.

http://www.juniper.net/techpubs/hardware/junos-jseries/junos-jseries94/junos-jseries-hardware-guide/using-the-reset-config-button.html

Note that the config button is not easy to accidentally press. It is recessed and would require a thin object like a paper clip to press. So although you may believe that no one pressed the button, the log seems to indicate otherwise.

You can also in the future prevent such config button resets.Check the link below for ways to change config button behavior.

http://www.juniper.net/techpubs/hardware/junos-jseries/junos-jseries94/junos-jseries-hardware-guide/changing-the-reset-config-button-behavior.html#jN182AF

-Richard

HI Loup and Richard,

Thanks to prompt reply my message.

I have asked them about reset button, but they didn't did it, and the router location is on their data center.

At old chassis log (chassisd.3.gz) all log display button press also :

Apr  8 20:44:34 button press 1239223474:167033, release 0:0
Apr  8 20:44:34 Already committing rescue config, ingnoring button event: press
Apr  8 20:44:34 siginfo handler: button event
Apr  8 20:44:34 Button handler
Apr  8 20:44:34 Button events pending 1

Apr  8 20:44:34 button press 1239223474:167033, release 0:0
Apr  8 20:44:34 Already committing rescue config, ingnoring button event: press
Apr  8 20:44:34 siginfo handler: button event
Apr  8 20:44:34 Button handler
Apr  8 20:44:34 Button events pending 1

Apr  8 20:44:34 button press 1239223474:169094, release 0:0
Apr  8 20:44:34 Already committing rescue config, ingnoring button event: press
Apr  8 20:44:34 siginfo handler: button event
Apr  8 20:44:34 Button handler
Apr  8 20:44:34 Button events pending 1

Apr  8 20:44:34 button press 1239223474:169094, release 1239223474:170129
Apr  8 20:44:34 Already committing rescue config, ingnoring button event: quick release
Apr  8 20:44:34 siginfo handler: button event
Apr  8 20:44:34 Button handler
Apr  8 20:44:34 Button events pending 1

Apr  8 20:44:34 button press 1239223474:171169, release 0:0
Apr  8 20:44:34 Already committing rescue config, ingnoring button event: press
Apr  8 20:44:34 siginfo handler: button event
Apr  8 20:44:34 Button handler
Apr  8 20:44:34 Button events pending 1

Apr  8 20:44:34 button press 1239223474:171169, release 1239223474:171937
Apr  8 20:44:34 Already committing rescue config, ingnoring button event: quick release
Apr  8 20:44:34 siginfo handler: button event
Apr  8 20:44:34 Button handler
Apr  8 20:44:34 Button events pending 1

......

until last log i posted before. It is show all the time someone pressed the button ?

If we do load factory or press the reset button over 15 second,  is the old config will beremove from /config folder ?

Note : before i restore configuration, red led (alarm led) router is on , but i not get any alarm by show chassis alarm

Hi NDCool

When you press the config button more than 15 seconds the old config are deleted (all the rolback).

The alarm you had was normaly due to the lack of rescue config. You should have seen that using the "show system alarm" commnd instead of "show chassis alarm".

regards

Loup2 

Hi Loup,

Are all the files on the compact flash will be removed at all or at /config folder only ?

Because there i can found user folder (admin) and old copy of config file there (but not current configuration).

thanks

Hi ND

All config files will be erased (last config and the previous ones)

I am talking off rollback config stored in /config folder and in /var/db/config.

Now if YOU had saved some configuration files they are stored in /var/home/<login_name>  folder.

So you can find them where you saved them.

I think they shoudn't be erased when pressing the config button to return to factory (but I am not sure, I should have to test it)

regards

Loup2 

Hi Loup,

Yes, at user folder i can find old files, and on /cf folder also.

So i will tell to my customer that their router has been identified load factory (by reset button) , isn't right ?

Yes thats right

Kind regards

Hi Loup,

Okay, thanks you bro...

HI all,

I just got the update about this issue from my customer. They said after i restored the configuration, the button press and trying to access usb drive logs still came up at their router,  whereas no body press it and nobody at router room.

Running OS version 8.5R2.10

Apr 10 17:16:34 Already committing rescue config, ingnoring button event: press
Apr 10 17:16:34 siginfo handler: button event
Apr 10 17:16:34 Button handler
Apr 10 17:16:34 Button events pending 1

Apr 10 17:16:34 button press 1239358594:670458, release 1239358594:671480
Apr 10 17:16:34 Already committing rescue config, ingnoring button event: quick
release
Apr 10 17:16:34 siginfo handler: button event
Apr 10 17:16:34 Button handler
Apr 10 17:16:34 Button events pending 1

have any suggestion for this ?? now i suggest to them to check phisically the reset button are in normal condition or not..

thanks

Hi NDCool

I believe you've got an hardware failure on this box

We got a customer running the same boxes J4350 and the same software version 8.5R2.10 and I have never seen this kind of problem on their site.

regards