Forwarded to the list:
Mark, I don't have nanog post so, if you could pass this along for me, I
believe that it may be "obvious" advice and it seems that the obvious is
what escapes us most often.
Yeah, (c) seems most likely to me. Ratul, a script like
this or some variant could cause what you are seeing:config-router# no neighbor <a>
config-router# no neighbor <b>
config-router# no neighbor <c>
(script to rewrite filters executes)
config-router# neighbor <a> remote-as <x>
config-router# neighbor <b> remote-as <y>
config-router# neighbor <c> remote-as <z>
(sessions start coming up)
config-router# neighbor <a> route-map <A> out
config-router# neighbor <b> route-map <B> out
config-router# neighbor <c> route-map <C> out
config-router# Ctrl-Z
# clear ip bgp external soft outJust guessing - you're seeing these events between midnight
and 5 am?
Wouldn't it be wiser to do the following:
config-router# no neighbor <a>
config-router# no neighbor <b>
config-router# no neighbor <b>
(script to rewrite filters executes)
config-router# neighbor <a> remote-as <x>
config-router# neighbor <a> shutdown
config-router# neighbor <b> remote-as <y>
config-router# neighbor <b> shutdown
config-router# neighbor <c> remote-as <z>
config-router# neighbor <c> shutdown
config-router# neighbor <a> route-map <A> out
config-router# neighbor <b> route-map <B> out
config-router# neighbor <c> route-map <C> out
config-router# no neighbor <a> shutdown
config-router# no neighbor <b> shutdown
config-router# no neighbor <c> shutdown
config-router# Ctrl-Z
# clear ip bgp external soft out
This way, the neighbor has much less time to come up without filters since
we're immediately putting it in admin idle after naming it.