the most likely cause would be one of:
<items deleted for brevity>
(c) script used to configure router(s) adds a 'network'
statement prior to trimming route-filters
Yeah, (c) seems most likely to me. Ratul, a script like
this or some variant could cause what you are seeing:
config-router# no neighbor <a>
config-router# no neighbor <b>
config-router# no neighbor <c>
(script to rewrite filters executes)
config-router# neighbor <a> remote-as <x>
config-router# neighbor <a> remote-as <y>
config-router# neighbor <a> remote-as <z>
(sessions start coming up)
config-router# neighbor <a> route-map <A> out
config-router# neighbor <b> route-map <B> out
config-router# neighbor <c> route-map <C> out
config-router# Ctrl-Z
# clear ip bgp external soft out
Just guessing - you're seeing these events between midnight
and 5 am?