Shutting down the interface is making a change to the running config, even if you don't save it to the startup config. Any time you make a change, the switch is going to fire off a syslog message that contains the string "Configured from console" (at least for Cisco IOS) which is the string that the syslog rule is looking for to trigger the RTCD.
↧