This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Last Change timestamps

BryanBecker over 13 years ago

How are the last change timestamps handled? Is that in an snmp mib that's polled? Reason I ask is I have a router that's down. It has multiple interfaces, one of which is the management interface. If this interface is down then Orion can't see any interfaces on the device.

The device went down, per Orion, on 7/7 @ 02:17 AM. But if you look at the last change field on all the interfaces none match that time. Now I would expect maybe they all would but the management interface should match the down time...no? It's last change is list as 6/30 11:54 AM.

So from an SW/Orion perspective how is this suppose to work?

0 BryanBecker over 13 years ago

SW....can someone answer this for me?
Cancel
Vote Up 0 Vote Down

Cancel
0 MarieB over 13 years ago in reply to BryanBecker

Hi Bryan--
I'll research this and someone will get back to you.
M
Cancel
Vote Up 0 Vote Down

Cancel
0 kurochan over 12 years ago in reply to BryanBecker

Hi,
I also have similar question. For my case, the time was a few months ago but the device was down in just 3 days earlier.
Thanks
Cancel
Vote Up 0 Vote Down

Cancel
0 kevin2me over 12 years ago in reply to kurochan

Hello,

Sometimes it can report incorrect time, due to limiations of that OID.
Like possible could see an interface's "Last Change" value have a date from the future.

The Last Change field uses two OIDs to attain it's value:

-ifLastChange(1.3.6.1.2.1.2.2.1.9): This static value reflects the value for sysUptime when the interface's Operating Status changed. For example, if the interface's operating status changed 60 seconds after the device was rebooted, the ifLastChange value will be 600 (hundredths of seconds) until the operating status changes again.

-SysUptime(1.3.6.1.2.1.1.3): This value represents the amount of time in hundredths of seconds that the system has been up.

In order to calculate the Last Change value for the interface, ifLastChange is deducted from SysUptime. This gives us the amount of hundredths of a second since the change. We then compare that to the current date and time and we end up with the specific date and time of the change.

The limitation of this calculation is that SysUptime rolls over at 4,294,967,296 hundredths of a second. When this occurs, deducting ifLastChange from SysUptime results in a negative number, which then ends up as a futuristic date.

The only way around this is to reboot the device, which will reset all counters to 0.
Also good link on this here:

Thanks, Kev
Cancel
Vote Up 0 Vote Down

Cancel
0 kevin2me over 12 years ago in reply to kevin2me

Also I suggest checking those OIDs above using Toolset MIB WALK\MIB Viewer, or even use NPM's UnDP Custom Poller.

You can check values and Formula is:
SysUpTime - IfLastChange = X
Then DateTimeFunction(X) = Interface Last Change

The assumption is that IfLastChange should always be a smaller value than SysUpTime since surely an interface could not be up longer than the box it is on…
But say for example if the SysUpTime value experiences a rollover we now have the scenario where SysUpTime is smaller than the value of IfLastChange.

Our equation will now result in a negative value which when converted to a date/time format will give us an erroneous value in the future.
So depending on SysUpTime and\or IfLastChange values having counter roller,
Then you could experience such issues.

Kev
Cancel
Vote Up 0 Vote Down

Cancel
0 noobes over 10 years ago

Hi Bryan, I am having this problem too, did you ever manage to implement a workaround or find a solution? This seems to me to be a poorly developed OID? Should ifLastChange not always get it's time reference straight from SysUpTime?! Can I ask also how did you manage to display the data on the node details page? That is to say how did you display the results of ifLastChange on node details page. I tried to add a resource to the page for a universal device poller, the only suitable one I could find was universal device poller summary chart but a chart is not the way to display such data. Any help greatly appreciated. Thanks!
BryanBecker
Cancel
Vote Up 0 Vote Down

Cancel