SW....can someone answer this for me?
I'll research this and someone will get back to you.
I also have similar question. For my case, the time was a few months ago but the device was down in just 3 days earlier.
Sometimes it can report incorrect time, due to limiations of that OID.
Like possible could see an interface's "Last Change" value have a date from the future.
The Last Change field uses two OIDs to attain it's value:
-ifLastChange(184.108.40.206.220.127.116.11.1.9): This static value reflects the value for sysUptime when the interface's Operating Status changed. For example, if the interface's operating status changed 60 seconds after the device was rebooted, the ifLastChange value will be 600 (hundredths of seconds) until the operating status changes again.
-SysUptime(18.104.22.168.22.214.171.124): This value represents the amount of time in hundredths of seconds that the system has been up.
In order to calculate the Last Change value for the interface, ifLastChange is deducted from SysUptime. This gives us the amount of hundredths of a second since the change. We then compare that to the current date and time and we end up with the specific date and time of the change.
The limitation of this calculation is that SysUptime rolls over at 4,294,967,296 hundredths of a second. When this occurs, deducting ifLastChange from SysUptime results in a negative number, which then ends up as a futuristic date.
The only way around this is to reboot the device, which will reset all counters to 0.
Also good link on this here:
Re: Interface last state change monitoring accuracy
Also I suggest checking those OIDs above using Toolset MIB WALK\MIB Viewer, or even use NPM's UnDP Custom Poller.
You can check values and Formula is:
SysUpTime - IfLastChange = X
Then DateTimeFunction(X) = Interface Last Change
The assumption is that IfLastChange should always be a smaller value than SysUpTime since surely an interface could not be up longer than the box it is on…
But say for example if the SysUpTime value experiences a rollover we now have the scenario where SysUpTime is smaller than the value of IfLastChange.
Our equation will now result in a negative value which when converted to a date/time format will give us an erroneous value in the future.
So depending on SysUpTime and\or IfLastChange values having counter roller,
Then you could experience such issues.
Hi Bryan, I am having this problem too, did you ever manage to implement a workaround or find a solution? This seems to me to be a poorly developed OID? Should ifLastChange not always get it's time reference straight from SysUpTime?! Can I ask also how did you manage to display the data on the node details page? That is to say how did you display the results of ifLastChange on node details page. I tried to add a resource to the page for a universal device poller, the only suitable one I could find was universal device poller summary chart but a chart is not the way to display such data. Any help greatly appreciated. Thanks!