6 Replies Latest reply on Feb 11, 2014 8:26 AM by noobes

    Last Change timestamps


      How are the last change timestamps handled?  Is that in an snmp mib that's polled?  Reason I ask is I have a router that's down.  It has multiple interfaces, one of which is the management interface.  If this interface is down then Orion can't see any interfaces on the device.

      The device went down, per Orion, on 7/7 @ 02:17 AM.  But if you look at the last change field on all the interfaces none match that time.  Now I would expect maybe they all would but the management interface should match the down time...no?  It's last change is list as 6/30 11:54 AM.

      So from an SW/Orion perspective how is this suppose to work?

        • Re: Last Change timestamps

          SW....can someone answer this for me?

            • Re: Last Change timestamps

              Hi Bryan--

              I'll research this and someone will get back to you.


              • Re: Last Change timestamps


                  I also have similar question. For my case, the time was a few months ago but the device was down in just 3 days earlier.


                  • Re: Last Change timestamps


                    Sometimes it can report incorrect time, due to limiations of that OID.

                    Like possible could see an  interface's "Last Change" value have a date from the future.

                    The Last Change field uses two OIDs to attain it's value:

                    -ifLastChange( This static value reflects the value for sysUptime when the interface's Operating Status changed. For example, if the interface's operating status changed 60 seconds after the device was rebooted, the ifLastChange value will be 600 (hundredths of seconds) until the operating status changes again.

                    -SysUptime( This value represents the amount of time in hundredths of seconds that the system has been up.

                    In order to calculate the Last Change value for the interface, ifLastChange is deducted from SysUptime. This gives us the amount of hundredths of a second since the change. We then compare that to the current date and time and we end up with the specific date and time of the change.

                    The limitation of this calculation is that SysUptime rolls over at 4,294,967,296 hundredths of a second. When this occurs, deducting ifLastChange from SysUptime results in a negative number, which then ends up as a futuristic date.

                    The only way around this is to reboot the device, which will reset all counters to 0.

                    Also good link on this here:
                    Re: Interface last state change monitoring accuracy 

                    Thanks, Kev

                      • Re: Last Change timestamps

                        Also I suggest checking those OIDs above using Toolset MIB WALK\MIB Viewer, or even use NPM's UnDP Custom Poller.

                        You can check values and Formula is: 

                        SysUpTime  - IfLastChange = X         
                        Then        DateTimeFunction(X) = Interface Last Change


                        The assumption is that IfLastChange should always be a smaller value than SysUpTime since surely an interface could not be up longer than the box it is on… 

                        But say for example if the SysUpTime value experiences a rollover we now have the scenario where SysUpTime is smaller than the value of IfLastChange.

                        Our equation will now result in a negative value which when converted to a date/time format will give us an erroneous value in the future.

                        So depending on SysUpTime and\or IfLastChange values having counter roller,
                        Then you could experience such issues.



                  • Re: Last Change timestamps

                    Hi Bryan, I am having this problem too, did you ever manage to implement a workaround or find a solution? This seems to me to be a poorly developed OID? Should ifLastChange not always get it's time reference straight from SysUpTime?! Can I ask also how did you manage to display the data on the node details page? That is to say how did you display the results of ifLastChange on node details page. I tried to add a resource to the page for a universal device poller, the only suitable one I could find was universal device poller summary chart but a chart is not the way to display such data. Any help greatly appreciated. Thanks!