If I poll over SNMP for example Cisco IOS interface
ifHCInOctets counter and last reading is lower than previous reading, then I know that either the device has reloaded,
ifHCInOctets counter has wrapped, there was an online hardware insertion/removal(OIR) which affected this particular interface or interface was deleted and recreated(this is possible in case of VLAN interface, Port-Channel interface, etc). Now I would like to distinguish between router reload and all those other possibilities for
ifHCInOctets to start from zero. At first
snmpEngineTime(range 0 - 2147483647 according to Cisco SNMP object navigator) seemed to be a perfect solution as this counter wraps after 68 years, but it also starts from zero if SNMP agent is restarted, i.e. stopped(
no snmp-server) and started(
snmp-server community public RO). This means that one still needs to check
sysUpTime, which as far as I know, starts from zero only in case system is restarted, but unfortunately wraps after every 497 days. This means that simple algorithm seen below would not work if
sysUpTime wraps between the same checks when
ifHCInOctets becomes zero:
if (( prev_ifHCInOctets > cur_ifHCInOctets )); then
if (( prev_sysUpTime > cur_sysUpTime )); then
echo "router reloaded"
echo "counter wrapped, OIR or interface recreated"
It would be perfection itself if there is a "
sysUpHCTime" counter, but looks like there is not. What options do I have? I guess one possibility is simply to ignore this highly unlikely situation where both
cur_ifHCInOctets(current reading of
ifHCInOctets counter) and
cur_sysUpTime(current reading of
sysUpTime counter) are smaller than previous readings because both counters wrapped within the same polling interval. However, just out of interest, what would be the options here? I guess at least one possible option is not to check if
prev_sysUpTime > cur_sysUpTime, but to check if delta between
cur_sysUpTime is roughly equivalent to script check interval? I mean for example let's imagine a situation where
prev_sysUpTime variable was 42949500 and script knows that it got this value 300 seconds ago. Now the
cur_sysUpTime read by script is 128. As a next step script checks if
prev_sysUpTime) is around 300(for example within range 295 - 305) and if it is, then it is 100% sure that
sysUpTime started from zero because of counter wrap and not because device reload. 42949672 used in this formula is the maximum value of SNMP
sysUpTime counter if milliseconds are not included, i.e. maximum value of SNMP
sysUpTime is 2^32, but last two digits represent milliseconds so for example 4294967296 is 42949672 seconds(about 497 days) and 96 milliseconds.
Sorry for the long post and please let me know if anything is unclear.