[c-nsp] SNMP ifLastChange > 30 days

[Peter Rathlev]

On Wed, 2015-09-02 at 17:11 +0000, Drew Weaver wrote:
> I came across the oid ifLastChange which tracks against the 32 bit
> counter sysUptime.0, the problem obviously is that when sysUptime.0
> resets ifLastChange becomes pretty much useless.
> 
> It seems as though there would be some way to 'math around this' by
> detecting whether or not the counter has wrapped based on the actual
> uptime of the device (which can be polled from)  snmpEngineTime.0 but
> before I go on this adventure I wondered if anyone had already come up
> with a solution?

AFAIK the only solution is what you propose: Adjust for wrapping knowing
that ifLastChange cannot be in the future and must thus always be a
smaller value than sysUpTime.0.

We use someting like this snippet in our web-based switch configuration
tool:

  $sysUpTime = $switch->snmpget("SNMPv2-MIB::sysUpTime", 0);
  $ifLastChange = $switch->snmpbulkwalk('IF-MIB::ifLastChange');
  my $secondsSinceStateChange = {};
  foreach (keys %{$ifLastChange}) {
          $secondsSinceStateChange->{$_} = $sysUpTime - snmp_time_to_seconds($ifLastChange->{$_});
          # SNMP timeticks might have wrapped at 2^32 jiffies
          while ($secondsSinceStateChange->{$_} < 0) {
                  $secondsSinceStateChange->{$_} += int(2**32 / 100);
          }
  }

It will of course not necessarily give you the correct ifLastChange
value, but for most cases it will be correct for finding interfaces that
haven't changed for 30 days. And where it errs it will always give you a
minimum time since last change, so if it says > 30 days then the
interface will have had no status change for at least 30 days.

-- 
Peter