[c-nsp] SNMP ifLastChange > 30 days

[Howard Jones]

On 02/09/2015 18:11, Drew Weaver wrote:
> Hey all,
>
> I've been dealing with an issue in SNMP (6500) where I need to know whether an interface has changed its operational status within the last 30 days.
>
> I came across the oid ifLastChange which tracks against the 32 bit counter sysUptime.0, the problem obviously is that when sysUptime.0 resets ifLastChange becomes pretty much useless.
>
> It seems as though there would be some way to 'math around this' by detecting whether or not the counter has wrapped based on the actual uptime of the device (which can be polled from)  snmpEngineTime.0 but before I go on this adventure I wondered if anyone had already come up with a solution?
>

 From basic logic, if ifLastChange < sysUptime, then the change must 
have been (2^32 - sysUptime + ifLastChange) timeticks ago, or that plus 
some multiple of 2^32 timeticks (496 days). So if you know that 
snmpEngineTime is > sysUpTime, you can figure out a minimum time for 
ifLastChange, at least, and if you know the actual uptime, then you have 
a maximum too. Not that many devices are up for many years without reload...

Howie