Cisco Catalyst 3500XL - 2950, bug with ifLastChange MIB OBJECT?

huynhkhay · ‎02-09-2007

Hi all,

I have few Cisco Catalyst 3500XL (12.0(5.2)XU) and Cisco Catalyst 2950 (12.1(9)EA1) and I want to get for all interfaces the "ifLastChange" object:

"The value of sysUpTime at the time the interface entered

its current operational state. If the current state was

entered prior to the last re-initialization of the local

network management subsystem, then this object contains a

zero value."

However, when i use a MIB Browser, the values I get back seem wrong : for example, for some interfaces, the ifLastChange value is higher than the sysuptime value of the switch!

I was looking for some information on releases of the switches (caveat, bug, etc.), but I found nothing about it.

Has someone already heard about this problem?

Thanks you by advance for your help because, now, I'm quite stuck!

David Stanford · ‎02-09-2007

It is possible for the ifLastChange to be greater than the sysUpTime of a device.

sysUpTime will not match ifLastChange as ifLastChange is looking at an interface and not the up time of the system itself. Also, time ticks for ifLastChange are for the sysuptime when the interface last changed state, not not how many seconds ago the change occurred as seen with sysUpTime.

Also, sysUpTime is a 32-bit counter and this mib object will wrap everyday 496 days. So if you do a show version and the up time is different than that of sysUpTime, then the counter most likely wrapped.

huynhkhay · ‎02-09-2007

Hi,

I don't understand the definition of IfLastChange object you give..

What i thought:

For example:

the sysuptime of a switch indicates 6days(=51840000 hundredths of a second).

The IfLastChange of an interface Eth0/1 indicates:

25920000 and this interface is down

So, I thought that the interface is down for:

51840000-2592000=2592000=3 days.

Am I wrong?

Can you give me examples, so I can understand the good definition of the IfLastObject?

Thanks you bay advance!

David Stanford · ‎02-09-2007

example)

Lets say you have a sysUpTime value of 2 months, 17 days, 4 hrs, 23 mins it is really is 2 months, 17 days 04:23:00.

Then if you look at an ifLastChanged it shows Last Changed is 0:2:10.

That means the condition of this port has not changed since the device SysUpTime was 0

days, 0 hrs, 2 minutes, 10 seconds.

You subtract the Last Changed value (0:02:10) from the current SysUpTime value (2 months,

17 days 04:23:00) to get the exact amount of time the port has been in this state.

This port has been in this operational state for 2 months, 17 days, 4 hrs, 20 minutes and

50 seconds.

(23:00 minutes - 2 minutes 10 seconds = 20 minutes 50 seconds)

huynhkhay · ‎02-09-2007

So, I understood right the definition.

But you said that the Last Changed Value can be higher than The SysUptime of the switch. It's what I don't understand.

Since you said:

"You subtract the Last Changed value (0:02:10) from the current SysUpTime value (2 months,

17 days 04:23:00) to get the exact amount of time the port has been in this state.

"

If the Last changed value was higher than the current sysuptime, you would find a negative value for the amount of time the port has been down or up!

Am I correct?