Solved: Strange SNMP values

chrisayres · ‎01-29-2010

Hi,

I have been having a problem with our SNMP Manager (CA Spectrum)

The problem is that Spectrum is reporting "Excessive Interface Reconfiguration" alarms on a lot for our switches and routers (various types and IOS levels)

when in reality nothing is happening to the devices

This alarm is based on the following MIBs ifStackLastChange and ifTableLastChange

When first looking at these values they are not changing but when I look at the raw values they are changing a little but not enough to affect how a MIB browser displays the duration since last change, see example below

Date/Time                            Name                         Type      sysuptime                                                            IftablelastChange                                            IftablelastChange raw
29-Jan-2010 12:05:00 GMT PORCSC_CC451_02 Cat4510 330 days, 12 hours, 35 minutes, 36 seconds       252 days, 8 hours, 49 minutes, 12 seconds      2180455221
29-Jan-2010 13:14:57 GMT PORCSC_CC451_02 Cat4510 330 days, 13 hours, 8 minutes, 48 seconds         252 days, 8 hours, 49 minutes, 12 seconds      2180455217

I believe that the ifTableLastChange MIB should show the sysuptime at the time that the Iftable last changed so if there had been a change in the Iftable between 12:05 and 13:14 I would have expected the value of fTableLastChange to have changed to 330days 13hours etc

Also the value of fTableLastChange is 4 less at 13:14 than it was at 12:05

Anyone got any idea what is happening

Rgds

Joe Clarke · ‎01-29-2010

Sounds like CSCsh93041, but you did not include a show ver so I cannot say for certain.

View solution in original post

Joe Clarke · ‎01-29-2010

Sounds like CSCsh93041, but you did not include a show ver so I cannot say for certain.

chrisayres · ‎02-01-2010

Hi Joe,

Thanks looks like I am hitting this bug

Many Thanks

Chris Ayres

thorsten.steffen · ‎02-23-2010

Hi all,

we also experience the mentioned problems with ca spectrum.

I assume Joe refers to OID 1.3.6.1.2.1.31.1.5 (ifTableLastChange) which is wrongly changed by the cisco switches and which triggers an interface reconfiguration in spectrum.

BugID CSCsh93041 refers to OID 1.3.6.1.2.1.2.2.1.9.49 (ifLastChange) which seems to be slight different from the one mentioned above.

While ifLastChange changes every time an interface changes it's operational state (e.g. connected, not connected, admin down), ifTableLastChange should only change when an interface is created or deleted from the ifTable (e.g. inserting or removing a linecard).

Does anybody else know about this strange behaviour of ifTableLastChange?

We experience this errors on several switches like

Cat45xx 12.2(50)SG

Cat4948 12.2(50)SG

Cat3550 12.2(44)SE3

3745 12.3(14)T7

This topic is also discussed in spectrum user group

Best Regards,

Thorsten

Joe Clarke · ‎02-23-2010

The bug as it is written is misleading. This bug DOES account for the change in ifTableLastChange, ifLastChange, and ifStackLastChange. The bug which details the problems with ifTableLastChange and ifStackLastChange is CSCsx26467 which was duped to CSCsh93041. This bug is fixed in 12.2(52)SG for the Cat4K. I'm not seeing any report of a fix for the 3550 or for mainline IOS. It is not clear those platforms are actually affected.