04-14-2006 08:41 AM
How could I use SNMP to walk certain parts of the MIB on a switch to find ports that have been unused for a length of time?
Solved! Go to Solution.
04-14-2006 12:38 PM
The calculation will always be the same.
It will be sysUptime - ifLastChange
That will in effect tell you how long it's been since the ifOperStatus changed.
04-14-2006 08:52 AM
First, you would need to find ifOperStatus (this would tell you if the interface is up or down).
Second, you would need to find ifLastChange (this would tell you the value of sysUpTime when interface went down).
Now, you would need to find sysUpTime (this would tell you how long the device has been up for).
Note: sysUpTime is in timeticks (in hundredths of a second).
04-14-2006 09:31 AM
Walking sysUptime and understanding it is easy; it's simply the uptime of the device -
system.sysUpTime.0 = Timeticks: (3124188865) 361 days, 14:18:08.65
Walking ifOperStatus and understanding it is easy as well; it's simply an up or a down for that interface. This is the output from 1 interface:
interfaces.ifTable.ifEntry.ifOperStatus.1 = up(1)
Walking ifLastChange and understanding it is a bit more difficult. This is the output from 1 interface:
interfaces.ifTable.ifEntry.ifLastChange.1 = Timeticks: (4322) 0:00:43.22
The part I don't understand is how to interpret the results.
Can you shed some more light on how to interpret the results?
04-14-2006 10:04 AM
Looks like this interface has been up for a long time.
ifLastChange.1 is returning 4322, so the interface has been up since the router's up time was 43 seconds.
In other words, it looks like the interface has been up for more than 361 days (sysUpTime - ifLastChange).
04-14-2006 09:41 AM
Does the User Tracking unused ports report (http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/cw2000/camp_mgr/camp_4x/cmgr_403/u_guide/ut.htm#wp1280599) not meet your needs?
Hope this helps. Please rate helpful posts.
04-14-2006 09:57 AM
This looks nice but our Campus Servers are at 3.3.
I'm trying to find a way to do this from a command line so I can fulfill the current request.
04-14-2006 10:47 AM
IIRC, 3.3 supports the Data Extraction Engine (DEE). Extract the User Tracking data via that mechanism (I believe it's all there in 3.3, just packaged in a report under 4.0), parse it out and pipe the output to a results file after some expression matching and sorting. It can all be scripted in a command shell or via some VB code that you can execute from command line as a shell script (Unix) or compiled executable (Windows).
The DEE schema is documented in the 4.0 user guide. See specifically: http://www.cisco.com/en/US/products/sw/cscowork/ps563/products_user_guide_chapter09186a00802297ac.html#wp1034795
04-14-2006 11:57 AM
I have the DEE installed and will take a look at it. However, I would still like to know how to do this from the command line using the snmpwalk command. The results shown in Campus are only as good as the last discovery.
04-14-2006 12:07 PM
Not sure if you saw my earlier reply to your snmp walks:
Looks like this interface has been up for a long time.
ifLastChange.1 is returning 4322, so the interface has been up since the router's up time was 43 seconds.
In other words, it looks like the interface has been up for more than 361 days (sysUpTime - ifLastChange).
04-14-2006 12:32 PM
Actually, I did overlook your previous response.
Can you repeat how you calculated this using that interface?
04-14-2006 12:38 PM
The calculation will always be the same.
It will be sysUptime - ifLastChange
That will in effect tell you how long it's been since the ifOperStatus changed.
04-15-2006 05:06 AM
Walk the sysUptime of a switch, the ifOperStatus to find a port that is down then subtract the sysUptime timeticks from the ifLastChange timeticks of an interface that is down then divide that value by 8640000 to get the number of days a port has been down.
04-15-2006 09:38 AM
Now all I need is a script that reads a list of devices from a file, determines how many ports are on the switch then performs the calculations......
04-16-2006 04:50 AM
RESULT1= snmpwalk
RESULTS2= snmpwalk
RESULTS3= snmpwalk
DOWNTIME of a port= ( RESULT1 - RESULTS3 ) / 8640000
I find it hard to believe no one has scripted this...
04-17-2006 06:40 AM
SNMP cannot distinguish between NOTCONNECT and ACTIVE ports, can it?
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide