SNMP sysUpTime ticks synced with NTP?

[Karol Sebesta]

Hello,

I'm trying to find how reliable and exact the sysUpTime counter is.

SNMP sysUpTime (1.3.6.1.2.1.1.3) counter (ticks) is based on HW clocks (system calendar) time.

Basically, when a Cisco device boots up, the software clock inquires and sets the current time based on the information it receives from the system calendar. Hence, if the system calendar is not accurate, then it would receive the incorrect time from it, which may contribute to a lot of confusion. However, if the device is configure as an NTP client, it would override the system calendar. So, it means that HW clocks are synced when NTP on cisco devices is set.

My questions is:

The hardware clock will be synced with ntp, but if the system clock is set back 1 second to fix the time on the box, is the sysUpTime set back as well?
And if the system time is set way into the future and the time is set back a year for example, is the sysUpTime set to correct value as well?

Thank you for help.

Regards,
Karol Sebesta

[ghostinthenet]

sysUpTime is based on the time since power-on, regardless of the system calendar. If the date of the system is set forward or backwards either manually or via NTP, this still doesn't change the amount of time that has elapsed.

This can be quickly tested by querying the OID, manually setting the time on the device to a few hours in the future (11:45pm, in this example) and then checking the OID again:

snmpwalk -c public -v 2c 172.23.0.1 1.3.6.1.2.1.1.3
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (156472595) 18 days, 2:38:45.95

router#clock set 23:45:00 16 July 2014
router#show clock
.23:45:02.184 EDT Wed Jul 16 2014

snmpwalk -c public -v 2c 172.23.0.1 1.3.6.1.2.1.1.3
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (156480796) 18 days, 2:40:07.96

As you can see, the OID only displays a small increase, marking the time it took me to login and set the clock.

Waiting a few minutes for NTP to re-sync and testing again, I get the following:

router#show clock
17:57:22.627 EDT Wed Jul 16 2014

snmpwalk -c public -v 2c 172.23.0.1 1.3.6.1.2.1.1.3
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (156504390) 18 days, 2:44:03.90

Still, the OID only reflects a few minutes' difference corresponding with the time I waited for NTP to synchronize.

[Karol Sebesta]

And what about realiability of sysUpTime itself? Is the accuracy of sysuptime linked to the reliability of NTP (if used) or to the internal hardware clock?

Thanks.

[ghostinthenet]

sysUpTime is completely unaffected by NTP, so it's accuracy is based solely on the internal clock. NTP affects only the system calendar, which is not the same as the clock.

[Vinod Arya]

sysUptime show the time (in hundredths of a second) since the network management portion of the system was last re-initialized.

sysUptime is not based on the clock, but it is a counter since when your device was last turned on.

-Thanks

Vinod

[Karol Sebesta]

Well, so it is based on internal clock or not? :)

And regarding system calendar and clock relation:

http://ccnablog.org/uncategorized/setting-time-clock-on-a-cisco-routerswitch/

------------------

Hardware Clock

Many Cisco devices, such as routers and switches have hardware clocks, known as system calendar, built-in on the circuit board and are backed up by lithium batteries in case of power loss. These lithium batteries are similar to the ones used in watches and hearing aids. Once set, the hardware clock (system calendar) continues to keep accurate time even when the device is shutdown or loses power for an extended period of time. This is the reason it is important to update the system calendar – as shown in Step 6: above – with the current time at the end of configuring the software clock.

When a Cisco device boots up, the software clock inquires and sets the current time based on the information it receives from the system calendar. Hence, if the system calendar is not accurate, then it would receive the incorrect time from it, which may contribute to a lot of confusion. However, if the device is configure as an NTP client, it would override the system calendar.

----------------------

From this info I was assuming that HW clock and system calendar is the same.

Karol

[Vinod Arya]

Yes you can say it is a internal hardware clock. Every Hardware guide for each cisco platform has following information under Overview (I picked it from 2800 Series Hardware here):

"An internal real-time clock with battery backup provides the system software with time of day on system power up. This allows the system to verify the validity of the certification authority (CA) certificate. In the Cisco 2811, Cisco 2821, and Cisco 2851 routers, the clock and battery are permanently installed; the battery lasts the life of the router under the operating environmental conditions specified for the router. The Cisco 2801 router has a socketed lithium battery. This battery lasts the life of the router under the operating environmental conditions specified for the router, and is not field-replaceable."

This Hardware Clock assists with system Uptime.

-Thanks

Vinod

[ghostinthenet]

Sorry about that. I should have been more specific.

When I was referring to the internal clock, I was referring to the software clock and not the calendar. The optional hardware clock (not present on all devices) and the calendar, as you have already pointed out, are the same.

The hardware clock is used to set the system date and time at boot time and is not generally referenced by the system afterwards. Once the system has started, the software clock takes over managing the system time. Devices that do not have a hardware clock (like Catalyst 2950 switches) will always boot with a default date and time reference and need NTP/SNTP to be configured to correct this.

NTP can be used to keep the date and time synchronized and can even be used to update the hardware clock, when present, but this does not change the software clock itself. It only changes the date and time reference.

If the software clock says a million ticks have gone by since power-on and its reference time is 12:05am, then it will show 12:05am when a "show clock" command is issued. If NTP adjusts the reference to 12:01am, the software clock does not reduce the number of ticks since power-on. It just changes the reference to account for the NTP adjustment. One million ticks since power-on used to mean 12:05am and now it means 12:01am. sysUpTime is based entirely on the number of ticks since power-on and is not affected by the calendar data in the hardware clock nor by NTP adjustments.

This can be tested by running sysUpTime query on a device that has neither a hardware clock nor an NTP configuration. The device will still return an accurate uptime.