Sysuptime network monitor

Monitor your Linux Servers with deep insights, further than can be obtained through SNMP alone. A word on SNMP versions A short digression on the different versions of the protocol is necessary to configure SNMP on Linux. The original version of the SNMP protocol was v1, developed through the 1980s. It was later superseded by v2 that mainly offered an increased security and authentication mechanisms. v2 has two flavors, v2c and v2u. v2c offers a community-based security model, while v2u operates on a user-based model (as specified in RFC1910).SNMP v2u never really took off, but part of its features were used to develop v3. v2c is much more common and what we actually refer to when using “v2” throughout this article.v3 is the latest version of the SNMP protocol, whose main difference is the added encryption support, with its pros and cons. What is snmpd? snmpd on Linux is the daemon part of net-snmp. When installed, it creates an SNMP host that can accept requests from another host and respond to them, issue notifications (TRAPs and INFORMs in SNMP parlance), and perform some self-monitoring tasks. The SNMP protocol allows for basic configuration of hosts and snmpd is needed to exploit these capabilities. What are the tools for SNMP monitoring on Linux? With snmpd being the daemon, the bulk of operations through SNMP are done with a series of tools in the snmp (Ubuntu/Debian) or net-snmp-utils package (Red Hat). These are the core of the SNMP implementation and what an administrator would routinely use to monitor a network with.Let’s have a look at how they work and what they are for. snmptranslate snmptranslate performs a translation of OID into the corresponding MIB name: # snmptranslate .1.3.6.1.2.1.1.3.0 SNMPv2-MIB::sysUpTime.0Or the opposite, from a MIB to have the numeric OID: # snmptranslate **-On** SNMPv2-MIB::sysUpTime.0

SNMP sysUpTime（OID 1.3.6.1.2.1.1.3.0） 时间戳信息解析遇到的问题 提示：sysUpTime： SNMP OID 1.3.6.1.2.1.1.3.0 计算出来的启动时间，与设备显示的不一致 SNMP V2C Trap 时间戳详细解析 最近计划通过SNMP Trap 获取设备的事件信息，发现Trap时候，设备会发生 OID = 1.3.6.1.2.1.1.3.0 的字段信息。 查资料，发现该OID表示MIB中的sysUpTime。 网络上查询该OID的定义解析： RFC1213 defines sysUpTime as a 32-bit counter in 1/100 second. From the RFC’s definition of sysUpTime: “The time (in hundredths of a second) since the network management portion of the system was last re-initialized.” 即是：该字段的值是32-bit 的计数器， 每1个单位，表示1秒的百分之一，即是0.01秒。 该计数器的值，是从设备启动后开始计数。 但是通过Trap收到的华为S9xxx设备发来的 sysUpTime ，与设备时间开机时间无法对上。 抓取到的 OID = 1.3.6.1.2.1.1.3.0 ， timeticks-value=4294967296 而通过display version, 显示设备启动时间： Quidway S9xxx Terabit Routing Switch uptime is 123 weeks, 5 days, 15 hours, 51 minutes 按照OID = 1.3.6.1.2.1.1.3.0的定义，4294967296应该是71 weeks 4294967296/100/(2436007) = 71.0146708994709 OID = 1.3.6.1.2.1.1.3.0 计算出来的启动时间，与设备显示的不一致。 这个问题困扰了很久。。。 OID = 1.3.6.1.2.1.1.3.0 计算出来的启动时间，与设备显示的不一致 提示：现网设备实际数据： 抓取到的 OID = 1.3.6.1.2.1.1.3.0 ， timeticks-value=4294967296 而通过display version, 显示设备启动时间： Quidway S9xxx Terabit Routing Switch uptime is 123 weeks, 5 days, 15 hours, 51 minutes 按照OID = 1.3.6.1.2.1.1.3.0的定义，4294967296应该是71 weeks 4294967296/100/(2436007) = 71.0146708994709 >>> 4294967296/100/(24*3600*7)71.0146708994709>>> 原因分析： 提示：SysUpTime MIB supports 32-bit (Timeticks)： SysUpTime MIB supports 32-bit = 2 to the 32nd power = 2^32 = 4294967296 (Timeticks) 32位的整数，最大表示是 2^32 = 4294967296 4294967296 最多表示 是 497天多一点，如果超过这个数值，计数器又从0开始计数。 >>> 2**32/100/(24*3600)497.1026962962963>>> All PacketWise images and models will have the same behavior after the sysUpTime value reaches 497 days, the sysUpTime polled value resets to zero (0). 解决方案： 提示：需要自己加上 n * 2**32 去计算 SysUpTime 如果一个设备启动时间特别长的话，设备通过Trap 发到接收器的 timeticks （OID = 1.3.6.1.2.1.1.3.0），需要加上 n * 2**32，再去计算设备的开机时间，从而再去计算trap信息的实际时间。 后记： 后面发现这个Trap接收到时间，实际也没什么意义了 因为Trap 收到的信息，是设备事件的信息，基本都是实时收到，在接收trap的程序上，记录接收的Trap消息的时间即可，无需通过这个 OID = 1.3.6.1.2.1.1.3.0 去计算了。。。

.1.3.6.1.2.1.1.3.0 snmpget snmpget retrieves data from an SNMP host. It makes a simple request that consists of three elements: where to retrieve information the administrative information associated with the request what information is required:# snmpget -v 2c -c demopublic test.net-snmp.org SNMPv2-MIB::sysUpTime.0 SNMPv2-MIB::sysUpTime.0 = Timeticks: (586731977) 67 days, 21:48:39.77 snmpgetnext The other main operation of the SNMP protocol for retrieving information is GETNEXT, implemented by the snmpgetnext tool. It retrieves similar types of information as snmpget, but from the next OID. It is useful to walk through a series of SNMP hosts and progressively get information from each device. Its syntax is identical to snmpget:# snmpgetnext -v 2c -c demopublic test.net-snmp.org sysUpTimeSNMPv2-MIB::sysUpTime.0 = Timeticks: (586978184) 67 days, 22:29:41.84 snmpwalk As a helper to walk a network, instead of launching snmpgetnext for each SNMP host, snmpwalk can be used to do it automatically: snmptable snmptable returns the content of an SNMP table, displaying it one row at a time: snmpset The SET operation of the SNMP protocol is used to modify information of an SNMP host, update its configuration, or control its behavior. It is implemented in the snmpset tool.One of many possible examples is how to set a random string to be returned when queried:$ snmpset -v 1 -c demopublic test.net-snmp.org ucdDemoPublicString.0 s "hi there!"$ snmpget -v 1 -c demopublic test.net-snmp.org ucdDemoPublicString.0UCD-DEMO-MIB::ucdDemoPublicString.0 = "hi there!" snmpbulkget The GETBULK operation available from SNMP v2 onward is implemented in the snmpbulkget tool. It is used to query a network of SNMP hosts rather than a single one.$ snmpbulkget -v2c -Cn1 -Cr5 -Os -c public zeus system ifTableIt will retrieve the variable system.sysDescr.0 and the first 5 objects of the ifTable.To retrieve multiple variables with a single command, snmpbulkwalk is a tool that allows you to run all the variables under a system:$ snmpbulkwalk

MIB overviewThis document provides information aboutthe management information bases (MIBs) available for the device, includingpublic and private MIBs. About MIBsMIB modules and MIBfilesA MIB is a collection of informationorganized hierarchically in a tree structure. Each node in a MIB is a managedobject uniquely identified by an object identifier (OID). An OID is a dottednumeric string that uniquely identifies the path from the root node to a leafnode. Collections of related objects are definedin MIB modules. Typically, each MIB module has a MIB file. You can run a MIBcompiler to compile the MIB files of the managed device into a visualized MIBtree for the ease of management, as shown in Figure 1.Figure 1 MIB treeafter compilationTypes of MIB objectsMIB objects are classified into scalarobjects, tabular objects, and notification objects. The SNMP manager can accessonly the instances of MIB objects.Scalar objectsScalar objects are single-instance objects.An example of a scalar object is sysUpTime, which contains only one objectinstance to store the time since the network management portion of the systemwas last initialized. The instance of a scalar object is identified by an indexvalue of 0. When the SNMP manager accesses the instance of a scalar object, theSNMP manager must add a suffix of .0 to the object identifier or object name,as shown below:Protocol version:SNMPv2cOperation:GetRequest binding:# Request sent by theSNMP manager1:sysUpTime.0 (TimeTicks) nullResponse binding:# Response sent bythe SNMP agent (the device)1:sysUpTime.0 (TimeTicks) 29 days15h:25m:15s.64th (256111564)Tabular objectsTabular objects define multiple relatedobjects in conceptual tables. You can think of a tabular object as a table inwhich

Status changed. For example, if the interface's operating status changed 60 seconds after the device was rebooted, the ifLastChange value will be 600 (hundredths of seconds) until the operating status changes again.-SysUptime(1.3.6.1.2.1.1.3): This value represents the amount of time in hundredths of seconds that the system has been up.In order to calculate the Last Change value for the interface, ifLastChange is deducted from SysUptime. This gives us the amount of hundredths of a second since the change. We then compare that to the current date and time and we end up with the specific date and time of the change.The limitation of this calculation is that SysUptime rolls over at 4,294,967,296 hundredths of a second. When this occurs, deducting ifLastChange from SysUptime results in a negative number, which then ends up as a futuristic date.The only way around this is to reboot the device, which will reset all counters to 0.Also good link on this here: Thanks, Kev Also I suggest checking those OIDs above using Toolset MIB WALK\MIB Viewer, or even use NPM's UnDP Custom Poller.You can check values and Formula is: SysUpTime - IfLastChange = X Then DateTimeFunction(X) = Interface Last ChangeThe assumption is that IfLastChange should always be a smaller value than SysUpTime since surely an interface could not be up longer than the box it is on… But say for example if the SysUpTime value experiences a rollover we now have the scenario where SysUpTime is smaller than the value of IfLastChange. Our equation will now