SNMP sysUpTime OID does not return the same time value as system uptime in "show system info."
3317
Created On 11/12/20 08:44 AM - Last Modified 11/29/23 03:44 AM
Symptom
The values displayed for uptime on "show system info" is different from SNMP sysUpTime OID (1.3.6.1.2.1.1.3)
Example:
admin@Lab-FW> show system info
.......
mac-address: 08:66:1f:02:1e:b3
time: Thu Nov 12 00:12:29 2020
uptime: 8 days, 1:56:55
......
user@linux-> snmpwalk -v 2c -c public 10.1.1.1 sysUpTime
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (69512883) 8 days, 1:05:28.83
Environment
- Palo Alto Firewalls
- Supported PAN-OS
- SNMP
Cause
- sysUptime is "snmp process uptime" (rfc3418) and not the actual uptime of Firewall.
- sysUpTime is a standard OID that defined as "The time (in hundredths of a second) since the network management portion of the system was last re-initialized."
Resolution
To get the actual firewall uptime using SNMP use OID hrSystemUptime (1.3.6.1.2.1.25.1.1.0)
admin@Lab-FW> show system info | match uptime
uptime: 8 days, 2:19:12
user@linux-> snmpwalk -v 2c -c public 10.1.1.1 1.3.6.1.2.1.25.1.1.0
HOST-RESOURCES-MIB::hrSystemUptime.0 = Timeticks: (69955383) 8 days, 2:19:13.83
Additional Information
- It's expected the sysUptime value is different from the system uptime
- When you restart the snmpd process, sysUpTime is reset.
admin@Lab-FW> debug software restart process snmpd Process snmpd was restarted by user admin!! before restart snmpd process user@linux-> snmpwalk -v 2c -c public 10.1.1.1 sysUpTime DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (69586212) 8 days, 1:17:42.12 !! after restart snmpd process user@linux-> snmpwalk -v 2c -c public 10.1.1.1 sysUpTime DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (555) 0:00:05.55