New Question
 
 
PRTG Network Monitor

Intuitive to Use.
Easy to manage.

200.000 administrators have chosen PRTG to monitor their network. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free PRTG
Download >>

 

What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general. You are invited to get involved by asking and answering questions!

Learn more

 

Top Tags


View all Tags


Why does the SNMP System Uptime sensor report wrong values?

Votes:

0

Your Vote:

Up

Down

My SNMP System Uptime sensor shows incorrect uptimes. For example, the Windows system info reports that the device is running for 153 days while PRTG displays an uptime of 4 days only.

Does the uptime sensor query the correct OID? How can I fix this wrong system uptime issue?

prtg snmp snmp-custom-sensor snmp-system-uptime system-uptime uptime windows-system-uptime wmi

Created on Aug 21, 2014 2:28:27 PM by  Gerald Schoch [Paessler Support]



3 Replies

Accepted Answer

Votes:

0

Your Vote:

Up

Down

This article applies to PRTG Network Monitor 13 or later

Incorrect System Uptime via SNMP

The SNMP System Uptime sensor monitors the time a device is running. For this purpose, PRTG queries the data from the device via Simple Network Management Protocol (SNMP) and uses specific Object Identifiers (OIDs) to get the corresponding values. See the article How do SNMP, MIBs and OIDs work? for a general introduction.

There are two possible OIDs to query uptime data from a device via SNMP:

  • HOST-RESOURCES-MIB::hrSystemUptime (1.3.6.1.2.1.25.1.1.0)
  • DISMAN-EVENT-MIB::sysUpTimeInstance (1.3.6.1.2.1.1.3.0)

The sensor queries hrSystemUptime if available and uses sysUpTimeInstance as fallback, so the SNMP System Uptime sensor usually reports the correct uptime value. However, in specific cases, PRTG reports an uptime that is lower than the real uptime of the monitored device. There are two possible reasons for this:

1) Wrong Uptime Values because of 32-bit Counters

Both OIDs which the sensor can query for system uptime are 32-bit counters. This means that the maximum value that these counters can have is 2^32 (2 to the power of 32) which is the integer 4294967296. Because the returned uptime value is given in hundreds of seconds (1/100), the maximum possible uptime that the sensor can display is 497 days (which is 4294967296 hundreds of seconds). If the uptime exceeds this value, i.e., the monitored device runs longer than 497 days, the counter resets to 0 and, from this time on, PRTG shows uptime values which are lower than they actually are.

This calculation applies to all network hardware devices, for example, switches or routers. Unfortunately, the behavior on Windows systems is different.

2) Wrong Uptime Values on Windows Systems

If you use the SNMP System Uptime sensor on Windows systems, you might encounter that the uptime value resets to zero not only every 497 days but more often.

Windows returns the uptime value of the default hrSystemUptime counter in thousands of seconds (1/1000). So, considering the calculation for 32-bit counters above, the maximum uptime that the SNMP System Uptime sensor can show on Windows is 49.7 days and resets to 0 if the uptime exceeds this value.

The fallback counter sysUpTimeInstance that would return the values in hundreds of seconds is not used on Windows systems because the default counter is usually available.

Example

Consider the following case that illustrates this issue:

  • The real uptime of a device is 153 days, 14 hours.
  • The SNMP System Uptime sensor in PRTG shows the value 4 days, 11 hours.
  • The maximum uptime value that PRTG can show is 49.7, so the value has exceeded the maximum three times in this case: 49.7 * 3 = 149.1 days
  • The value that PRTG shows added to the “exceeding times product” is then the real uptime: 149.1 days + (4 days, 11 hours) = (153 days, 14 hours)

Workaround

You have two workaround options to get the correct system uptime value on Windows systems:

  • Use the Windows System Uptime sensor on Windows systems. This sensor type can show even uptime values that exceed 497 days.
  • Create an SNMP Custom sensor if you want to avoid using WMI and to avoid the default hrSystemUptime counter of the SNMP System Uptime sensor (that can show a maximum of only 49.7 days on Windows):
    • Query the OID 1.3.6.1.2.1.1.3.0 (sysUpTimeInstance). This is only the fallback of the standard SNMP System Uptime sensor but can show values up to 497 days also on Windows.
    • For display purposes, calculate the number of uptime days by dividing the retrieved value (that comes in hundreds of seconds) by 8640000. Enter this number into the Division field of the sensor settings.
    • Note: Of course, you can display the value also in any other time unit not only in days. Adjust the calculation to get the desired division for the sensor value: The calculation to map hundreds of seconds into days is retrieved_value / (100 (seconds) * 60 (minutes) * 60 (hours) * 24 (days))
    • Note: This counter resets to zero every time the SNMP service on the machine is restarted. This means that the uptime value in the sensor can be different from the real uptime of the monitored device even if there was no restart of the system.
    • Note: You will get a maximum of only 497 days also with this sensor type.

Created on Aug 21, 2014 2:41:23 PM by  Gerald Schoch [Paessler Support]

Last change on Nov 15, 2017 1:12:17 PM by  Gerald Schoch [Paessler Support]



Votes:

1

Your Vote:

Up

Down

Adding to Gerald's answer above, in which he says:

"Note: This counter resets to zero every time the SNMP service on the machine is restarted for whatever reason. This means that the uptime value in the sensor can be different from the real uptime of the monitored device even if there was no restart of the system."

This is per the requirements of the sysUpTime (as found in e.g. RFC 1213), which are that it reflects the uptime of the SNMP Agent, not that of the managed entity itself.

In contrast, hrSystemUptime is supposed to reflect the actual system uptime.

Created on Nov 14, 2017 11:44:09 AM by  tomalak (10)

Last change on Nov 15, 2017 1:03:28 PM by  Luciano Lingnau [Paessler Support]



Votes:

0

Your Vote:

Up

Down

Thank you for sharing this information, tomalak!

Created on Nov 15, 2017 1:49:55 PM by  Gerald Schoch [Paessler Support]



Please log in or register to enter your reply.


Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.