OID for Windows Uptime

tman · Post by **tman** » Mon Jul 02, 2007 7:58 am

I'm trying to put a simple graph into Cacti showing Windows uptime. Trouble is, there seems to be multiple OID's showing different uptimes in Windows, and I need to know one that's actually accurate.

The summary is;

If I query the standard sysuptime OID (1.3.6.1.2.1.1.3), then the value I get is actually the time the SNMP stack has been running (not reliable on a Windows host!)

If I query hrSystemUptime (1.3.6.1.21.25.1.1) I get another figure which is very high (and wrong!), and if I run the standard uptime.exe on Windows, I get yet another uptime (which might be more accurate, but doesn't seem to have an OID).

So, which is the most accurate way of polling uptime on a Windows host?

BSOD2600 · Post by **BSOD2600** » Mon Jul 02, 2007 12:44 pm

I believe hrSystemUptime is the better way to go. Reading through the RFC for it, "The amount of time since this host was last initialized. Note that this is different from sysUpTime in MIB-II [3] because sysUpTime is the uptime of the network management portion of the system." This is represented in TimeTicks. A TimeTicks is,

The TimeTicks type represents a non-negative integer which represents the time, modulo 2^32 (4294967296 decimal), in hundredths of a second between two epochs. When objects are defined which use this ASN.1 type, the description of the object identifies both of the reference epochs.

For example, [3] defines the TimeStamp textual convention which is based on the TimeTicks type. With a TimeStamp, the first reference epoch is defined as the time when sysUpTime [5] was zero, and the second reference epoch is defined as the current value of sysUpTime.

The TimeTicks type may not be sub-type

Being the case its only 32bits, after X days, the counter will wrap and become invalid, FYI.

mcutting · Post by **mcutting** » Tue Jul 03, 2007 1:36 am

There is a generic uptime template in the scripts forum. This works for all devices, and may save you some time...

Let me know if you can't find it...

tman · Post by **tman** » Tue Jul 03, 2007 4:25 am

Thanks for the replies.

I going to have to say that the hrSystemUptime OID on Windows hosts is not giving the correct value. The example I give is for a Windows 2003 server that has been up for 64 days 21 hours (checked).

sysuptime OID gives the correct value, but can't be trusted because it's relevant to the time the management subsystem has been up.

hrSysUptime for the host shows 151 days 17 hours or 1310824344 timeticks (!), and this is the OID polled by the Generic Uptime template. For the life of me, I can't understand why this amount of uptime is showing, if this was meant to be from the last point of initialization.

Running 'uptime.exe' on the host shows the correct value, but I believe this is making an RPC query against the host, so can't easily be used.

I can replicate this on all our Windows hosts. hrSysUptime always shows a 'way off' value, so I can't use it. If I try querying sysuptime and hsSysUptime on *nix hosts though, the values are *almost* the same (maybe a couple of minutes difference). I guess this may be the difference in time between the counter starting from a boot and the management subsystem to start on the host.

BSOD2600 · Post by **BSOD2600** » Tue Jul 03, 2007 10:53 am

It's possible with that large of an uptime, that the counter has rolled over. Other than snmp, the other way to retrieve uptime would be wmi, but that is costly.

aleu · Post by **aleu** » Mon Mar 09, 2009 6:25 am

BSOD2600 wrote:It's possible with that large of an uptime, that the counter has rolled over. Other than snmp, the other way to retrieve uptime would be wmi, but that is costly.

Hey guys. I know this is an old thread, but perhaps someone has a template for this. I checked the forum, but found only one using WMI. Thus my question. Is there a way to get legitimate (I am also seeing issues described by tman - sysuptime OID giving incorrect results) uptime of Windows devices via SNMP? If so, can you please point me to the right template?

Thanks,
AL

BSOD2600 · Post by **BSOD2600** » Mon Mar 09, 2009 1:20 pm

My original comments about this issue and the snmp uptime counter still apply. Thats probably why users have gone with the WMI method instead.

mcutting · Post by **mcutting** » Mon Mar 09, 2009 1:48 pm

Search the Scripts and Templates forum for "Generic Uptime". If you can't find it, let me know, as I am actively using this.

aleu · Post by **aleu** » Mon Mar 09, 2009 3:14 pm

mcutting wrote:Search the Scripts and Templates forum for "Generic Uptime". If you can't find it, let me know, as I am actively using this.

Could you please post link to the one you are refering to? I want to make sure to use one that works as I have seen many other scripts on the forum.

Thanks a lot.

mcutting · Post by **mcutting** » Tue Mar 10, 2009 3:13 am

aleu wrote:
mcutting wrote:Search the Scripts and Templates forum for "Generic Uptime". If you can't find it, let me know, as I am actively using this.
Could you please post link to the one you are refering to? I want to make sure to use one that works as I have seen many other scripts on the forum.

Thanks a lot.

have a look at http://forums.cacti.net/viewtopic.php?p ... ime#151908

aleu · Post by **aleu** » Tue Mar 10, 2009 5:19 pm

mcutting wrote:have a look at http://forums.cacti.net/viewtopic.php?p ... ime#151908

I have just checked this template and saw that it is polling the SNMPv2-MIB::sysUpTime.0 OID (1.3.6.1.2.1.1.3), which is actually the time the SNMP stack has been running. This is not accurate information as one may restart the SNMP service at any time.
What I was trying to query in the past was the "HOST-RESOURCES-MIB::hrSystemUptime.0" or ".1.3.6.1.2.1.25.1.1.0" OID. The issue I am having with the hrSystemUptime is as described here:

http://forums.cacti.net/viewtopic.php?t ... ght=uptime

It simply works "too fast". I would like to avoid using WMI. Any idea why this OID produces the incorrect data?

aleu · Post by **aleu** » Fri Mar 20, 2009 5:50 pm

aleu wrote:Any idea why this OID produces the incorrect data?

Anyone?

BSOD2600 · Post by **BSOD2600** » Sat Mar 21, 2009 2:44 pm

aleu wrote:Anyone?

BSOD2600 wrote:I believe hrSystemUptime is the better way to go. Reading through the RFC for it, "The amount of time since this host was last initialized. Note that this is different from sysUpTime in MIB-II [3] because sysUpTime is the uptime of the network management portion of the system." This is represented in TimeTicks. A TimeTicks is,
The TimeTicks type represents a non-negative integer which represents the time, modulo 2^32 (4294967296 decimal), in hundredths of a second between two epochs. When objects are defined which use this ASN.1 type, the description of the object identifies both of the reference epochs.

For example, [3] defines the TimeStamp textual convention which is based on the TimeTicks type. With a TimeStamp, the first reference epoch is defined as the time when sysUpTime [5] was zero, and the second reference epoch is defined as the current value of sysUpTime.

The TimeTicks type may not be sub-type
Being the case its only 32bits, after X days, the counter will wrap and become invalid, FYI.

aleu · Post by **aleu** » Sat Mar 21, 2009 11:12 pm

BSOD2600 wrote:I believe hrSystemUptime is the better way to go. Reading through the RFC for it, "The amount of time since this host was last initialized. Note that this is different from sysUpTime in MIB-II [3] because sysUpTime is the uptime of the network management portion of the system." This is represented in TimeTicks.

Nevermind, I figured it out. M$ reports the MIB uptime in centiseconds, not miliseconds as other vendors. Attached graph template addresses this issue. Thanks.

BSOD2600 · Post by **BSOD2600** » Sat Mar 21, 2009 11:39 pm

That's what I said...

Anyways, glad you got it working how you wanted.

OID for Windows Uptime

OID for Windows Uptime

Who is online