Is it possible to convert a Cisco timestamp to date format?

[ayaz.akhtar]

I am trying to determine at approx. what time a serial interface on a Cisco 3745 went down/up.

The relevant show command outputs are as follows:

R1>sh logging history

Syslog History Table:1 maximum table entries,

saving level warnings or higher

378 messages ignored, 0 dropped, 0 recursion drops

200 table entries flushed

SNMP notifications not enabled

entry number 201 : LINK-3-UPDOWN

Interface Serial1/0, changed state to up

timestamp: 1013154610

R1>

R1>sh clock

*01:30:40.415 UTC Mon Jun 28 1993

R1>

Using the timestamp at which Serial1/0 changed state is it possible to calculate date/time?

Thanks in advance for your help.

[vmiller]

try this:

service timestamps debug datetime

service timestamps log datetime msec

gets you log entries like this:

Aug 18 21:51:22: %DUAL-5-NBRCHANGE: IP-EIGRP 1: Neighbor xxx.xxx.xxx.xxx.(Vlan277) is down: peer restarted

[ayaz.akhtar]

The router is already configured with the command lines suggested.

Also, do you know what unit of measurement is used for the timestamp shown under the 'show logging history' command? Is it msec, microseconds, ticks etc etc...???

Thanks.

[rajesh444]

Hi,

Do you have NTP configured on your router? From your output it looks like there is no NTP setting.

Network Time Protocol [NTP:UDP-port 123] synchronizes time between a server that provides clocking and a client [router/switch] that receives it. You can find public NTP servers on the Internet.

The following links should be useful.

Configuring NTP on Cisco routers:

http://www.cisco.com/en/US/customer/tech/tk648/tk362/technologies_q_and_a_item09186a0080093f16.shtml

NTP Best practices:

http://www.cisco.com/en/US/tech/tk869/tk769/technologies_white_paper09186a0080117070.shtml

Listing of worldwide NTP servers and general documentation on NTP:

http://www.ntp.org/

Hope this helps,

Rajesh

[ayaz.akhtar]

Yes, you are right, we do not have NTP configured.

What I am trying to discover is what does the timestamp value shown under the 'show logging history' command symbolise, and if it is possible to calculate a date from this timestamp.

It would help if you could advise if this timestamp is in msec, microseconds, tick etc etc...

Thanks.

[vmiller]

you will get the date once you set the system clock.

i overlooked the fact that yours isn't set. A better course will be to use NTP. The msec is milliseconds.

[ayaz.akhtar]

Just to double-check -

So, the timestamp shown under the logging history command below is given in milliseconds?

R1#show logging history

Syslog History Table:1 maximum table entries,

saving level warnings or higher

378 messages ignored, 0 dropped, 0 recursion drops

200 table entries flushed

SNMP notifications not enabled

entry number 201 : LINK-3-UPDOWN

Interface Serial1/0, changed state to up

timestamp: 1013154610

R1#

Is it possible to convert this timestamp to a date to verify at what time the Serial1/0 interface changed state?

[vmiller]

I dont recognize that syslog output.

whats the device ?

make sure you:

1. either set the system clock or configure NTP

2. put the following 2 line in your config

service timestamps debug datetime

service timestamps log datetime msec

This should produce output in the log like this:

Nov 20 06:57:05.508: %BGP-5-ADJCHANGE: neighbor xxx.xxx.xxx.xxxx Up

so you have month hour minute second millisecond then the message

[PATRICK SERENO]

I doubt you still have this question 12 years later, but the answer is the timestamp is the number of milliseconds since the last router boot, aka system uptime (unless the router has been up for 1 year, 132 days, 2 hours, 27 minutes and 52.96, at which rate you may get inconsistent results because SNMP uptime is a 32-bit number).

To convert the timestamp to a date, get your system uptime (SNMP OID 1.3.6.1.2.1.1.3.0), subtract the timestamp from the system uptime... that is the number of milliseconds in the past that this event happened.

For Instance:

timestamp: 172704447

system uptime: 215970761

( 215970761 - 172704447 ) = 43266314 => 5 days, 0 hours, 11 minutes, 3.14 seconds