OID to get Last Input Never infor via snmp

[Jorenilson Santos]

Hi everyone,

I'm trying to get the Last input never information via snmp regarding to each interface from my Cisco C9200L-48P-4G switches? The idea is create a discovery rule in the Zabbix to monitor the amount time that each interface in the switch is in use or not and by how long time, this is the main idea here.

To do that I need to know which the correct OID that I may to use?

[balaji.bandi]

i generally use out of the box connect device on demand and get report - using below command :

show int | i proto.*notconnect|proto.*administratively down|Last in.* [6-9]w|Last in.*[0-9][0-9]w|[0-9]y|disabled|Last input never, output never, output hang never

depends on device you using check some SNMP information as below :

https://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/26007-faq-snmpcounter.html

[Jorenilson Santos]

Just to comment I saw another post here in the community saying for:
ref.: https://community.cisco.com/t5/network-management/cisco-oid-for-getting-info-on-last-input-and-output-interface/td-p/428842

1. Elapsed time in milliseconds since last line protocol input packet was received: I can use this OID .1.3.6.1.4.1.9.2.2.1.1.3

2. Elapsed time in milliseconds since last line protocol output packet was transmitted: I can use this another one OID .1.3.6.1.4.1.9.2.2.1.1.4

The result is positive and worked partially fine. But I don't know the reason for the interface that never was used return some time, as you can see the evidence in attached picture. If I go to check via command line, shows like LAST INPUT NEVER.

[balaji.bandi]

what device and IOS code running to understand us better.

you can do some more sub references:

https://oidref.com/1.3.6.1.4.1.9.2.2.1.1.3  ( you can replace last 3 with 4 get other results)

[Jorenilson Santos]

Hi @balaji.bandi ,

Thank you for your answer. See...

As I noticed before can get by SNMP the correct information related to the LAST INPUT informations of interfaces in use or not as you can see below.

The main problem is that when one Interface that never was connected (see in the arrow "2" , below), for example, via command line shows the correct information as Last input never(See in the arrow "3", below). But when I perform the Snmpwalk to get the OID content information from the device, it return a value as you can see in the arrow "1" resulting in a wrong return to the Zabbix monitoring tool.

In resume, what I need to know from some cisco specialist is when the network device pass to consider the result Last Input Never???

[balaji.bandi]

On Cat 9200 and  what IOS XE Code running ? 

never seen that - I will try later cat 9300 snmpwalk and let you know

check any new MIB you can download  for IOS XE :

https://github.com/cisco/cisco-mibs/tree/main/v2

[Jorenilson Santos]

Here go my friend!

SWITCH#sh ver
Cisco IOS XE Software, Version 17.03.05
Cisco IOS Software [Amsterdam], Catalyst L3 Switch Software (CAT9K_LITE_IOSXE), Version 17.3.5, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2022 by Cisco Systems, Inc.
Compiled Wed 09-Feb-22 09:28 by mcpre

Cisco IOS-XE software, Copyright (c) 2005-2022 by cisco Systems, Inc.
All rights reserved. Certain components of Cisco IOS-XE software are
licensed under the GNU General Public License ("GPL") Version 2.0. The
software code licensed under GPL Version 2.0 is free software that comes
with ABSOLUTELY NO WARRANTY. You can redistribute and/or modify such
GPL code under the terms of GPL Version 2.0. For more details, see the
documentation or "License Notice" file accompanying the IOS-XE software,
or the applicable URL provided on the flyer accompanying the IOS-XE
software.

ROM: IOS-XE ROMMON
BOOTLDR: System Bootstrap, Version 17.5.1r [FC4], RELEASE SOFTWARE (P)

MNSTS036-DR01 uptime is 2 days, 2 hours, 39 minutes
Uptime for this control processor is 2 days, 2 hours, 41 minutes
System returned to ROM by Power Failure or Unknown
System restarted at 17:13:58 MNS Sun Nov 6 2022
System image file is "flash:packages.conf"
Last reload reason: Power Failure or Unknown

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

Technology Package License Information:

------------------------------------------------------------------------------
Technology-package Technology-package
Current Type Next reboot
------------------------------------------------------------------------------
network-essentials Smart License network-essentials
dna-essentials Subscription Smart License dna-essentials

Smart Licensing Status: Registration Not Applicable/Not Applicable

cisco C9200L-48P-4G (ARM64) processor with 523641K/3071K bytes of memory.
Processor board ID TSP26270185
2 Virtual Ethernet interfaces
52 Gigabit Ethernet interfaces
2048K bytes of non-volatile configuration memory.
1984312K bytes of physical memory.
819200K bytes of Crash Files at crashinfo:.
1941504K bytes of Flash at flash:.

Base Ethernet MAC Address : f8:e9:4f:cf:aa:80
Motherboard Assembly Number : 73-18365-08
Motherboard Serial Number : TSP26270185
Model Revision Number : P0
Motherboard Revision Number : C0
Model Number : C9200L-48P-4G
System Serial Number : TSP26270185
CLEI Code Number : INM6B00ARA

Switch Ports Model SW Version SW Image Mode
------ ----- ----- ---------- ---------- ----
* 1 52 C9200L-48P-4G 17.03.05 CAT9K_LITE_IOSXE INSTALL

[balaji.bandi]

ok i am running same version all over my Cat 9300, I will do snmp walk let you know the outcome.

[Jorenilson Santos]

I did not find nothing until at the moment. Same the Data sheet of this equipment continue making references to this MIB "OLD-CISCO-INTERFACES-MIB" that is the same that I'm using.

But I end up of see a stranger thing here... The returned time for these interfaces never used is exactly the same present in the uptime of the device. So maybe this is the way that the device check when one interface never used just comparing these two informations, if they are similar so it never was used.

I think! What do you think?

[balaji.bandi]

i did snmpwalk i get the results as expected,  here is the output of interface and have huge snmpwalk all looks good,

TwoGigabitEthernet1/0/1 is down, line protocol is down (notconnect)
MTU 1500 bytes, BW 2500000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Auto-duplex, Auto-speed, media type is 100/1000/2.5GBaseTX
input flow-control is on, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: Class-based queueing
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts (0 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast, 0 pause input
0 input packets with dribble condition detected
0 packets output, 0 bytes, 0 underruns
Output 0 broadcasts (0 multicasts)
0 output errors, 0 collisions, 3 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out

[Jorenilson Santos]

Hello my friend,

Can you please share also the your snmp walk result?

[Jorenilson Santos · Accepted solution]

That's it folks,
I found the logic for never use interfaces. They just compare the Uptime with the Last Input Never information that we get via snmp. If both are the same, so means that there interface in the switcher never was used.

Now that I got the logic for this question so this topic was solved.