I got bit by a rather interesting bug today. I noticed my time was all out of whack on RMON events. In my lab I really don’t care too much about the time to a critical degree. But I do make sure its generally in sync between my switches and server so that things like Certificates don’t break. Here is the situation, I configure an RMON event on my MDS:
MDS1# show run | inc rmon
rmon event 1 log trap public description FATAL(1) owner mgmt
rmon event 2 log trap public description CRITICAL(2) owner mgmt
rmon event 3 log trap public description ERROR(3) owner mgmt
rmon event 4 log trap public description WARNING(4) owner mgmt
rmon event 5 log trap public description INFORMATION(5) owner mgmt
rmon hcalarm 2 1.3.6.1.2.1.31.1.1.1.6.16777216 5 delta rising-threshold-high 0 rising-threshold-low 5000000 4 falling-threshold-high 0 falling-threshold-low 1000000 4 owner ifHCInOctets.fc1/1@mgmt
I have NTP set on this MDS, and here is the time:
MDS1# show run | inc clock
clock timezone PST -8 0
clock summer-time PST 2 Sunday March 02:00 1 Sunday November 02:00 60
MDS1# show clock
Wed Aug 18 19:52:12 PST 2010
Yet, the RMON events are being logged with the incorrect time:
MDS1# show rmon events
Event 1 is active, owned by mgmt
Description is FATAL(1)
Event firing causes log and trap to community public, last fired never
Event 2 is active, owned by mgmt
Description is CRITICAL(2)
Event firing causes log and trap to community public, last fired never
Event 3 is active, owned by mgmt
Description is ERROR(3)
Event firing causes log and trap to community public, last fired never
Event 4 is active, owned by mgmt
Description is WARNING(4)
Event firing causes log and trap to community public, last fired 2010/08/18-16:09:35
Event 5 is active, owned by mgmt
Description is INFORMATION(5)
Event firing causes log and trap to community public, last fired never
What’s even more strange, is that I send these events to FMS, and in FMS Web Client, the time shows a totally different time there as well. Its very bizarre, here is the summary, lets say the MDS clock shows 19:21 hours, this would be the result of the other clocks:
-
MDS clock shows 19:21 hours
MDS rmon event shows 15:21 hours
FMS host (Windows 2003) time is set to 7:21pm
FMS Web Client rmon log shows event as 14:21 hours
This has been confirmed as Cisco bug CSCta34838. It is marked internal only. Title is “RMON: Event last fired timestamp is wrong” and it exists in FMS 4.2(1) and below. It is fixed in 5.0.
