What is the difference between the 0x10ff0, 0x11000, and 0x11db1 events in Spectrum?
0x10ff0 Device or SNMP agent on Device {m} of type {t} has been rebooted.
0x11000 Host Device {m} of type {t} has been rebooted.
0x11db1 The SNMP engine on device {t}, named {m} has been rebooted
Reboot time - {D 1}
SNMP engine boots - {I 2}
Event 0x00011db1 is generated by interference handler which polls the snmpEngineBoots attribute on the device. When the current value is lower than the previous value a potential reboot has occurred so Spectrum will calculate the reboot time as the difference between current system time and snmpEngineTime and send SNMP_ENGINE_BOOT_EVENT along with the reboot time and snmpEngineBoots value.
Event 0x00010ff0 is triggered when sysUpTime value decreases from the current value.
Event 0x00011000 is generated by monitoring sysUpTime when it is populated using hrsysuptime (from the Host Resources mib). hrsysuptime is noted as "The amount of time since this host was last initialized."
Spectrum will use a combination of sysuptime, hrsysuptime, or enginetime depending on what the device supports to determine if the device has actually rebooted.
Although System uptime is a 32-bit counter and the value will roll to 0 after 497 days this alone will not trigger a false device reboot event. Spectrum code understands the limitations of the 32-bit value and when the counter value resets it checks to see if a previous poll neared the counter limit.
None of the above events generate an alarm out of the box.