Tons of false device has been rebooted 0x10ff0 events

Products

• CA Spectrum

Issue/Introduction

There are tons of false "Device XXXXX of type YYYYY has been rebooted" 0x10ff0 events for hundred devices, generated in each polling cycle.
This could happen in any CA Spectrum release prior 10.3. 

Environment

CA Spectrum 10.2.3  + Spectrum_10.02.03.BMP_10.2.301

Cause

Spectrum polls the sysUpTime attribute id 0x10245 every poll interval. For most devices, the Polling_Interval attribute ID 0x10071 is set to 300 seconds. Spectrum then compares the current value of sysUpTime with the previous value of sysUpTime read. If the current value is less than the previous value, that is an indication the device has been rebooted and the device rebooted event id 0x10ff0 is logged

But if the sysUpTime attribute rolls over in 495 days or gives inconsistent values, and so a false reboot alarm is generated.
 

Resolution

Unlike sysUptime, snmpEngineTime will rollover after 68 years.
So, if sysUpTime resets, then based on the snmpEngineTime we will decide whether there was an actual reboot or it is rollover case.

This issue has been addressed in the following patch. Please contact CA Spectrum Support:
For Spectrum 10.2.3 + Spectrum_10.02.03.BMP_10.2.301 -->  Spectrum_10.02.03.PTF_10.2.325

This is also fixed in Spectrum release 10.3.0 and above as noted in the Resolved Issues section of the 10.3 documentation:

Resolution: If sysUpTime resets, then based on the snmpEngineTime it will be decided whether there was an actual reboot or not.
(10.3.0, DE356653, 00998222)