Tons of false device has been rebooted 0x10ff0 events

Document ID : KB000098429
Last Modified Date : 10/09/2018
Show Technical Document Details
Issue:
There are tons of false "Device XXXXX of type YYYYY has been rebooted" 0x10ff0 events for hundred devices, generated in each polling cycle.
This could happen in any CA Spectrum release prior 10.3. 
Environment:
CA Spectrum 10.2.3  + Spectrum_10.02.03.BMP_10.2.301
Cause:
Spectrum polls the sysUpTime attribute id 0x10245 every poll interval. For most devices, the Polling_Interval attribute ID 0x10071 is set to 300 seconds. Spectrum then compares the current value of sysUpTime with the previous value of sysUpTime read. If the current value is less than the previous value, that is an indication the device has been rebooted and the device rebooted event id 0x10ff0 is logged

But if the sysUpTime attribute rolls over in 495 days or gives inconsistent values, and so a false reboot alarm is generated.
 
Resolution:
Unlike sysUptime, snmpEngineTime will rollover after 68 years.
So, if sysUpTime resets, then based on the snmpEngineTime we will decide whether there was an actual reboot or it is rollover case.

This issue has been addressed in the following patch. Please contact CA Spectrum Support:
For Spectrum 10.2.3 + Spectrum_10.02.03.BMP_10.2.301 -->  Spectrum_10.02.03.PTF_10.2.325