How to Check a Cisco Interface Last Change

Sometimes, customers ask:
"I would like to know when was the last time this port went down!"

Well, our aswer will always be, "we will investigate and let you know."

The problem is, how can I get this information.
Actually, you will find it, if you have a syslog server, but what if the syslog rotates de logs earlier then your think !

Well, there is another way to get some info. Although Cisco says that it is valid, all my tests have not give me any confidence for this data:
Anyway, here it is how to get it.

Cisco provides a MIB for the last change of an Interface:
snmpwalk -v 1 -c .iso.3.6.1.2.1.2.2.1.9

IF-MIB::ifLastChange.1 = Timeticks: (10995) 0:01:49.95
IF-MIB::ifLastChange.2002 = Timeticks: (14524) 0:02:25.24
IF-MIB::ifLastChange.5001 = Timeticks: (12082) 0:02:00.82
IF-MIB::ifLastChange.5002 = Timeticks: (96967443) 11 days, 5:21:14.43
IF-MIB::ifLastChange.10101 = Timeticks: (97498708) 11 days, 6:49:47.08
IF-MIB::ifLastChange.10102 = Timeticks: (97497760) 11 days, 6:49:37.60
IF-MIB::ifLastChange.10103 = Timeticks: (97497340) 11 days, 6:49:33.40
IF-MIB::ifLastChange.10104 = Timeticks: (97496849) 11 days, 6:49:28.49
IF-MIB::ifLastChange.10105 = Timeticks: (97495422) 11 days, 6:49:14.22
IF-MIB::ifLastChange.10106 = Timeticks: (97494025) 11 days, 6:49:00.25
IF-MIB::ifLastChange.10107 = Timeticks: (97494995) 11 days, 6:49:09.95
IF-MIB::ifLastChange.10108 = Timeticks: (11332) 0:01:53.32
IF-MIB::ifLastChange.10109 = Timeticks: (11332) 0:01:53.32
IF-MIB::ifLastChange.10110 = Timeticks: (11332) 0:01:53.32
IF-MIB::ifLastChange.10111 = Timeticks: (11332) 0:01:53.32
IF-MIB::ifLastChange.10112 = Timeticks: (11332) 0:01:53.32
IF-MIB::ifLastChange.10113 = Timeticks: (11332) 0:01:53.32
IF-MIB::ifLastChange.10114 = Timeticks: (11332) 0:01:53.32
IF-MIB::ifLastChange.10115 = Timeticks: (11332) 0:01:53.32
IF-MIB::ifLastChange.10116 = Timeticks: (97498710) 11 days, 6:49:47.10
IF-MIB::ifLastChange.10117 = Timeticks: (97497765) 11 days, 6:49:37.65
IF-MIB::ifLastChange.10118 = Timeticks: (97497353) 11 days, 6:49:33.53
IF-MIB::ifLastChange.10119 = Timeticks: (97496854) 11 days, 6:49:28.54
IF-MIB::ifLastChange.10120 = Timeticks: (97495448) 11 days, 6:49:14.48
IF-MIB::ifLastChange.10121 = Timeticks: (97494037) 11 days, 6:49:00.37
IF-MIB::ifLastChange.10122 = Timeticks: (97494996) 11 days, 6:49:09.96
IF-MIB::ifLastChange.10123 = Timeticks: (11333) 0:01:53.33
IF-MIB::ifLastChange.10124 = Timeticks: (11333) 0:01:53.33
IF-MIB::ifLastChange.10125 = Timeticks: (11333) 0:01:53.33


Use it in your own risk!

Serial Interface Sync

There serial interface can be in a state where it is up but looped. This means that the circuit has a loop on the other side, but not connectivity to any other point.

In order to correctly read the status of the interface, use the option:

interface Serial0/0
down-when-looped

This will bring the status to:

Serial0/0 is up, line protocol is down (looped)
Hardware is PowerQUICC Serial

When the V.35 Layer 1 connection is actually estabilhed, the HDLC will also sync with the logs:


Serial0: HDLC myseq 3354903, mineseen 3354903*, yourseen 25701, line up
Serial0: HDLC myseq 3354904, mineseen 3354904*, yourseen 25702, line up
Serial0: HDLC myseq 3354905, mineseen 3354905*, yourseen 25703, line up
Serial0: HDLC myseq 3354906, mineseen 3354905, yourseen 25703, line up

May 28 14:12:54: %IP_SNMP-4-NOTRAPIP: SNMP trap source FastEthernet0/0 has no ip address
May 28 14:14:03: %IP_SNMP-4-NOTRAPIP: SNMP trap source FastEthernet0/0 has no ip address
6d03h: Serial0/0: HDLC myseq 53150, mineseen 53149*, yourseen 53150, line up (looped)
6d03h: Serial0/0: HDLC myseq 53151, mineseen 53150*, yourseen 53151, line up (looped)
6d03h: Serial0/0: attempting to restart
6d03h: PowerQUICC(0/0): DCD is up.

After this log, the serial will be in the state:

Serial0/0 is up, line protocol is up