Restart of SNMP agent causes incorrect rate calculation

When an SNMP agent restarts (for example, after a reboot of the network device), it generally resets all counter variables to zero, which causes rate tags to contain incorrect values.

For example, PI_tag1 is configured to scan an OID at five-minute intervals starting on the hour. During normal operation, the OID values for the counter on the network device change as follows:

08:00:00 (scanned): 400,000
08:02:59 (not scanned): 500,000
08:05:00 (scanned): 600,000

The number of octets received during the five-minute time interval is 200,000. The rate stored in PI_tag1, is 666.67 (200,000/300) octets/second, which is correct.

If an SNMP agent were to restart between scans, the values might change as follows:

08:00:00 (scanned): 400,000
08:02:59 (reboot resets counter; not scanned): 0
08:05:00 (scanned): 100,000

In this case, the interface determines that the number of octets received during this five-minute interval is 4,294,667,296, calculated as 100,000 – 400,000 = –300,000, or Hexadecimal FFFB6C20; for an unsigned value, this is 4,294,667,296, and clearly incorrect.

To detect restarts, configure a tag that records system.sysUptime.0 for each network devices you are tracking, to record the approximate time at which the SNMP agent restarted. If you knows beforehand that an SNMP agent will restart (for example, because of the need to reboot a router), stop the interface program, restart the SNMP agent, then restart the interface.