Alerts and Queryables for Device Reset
Alerts and Queryable for Device Resets
Outcome: Monitoring and alerting capabilities are enabled for Device Reset. Device reset KPI is about identifying when a device reboots. The feature is enabled for all the devices deployed in all environments.
Dashboard Example:
| Alert Name | Priority | Queryable | Notes |
|---|---|---|---|
| Device Reboot | P3 | device_reset_state_violation | An alert is generated when the Device reboots. |
As defined in RFC 1213, the SNMP sysUpTime counter is a 32-bit value that peaks at 4,294,967,295. This represents approximately 497.1 days (specifically 497 days, 2 hours, 27 minutes, and 53 seconds). Once this limit is reached, the counter “wraps around” and automatically resets to zero.
Detection Condition
A decrease in the sysUpTime value does not automatically trigger a reboot alert. This is because a lower value could simply indicate a natural counter rollover after 497 days rather than a physical restart.
In Selector, we precisely monitor the sysUpTime calculations to distinguish between a routine counter wrap-around and a genuine system reboot.
By accounting for this 497-day cycle, we ensure that “Device Reset” alerts are only dispatched for actual hardware or software reboots, eliminating false positives caused by counter limitations.
Queryables
device_reset_state_violation where device_vendor!~“CA|Firemon|Forescout|InfoBlox|ISE|NetBrain|NetMRI|Netscout|CISCO ISE|UDPD”
NOTE: Vendor list should be adjusted for equipment environment.