wrong datestamp in "show log"

[Silvio_Oehme]

Hi folks, I discovered a problem with our Procurve 5000 series switches. The switches show a wrong datestamp within the log. Since the year change to 2013 the log shows a "little" difference to the system time. firmware Image stamp: /sw/code/build/btm(K_15_04) May 27 2011 13:48:59 K.15.04.0007 97 ______________________________________________________________ show log -r Keys: W=Warning I=Information M=Major D=Debug E=Error ---- Reverse event Log listing: Events Since Boot ---- I 08/25/11 10:05:00 00179 mgr: SME SSH from x.x.x.x - MANAGER Mode I 08/25/11 06:11:23 00131 tftp: Transfer completed show time Thu Jan 3 11:39:43 2013 ______________________________________________________________ It occurs on all our 5k series switches, so I assume its something with the software? Does anybody else have the same problem? Before I start to reboot all switches and let our people driving made because of the downtime I would like to know if somebody tried something in that direction or has another solution? Regards Silvio Oehme University of Applied Sciences Esslingen

[paulgear]

Do you have SNTP enabled? What does "show sntp" report?

[Silvio_Oehme]

hi paul gear, yes sntp is enabled and works fine. as I wrote the current time/date is ok. the failure only occurs inside the log-function. show sntp SNTP Configuration SNTP Authentication : Disabled Time Sync Mode: Sntp SNTP Mode : Unicast Poll Interval (sec) [720] : 720 Source IP Selection: Outgoing Interface Priority SNTP Server Address Version Key-id -------- --------------------------------------- ------- ---------- 1 xxx 3 0 regards silvio

[EckerA]

hi... here happens the same...with K.15.08.0013 sw1# sh time Fri Jan 4 09:46:48 2013 sw1# clear log sw1# sh log Keys: W=Warning I=Information M=Major D=Debug E=Error ---- Event Log listing: Events Since Boot ---- I 01/04/13 09:47:07 00184 mgr: Log cleared as a result of 'clear logging' command ---- Bottom of Log : Events Listed = 1 ---- sw1# sh time Fri Jan 4 09:46:59 2013 sw1# have you made a call with HP? Alex

[Silvio_Oehme]

hi alex, not yet. First I wanted to know if somebody else do has the same problem. You wrote you also have the problem. But your logfile-times seems nearly fine to me. you have a difference from about 15 seconds. with me its a difference from about one and a half years. Possibly its the same error, so it seems I have to open a call at hp. Regards Silvio btw: why are all my posts without line-breaks? this looks awful and is hard to read (there are several member with the same effect)

[paulgear]

Definitely looks like a bug.  I'd be willing to bet a reboot clears it, but that's not a good solution, especially on 5300/5400 series switches which tend to be more critical.

[Jim-McNugget]

I have this too on a ProCurve 3500yl with K.15.04.0003 and am considering whether to reboot the switch or contact HP first. I reviewed the release notes on all the subsequent firmware releases and have not seen mention of a fix. I am using SNTP and show time gives the correct time. show logging is showing a date of 02/21/12 for today.

What did you decide to do in the end?

[paulgear]

Hi Jim,

I would definitely try to schedule a firmware upgrade regardless.  In my experience the release notes are not 100% comprehensive, and a firmware upgrade is the first thing that support will ask you to do if you call.  So being on the latest firmware can shortcut that process and hopefully get you to L2/L3 support faster.

[Jim-McNugget]

Hi Paul,

First off just let me say I reloaded one of the switches with this problem last night and the dates are now correct, so that is obviously a good short term fix for this issue. The switch had been up for some time so perhaps a counter gets filled up somewhere...

You're right of course firmware upgrades are generally a good idea. However, the problem I occasionally find is that for issues that take a long time to recur, you can update the firmware and be waiting some time to find out that the problem is not fixed. By this time, more firmware (that still doesn't fix the problem) has become available and you're stuck in a loop!

Jim

[heismancat]

Does anyone know if HP got this bug resolved?  I ran into this issue this morning where my "show time" is correct, but the timestamp on my show log is off.  I'm going to upgrade the firmware tonight, but was just wondering if that will actually fix this long term.

[Joel_Leonhardt]

FYI, HP has released information and a fix for this bug; see below.

Also, additional symptoms noted in our environment (hp5412zl, K.15.07.0008):

- Upon  snmp sysUpTime reaching approx 4294965000 (hundredths of a second since restart), or 497 days, it dropped to zero and started climbing again; this would normally indicate a switch restart, so triggered a monitoring system alert.

- CLI command "show uptime" indicated the switch to have been up for only a few minutes.

- But other CLI commands (eg: "show span" with long time since last change, and "show int" with high packet counts) indicated the switch to have been up for an extended period.

- And the log file had the symptoms mentioned in this discussion, with previous logs all timestamped correctly, but new logs (since sysUpTime was reset), timestamped starting about Dec 27, 2012, 9am.

- This happened to all 3 of our hp5400 switches that had been up for 497 days.

HP's information on this issue:

**Version K.15.13.0004 Fix List

Event Log (CR_0000127436) - After the switch uptime reaches 497 days, the timestamp entries in the event log become erratic with gaps of several hours or days. In some cases the timestamps revert to previous months and years, even though SNTP updates with those wrong timestamps report the correct date and time.

Reference:

http://h20566.www2.hp.com/portal/site/hpsc/template.BINARYPORTLET/public/kb/docDisplay/resource.process/?spf_p.tpst=kbDocDisplay_ws_BI&spf_p.rid_kbDocDisplay=docDisplayResURL&spf_p.rst_kbDocDisplay=wsrp-resourceState%3DdocId%253Demr_na-c04084207-5%257CdocLocale%253D

[Gordon Cook]

I understand the fix for this issue is to upgrade the firmware.   We do plan to do that it is just takes a lot of planning since we have to shut down most of our servers to do this.  Is there a way to reset the time for the logs or something in the meantime.  Trying to troubleshoot is a real pain right now.  We have a E5412ZL