Interface byte counters only go up. When a sample shows fewer bytes than the previous one, the obvious conclusion is that the sample is bad, and our collector did the obvious thing: it discarded the delta so that the usage figures would not go wrong. Sensible, and a waste.
A counter goes backwards for one reason on this hardware: the device rebooted. A reboot at a remote site, with no one there, is almost always a power event. Battery, load-shedding, a tripped breaker. That is the physical cause the operator spends their day trying to establish from WhatsApp messages, and the collector had been watching it happen and saying nothing.
What changed
The discard became an event. A reboot signal now fires on a backwards counter or on a shift in boot time, deduplicated within half an hour, and lands in a ledger with the device and the time. The hourly report shows the "reboot tell" next to an outage where there is one. It is the first witness in a cause-attribution layer that also reads the operator's own incident notes, where phrases like "it is a battery issue" were already recorded by hand, waiting for a program to take them seriously.
Every monitoring system has a few of these: signals it detects and then suppresses in the name of clean graphs. They are worth a second look.