With IPHost Network Monitor you can run simple snmp requests against a Cisco device in your network.
cwnChangeReason
cwn Change Reason
1.3.6.1.4.1.9.9.223.1.1.6
The reason for the most recent change of a source of network clock, as indicated by the change in the value of 'ciscoWanChangeTimeStamp'. 'none' indicates that the source of network clock has not changed. 'lossOfLock' indicates that the clock source was changed because the network clocking hardware lost lock on the previous network clock source. 'lossOfActivity' indicates that the clock source was changed because the network clocking hardware detected a loss of activity on the previous network clock source. 'ncdpRestructure' indicates that the NCDP entity has changed the clock source as a result of a network-wide network clock distribution tree restructuring process. When the reason for a clock switchover is none of the above, the value of this object is 'other'.
Back to CISCO-WAN-NCDP-MIB MIB page.
IPHost Network monitor allows you to monitor cwnChangeReason on Cisco device via the SNMP protocol. Download IPHost Network Monitor (500 monitors for 30 days, 50 monitors free forever) to start monitoring Cisco firewalls right now.