SYSLOG-MSG-MIB DEFINITIONS ::= BEGIN IMPORTS MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE, Unsigned32, mib-2 FROM SNMPv2-SMI TEXTUAL-CONVENTION, DisplayString, TruthValue FROM SNMPv2-TC OBJECT-GROUP, NOTIFICATION-GROUP, MODULE-COMPLIANCE FROM SNMPv2-CONF SyslogFacility, SyslogSeverity FROM SYSLOG-TC-MIB; syslogMsgMib MODULE-IDENTITY LAST-UPDATED "200908130800Z" ORGANIZATION "IETF OPSAWG Working Group" CONTACT-INFO "Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de> Jacobs University Bremen Campus Ring 1 28757 Bremen Germany Alexander Clemm <alex@cisco.com> Cisco Systems 170 West Tasman Drive San Jose, CA 95134-1706 USA Anirban Karmakar <akarmaka@cisco.com> Cisco Systems India Pvt Ltd SEZ Unit, Cessna Business Park, Sarjapur Marathahalli ORR, Bangalore, Karnataka 560103 India" DESCRIPTION "This MIB module represents SYSLOG messages as SNMP objects. Copyright (c) 2009 IETF Trust and the persons identified as authors of the code. All rights reserved. Redistribution and use in source and binary forms, with or without modification, is permitted pursuant to, and subject to the license terms contained in, the Simplified BSD License set forth in Section 4.c of the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info). This version of this MIB module is part of RFC 5676; see the RFC itself for full legal notices." REVISION "200908130800Z" DESCRIPTION "Initial version issued as part of RFC 5676." ::= { mib-2 192 } -- textual convention definitions SyslogTimeStamp ::= TEXTUAL-CONVENTION DISPLAY-HINT "2d-1d-1d,1d:1d:1d.3d,1a1d:1d" STATUS current DESCRIPTION "A date-time specification. This type is similar to the DateAndTime type defined in the SNMPv2-TC, except the subsecond granulation is microseconds instead of deciseconds and a zero-length string can be used to indicate a missing value. field octets contents range ----- ------ -------- ----- 1 1-2 year* 0..65536 2 3 month 1..12 3 4 day 1..31 4 5 hour 0..23 5 6 minutes 0..59 6 7 seconds 0..60 (use 60 for leap-second) 7 8-10 microseconds* 0..999999 8 11 direction from UTC '+' / '-' 9 12 hours from UTC* 0..13 10 13 minutes from UTC 0..59 * Notes: - the value of year is in network-byte order - the value of microseconds is in network-byte order - daylight saving time in New Zealand is +13 For example, Tuesday May 26, 1992 at 1:30:15 PM EDT would be displayed as: 1992-5-26,13:30:15.0,-4:0 Note that if only local time is known, then timezone information (fields 11-13) is not present." SYNTAX OCTET STRING (SIZE (0 | 10 | 13)) SyslogParamValueString ::= TEXTUAL-CONVENTION DISPLAY-HINT "65535t" STATUS current DESCRIPTION "The value of a SYSLOG SD-PARAM is represented using the ISO/IEC IS 10646-1 character set, encoded as an octet string using the UTF-8 transformation format described in RFC 3629. Since additional code points are added by amendments to the 10646 standard from time to time, implementations must be prepared to encounter any code point from 0x00000000 to 0x7fffffff. Byte sequences that do not correspond to the valid UTF-8 encoding of a code point or that are outside this range are prohibited. Similarly, overlong UTF-8 sequences are prohibited. UTF-8 may require multiple bytes to represent a single character / code point; thus, the length of this object in octets may be different from the number of characters encoded. Similarly, size constraints refer to the number of encoded octets, not the number of characters represented by an encoding." REFERENCE "RFC 3629: UTF-8, a transformation format of ISO 10646" SYNTAX OCTET STRING -- object definitions syslogMsgNotifications OBJECT IDENTIFIER ::= { syslogMsgMib 0 } syslogMsgObjects OBJECT IDENTIFIER ::= { syslogMsgMib 1 } syslogMsgConformance OBJECT IDENTIFIER ::= { syslogMsgMib 2 } syslogMsgControl OBJECT IDENTIFIER ::= { syslogMsgObjects 1 } syslogMsgTableMaxSize OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-write STATUS current DESCRIPTION "The maximum number of SYSLOG messages that may be held in syslogMsgTable. A particular setting does not guarantee that there is sufficient memory available for the maximum number of table entries indicated by this object. A value of 0 means no fixed limit. If an application reduces the limit while there are SYSLOG messages in the syslogMsgTable, the SYSLOG messages that are in the syslogMsgTable for the longest time MUST be discarded to bring the table down to the new limit. The value of this object should be kept in nonvolatile memory." DEFVAL { 0 } ::= { syslogMsgControl 1 } syslogMsgEnableNotifications OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Indicates whether syslogMsgNotification notifications are generated. The value of this object should be kept in nonvolatile memory." DEFVAL { false } ::= { syslogMsgControl 2 } syslogMsgTable OBJECT-TYPE SYNTAX SEQUENCE OF SyslogMsgEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A table containing recent SYSLOG messages. The size of the table is controlled by the syslogMsgTableMaxSize object." ::= { syslogMsgObjects 2 } syslogMsgEntry OBJECT-TYPE SYNTAX SyslogMsgEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry of the syslogMsgTable." INDEX { syslogMsgIndex } ::= { syslogMsgTable 1 } SyslogMsgEntry ::= SEQUENCE { syslogMsgIndex Unsigned32, syslogMsgFacility SyslogFacility, syslogMsgSeverity SyslogSeverity, syslogMsgVersion Unsigned32, syslogMsgTimeStamp SyslogTimeStamp, syslogMsgHostName DisplayString, syslogMsgAppName DisplayString, syslogMsgProcID DisplayString, syslogMsgMsgID DisplayString, syslogMsgSDParams Unsigned32, syslogMsgMsg OCTET STRING } syslogMsgIndex OBJECT-TYPE SYNTAX Unsigned32 (1..4294967295) MAX-ACCESS not-accessible STATUS current DESCRIPTION "A monotonically increasing number used to identify entries in the syslogMsgTable. When syslogMsgIndex reaches the maximum value (4294967295), the value wraps back to 1. Applications periodically polling the syslogMsgTable for new entries should take into account that a complete rollover of syslogMsgIndex will happen if more than 4294967294 messages are received during a poll interval." ::= { syslogMsgEntry 1 } syslogMsgFacility OBJECT-TYPE SYNTAX SyslogFacility MAX-ACCESS read-only STATUS current DESCRIPTION "The facility of the SYSLOG message." REFERENCE "RFC 5424: The Syslog Protocol (Section 6.2.1) RFC 5427: Textual Conventions for Syslog Management" ::= { syslogMsgEntry 2 } syslogMsgSeverity OBJECT-TYPE SYNTAX SyslogSeverity MAX-ACCESS read-only STATUS current DESCRIPTION "The severity of the SYSLOG message" REFERENCE "RFC 5424: The Syslog Protocol (Section 6.2.1) RFC 5427: Textual Conventions for Syslog Management" ::= { syslogMsgEntry 3 } syslogMsgVersion OBJECT-TYPE SYNTAX Unsigned32 (0..999) MAX-ACCESS read-only STATUS current DESCRIPTION "The version of the SYSLOG message. A value of 0 indicates that the version is unknown." REFERENCE "RFC 5424: The Syslog Protocol (Section 6.2.2)" ::= { syslogMsgEntry 4 } syslogMsgTimeStamp OBJECT-TYPE SYNTAX SyslogTimeStamp MAX-ACCESS read-only STATUS current DESCRIPTION "The timestamp of the SYSLOG message. A zero-length string is returned if the timestamp is unknown." REFERENCE "RFC 5424: The Syslog Protocol (Section 6.2.3)" ::= { syslogMsgEntry 5 } syslogMsgHostName OBJECT-TYPE SYNTAX DisplayString (SIZE (0..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The hostname and the (optional) domain name of the SYSLOG message. A zero-length string indicates an unknown hostname. The SYSLOG protocol specification constrains this string to printable US-ASCII code points." REFERENCE "RFC 5424: The Syslog Protocol (Section 6.2.4)" ::= { syslogMsgEntry 6 } syslogMsgAppName OBJECT-TYPE SYNTAX DisplayString (SIZE (0..48)) MAX-ACCESS read-only STATUS current DESCRIPTION "The app-name of the SYSLOG message. A zero-length string indicates an unknown app-name. The SYSLOG protocol specification constrains this string to printable US-ASCII code points." REFERENCE "RFC 5424: The Syslog Protocol (Section 6.2.5)" ::= { syslogMsgEntry 7 } syslogMsgProcID OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The procid of the SYSLOG message. A zero-length string indicates an unknown procid. The SYSLOG protocol specification constrains this string to printable US-ASCII code points." REFERENCE "RFC 5424: The Syslog Protocol (Section 6.2.6)" ::= { syslogMsgEntry 8 } syslogMsgMsgID OBJECT-TYPE SYNTAX DisplayString (SIZE (0..32)) MAX-ACCESS read-only STATUS current DESCRIPTION "The msgid of the SYSLOG message. A zero-length string indicates an unknown msgid. The SYSLOG protocol specification constrains this string to printable US-ASCII code points." REFERENCE "RFC 5424: The Syslog Protocol (Section 6.2.7)" ::= { syslogMsgEntry 9 } syslogMsgSDParams OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of structured data element parameters carried in the SYSLOG message. This number effectively indicates the number of entries in the syslogMsgSDTable. It can be used, for example, by a notification receiver to determine whether a notification carried all structured data element parameters of a SYSLOG message." ::= { syslogMsgEntry 10 } syslogMsgMsg OBJECT-TYPE SYNTAX OCTET STRING MAX-ACCESS read-only STATUS current DESCRIPTION "The message part of the SYSLOG message. The syntax does not impose a size restriction. Implementations of this MIB module may truncate the message part of the SYSLOG message such that it fits into the size constraints imposed by the implementation environment. Such truncations can also happen elsewhere in the SYSLOG forwarding chain. If the first octets contain the value 'EFBBBF'h, then the rest of the message is a UTF-8 string. Since SYSLOG messages may be truncated at arbitrary octet boundaries during forwarding, the message may contain invalid UTF-8 encodings at the end." REFERENCE "RFC 5424: The Syslog Protocol (Sections 6.1 and 6.4)" ::= { syslogMsgEntry 11 } syslogMsgSDTable OBJECT-TYPE SYNTAX SEQUENCE OF SyslogMsgSDEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A table containing structured data elements of SYSLOG messages." ::= { syslogMsgObjects 3 } syslogMsgSDEntry OBJECT-TYPE SYNTAX SyslogMsgSDEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry of the syslogMsgSDTable." INDEX { syslogMsgIndex, syslogMsgSDParamIndex, syslogMsgSDID, syslogMsgSDParamName } ::= { syslogMsgSDTable 1 } SyslogMsgSDEntry ::= SEQUENCE { syslogMsgSDParamIndex Unsigned32, syslogMsgSDID DisplayString, syslogMsgSDParamName DisplayString, syslogMsgSDParamValue SyslogParamValueString } syslogMsgSDParamIndex OBJECT-TYPE SYNTAX Unsigned32 (1..4294967295) MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object indexes the structured data element parameters contained in a SYSLOG message. The first structured data element parameter has the index value 1, and subsequent parameters are indexed by incrementing the index of the previous parameter. The index increases across structured data element boundaries so that the value reflects the position of a structured data element parameter in a SYSLOG message." REFERENCE "RFC 5424: The Syslog Protocol (Section 6.3.3)" ::= { syslogMsgSDEntry 1 } syslogMsgSDID OBJECT-TYPE SYNTAX DisplayString (SIZE (1..32)) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The name (SD-ID) of a structured data element. The SYSLOG protocol specification constrains this string to printable US-ASCII code points." REFERENCE "RFC 5424: The Syslog Protocol (Section 6.3.2)" ::= { syslogMsgSDEntry 2 } syslogMsgSDParamName OBJECT-TYPE SYNTAX DisplayString (SIZE (1..32)) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The name of a parameter of the structured data element. The SYSLOG protocol specification constrains this string to printable US-ASCII code points." REFERENCE "RFC 5424: The Syslog Protocol (Section 6.3.3)" ::= { syslogMsgSDEntry 3 } syslogMsgSDParamValue OBJECT-TYPE SYNTAX SyslogParamValueString MAX-ACCESS read-only STATUS current DESCRIPTION "The value of the parameter of a SYSLOG message identified by the index of this table. The value is stored in the unescaped format." REFERENCE "RFC 5424: The Syslog Protocol (Section 6.3.3)" ::= { syslogMsgSDEntry 4 } -- notification definitions syslogMsgNotification NOTIFICATION-TYPE OBJECTS { syslogMsgFacility, syslogMsgSeverity, syslogMsgVersion, syslogMsgTimeStamp, syslogMsgHostName, syslogMsgAppName, syslogMsgProcID, syslogMsgMsgID, syslogMsgSDParams, syslogMsgMsg } STATUS current DESCRIPTION "The syslogMsgNotification is generated when a new SYSLOG message is received and the value of syslogMsgGenerateNotifications is true. Implementations may add syslogMsgSDParamValue objects as long as the resulting notification fits into the size constraints imposed by the implementation environment and the notification message size constraints imposed by maxMessageSize [RFC3412] and SNMP transport mappings." ::= { syslogMsgNotifications 1 } -- conformance statements syslogMsgGroups OBJECT IDENTIFIER ::= { syslogMsgConformance 1 } syslogMsgCompliances OBJECT IDENTIFIER ::= { syslogMsgConformance 2 } syslogMsgFullCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "The compliance statement for implementations of the SYSLOG-MSG-MIB." MODULE -- this module MANDATORY-GROUPS { syslogMsgGroup, syslogMsgSDGroup, syslogMsgControlGroup, syslogMsgNotificationGroup } ::= { syslogMsgCompliances 1 } syslogMsgReadOnlyCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "The compliance statement for implementations of the SYSLOG-MSG-MIB that do not support read-write access." MODULE -- this module MANDATORY-GROUPS { syslogMsgGroup, syslogMsgSDGroup, syslogMsgControlGroup, syslogMsgNotificationGroup } OBJECT syslogMsgTableMaxSize MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT syslogMsgEnableNotifications MIN-ACCESS read-only DESCRIPTION "Write access is not required." ::= { syslogMsgCompliances 2 } syslogMsgNotificationCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "The compliance statement for implementations of the SYSLOG-MSG-MIB that do only generate notifications and do not provide a table to allow read access to SYSLOG message details." MODULE -- this module MANDATORY-GROUPS { syslogMsgGroup, syslogMsgSDGroup, syslogMsgNotificationGroup } OBJECT syslogMsgFacility MIN-ACCESS accessible-for-notify DESCRIPTION "Read access is not required." OBJECT syslogMsgSeverity MIN-ACCESS accessible-for-notify DESCRIPTION "Read access is not required." OBJECT syslogMsgVersion MIN-ACCESS accessible-for-notify DESCRIPTION "Read access is not required." OBJECT syslogMsgTimeStamp MIN-ACCESS accessible-for-notify DESCRIPTION "Read access is not required." OBJECT syslogMsgHostName MIN-ACCESS accessible-for-notify DESCRIPTION "Read access is not required." OBJECT syslogMsgAppName MIN-ACCESS accessible-for-notify DESCRIPTION "Read access is not required." OBJECT syslogMsgProcID MIN-ACCESS accessible-for-notify DESCRIPTION "Read access is not required." OBJECT syslogMsgMsgID MIN-ACCESS accessible-for-notify DESCRIPTION "Read access is not required." OBJECT syslogMsgSDParams MIN-ACCESS accessible-for-notify DESCRIPTION "Read access is not required." OBJECT syslogMsgMsg MIN-ACCESS accessible-for-notify DESCRIPTION "Read access is not required." OBJECT syslogMsgSDParamValue MIN-ACCESS accessible-for-notify DESCRIPTION "Read access is not required." ::= { syslogMsgCompliances 3 } syslogMsgNotificationGroup NOTIFICATION-GROUP NOTIFICATIONS { syslogMsgNotification } STATUS current DESCRIPTION "The notifications emitted by this MIB module." ::= { syslogMsgGroups 1 } syslogMsgGroup OBJECT-GROUP OBJECTS { -- syslogMsgIndex, syslogMsgFacility, syslogMsgSeverity, syslogMsgVersion, syslogMsgTimeStamp, syslogMsgHostName, syslogMsgAppName, syslogMsgProcID, syslogMsgMsgID, syslogMsgSDParams, syslogMsgMsg } STATUS current DESCRIPTION "A collection of objects representing a SYSLOG message, excluding structured data elements." ::= { syslogMsgGroups 2 } syslogMsgSDGroup OBJECT-GROUP OBJECTS { -- syslogMsgSDParamIndex, -- syslogMsgSDID, -- syslogMsgSDParamName, syslogMsgSDParamValue } STATUS current DESCRIPTION "A collection of objects representing the structured data elements of a SYSLOG message." ::= { syslogMsgGroups 3 } syslogMsgControlGroup OBJECT-GROUP OBJECTS { syslogMsgTableMaxSize, syslogMsgEnableNotifications } STATUS current DESCRIPTION "A collection of control objects to control the size of the syslogMsgTable and to enable/disable notifications." ::= { syslogMsgGroups 4 } END