606 lines
21 KiB
Plaintext
606 lines
21 KiB
Plaintext
-- *****************************************************************
|
|
-- CISCO-SYSLOG-MIB.my: Cisco syslog message MIB file
|
|
--
|
|
-- August 1995, Scott Mordock
|
|
--
|
|
-- Copyright (c) 1995-1997, 2005 by cisco Systems, Inc.
|
|
-- All rights reserved.
|
|
-- *****************************************************************
|
|
--
|
|
|
|
-- This MIB provides a means to gather syslog messages generated
|
|
-- by the Cisco IOS
|
|
|
|
-- Terminology:
|
|
-- Various textual messages are generated by the Cisco IOS. The IOS
|
|
-- can be configured such that these messages are sent to a "syslog"
|
|
-- server. With this MIB these same messages can also be received via
|
|
-- the SNMP. These messages are hereupon referred to as "syslog
|
|
-- messages" in this document. Note: Messages generated as a result
|
|
-- of entering CLI debug commands are not made available via the SNMP
|
|
-- at this time.
|
|
--
|
|
-- All IOS syslog messages have the following attributes:
|
|
-- timestamp (optional), facility name (where the message came
|
|
-- from), severity, message name, message text
|
|
--
|
|
-- The following example is often seen:
|
|
-- %SYS-5-CONFIG_I: Configured from console ...
|
|
-- where facility=SYS, severity=5, message name=CONFIG_I
|
|
|
|
CISCO-SYSLOG-MIB DEFINITIONS ::= BEGIN
|
|
|
|
IMPORTS
|
|
MODULE-IDENTITY,
|
|
NOTIFICATION-TYPE,
|
|
OBJECT-TYPE,
|
|
Integer32,
|
|
Counter32,
|
|
Unsigned32
|
|
FROM SNMPv2-SMI
|
|
TEXTUAL-CONVENTION,
|
|
DisplayString,
|
|
TimeStamp,
|
|
TruthValue,
|
|
RowStatus
|
|
FROM SNMPv2-TC
|
|
MODULE-COMPLIANCE,
|
|
OBJECT-GROUP,
|
|
NOTIFICATION-GROUP
|
|
FROM SNMPv2-CONF
|
|
SnmpAdminString
|
|
FROM SNMP-FRAMEWORK-MIB
|
|
ciscoMgmt
|
|
FROM CISCO-SMI
|
|
InetAddress,
|
|
InetAddressType
|
|
FROM INET-ADDRESS-MIB;
|
|
|
|
ciscoSyslogMIB MODULE-IDENTITY
|
|
LAST-UPDATED "200512030000Z"
|
|
ORGANIZATION "Cisco Systems, Inc."
|
|
CONTACT-INFO
|
|
" Cisco Systems
|
|
Customer Service
|
|
|
|
Postal: 170 W Tasman Drive
|
|
San Jose, CA 95134
|
|
USA
|
|
|
|
Tel: +1 800 553-NETS
|
|
|
|
E-mail: cs-snmp@cisco.com"
|
|
DESCRIPTION
|
|
"The MIB module to describe and store the system
|
|
messages generated by the IOS and any other
|
|
OS which supports syslogs."
|
|
REVISION "200512030000Z"
|
|
DESCRIPTION
|
|
"Removed UNITS clause for clogOriginIDType
|
|
as UNITS clause is not applicable."
|
|
|
|
REVISION "200508110000Z"
|
|
DESCRIPTION
|
|
"Added following objects:
|
|
clogOriginIDType
|
|
clogOriginID"
|
|
|
|
REVISION "200506010000Z"
|
|
DESCRIPTION
|
|
"Added clogServerGroup."
|
|
REVISION "9508070000Z"
|
|
DESCRIPTION
|
|
"Initial version of this MIB module."
|
|
::= { ciscoMgmt 41 }
|
|
|
|
ciscoSyslogMIBObjects OBJECT IDENTIFIER ::= { ciscoSyslogMIB 1 }
|
|
|
|
-- Subgroups
|
|
|
|
clogBasic OBJECT IDENTIFIER ::= { ciscoSyslogMIBObjects 1 }
|
|
clogHistory OBJECT IDENTIFIER ::= { ciscoSyslogMIBObjects 2 }
|
|
clogServer OBJECT IDENTIFIER ::= { ciscoSyslogMIBObjects 3 }
|
|
|
|
-- Textual Conventions
|
|
|
|
SyslogSeverity ::= TEXTUAL-CONVENTION
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The severity of a syslog message. The enumeration
|
|
values are equal to the values that syslog uses + 1.
|
|
For example, with syslog, emergency=0.
|
|
|
|
'emergency' : system is unusable
|
|
'alert' : action must be taken immediately
|
|
'critical' : critical conditions
|
|
'error' : error conditions
|
|
'warning' : warning conditions
|
|
'notice' : normal but significant condition
|
|
'informational': informational messages
|
|
'debug' : debug-level messages."
|
|
REFERENCE
|
|
"RFC 3164, Section 4.1 - syslog Message Parts"
|
|
SYNTAX INTEGER { emergency(1),
|
|
alert(2),
|
|
critical(3),
|
|
error(4),
|
|
warning(5),
|
|
notice(6),
|
|
info(7),
|
|
debug(8)
|
|
}
|
|
|
|
-- Basic syslog objects
|
|
|
|
clogNotificationsSent OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
UNITS "notifications"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of clogMessageGenerated notifications that
|
|
have been sent. This number may include notifications
|
|
that were prevented from being transmitted due to
|
|
reasons such as resource limitations and/or
|
|
non-connectivity. If one is receiving notifications,
|
|
one can periodically poll this object to determine if
|
|
any notifications were missed. If so, a poll of the
|
|
clogHistoryTable might be appropriate."
|
|
::= { clogBasic 1 }
|
|
|
|
clogNotificationsEnabled OBJECT-TYPE
|
|
SYNTAX TruthValue
|
|
MAX-ACCESS read-write
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Indicates whether clogMessageGenerated notifications
|
|
will or will not be sent when a syslog message is
|
|
generated by the device. Disabling notifications
|
|
does not prevent syslog messages from being added
|
|
to the clogHistoryTable."
|
|
DEFVAL { false }
|
|
::= { clogBasic 2 }
|
|
|
|
clogMaxSeverity OBJECT-TYPE
|
|
SYNTAX SyslogSeverity
|
|
MAX-ACCESS read-write
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Indicates which syslog severity levels will be
|
|
processed. Any syslog message with a severity value
|
|
greater than this value will be ignored by the agent.
|
|
note: severity numeric values increase as their
|
|
severity decreases, e.g. 'error' is more severe than
|
|
'debug'."
|
|
DEFVAL { warning }
|
|
::= { clogBasic 3 }
|
|
|
|
clogMsgIgnores OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
UNITS "messages"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of syslog messages which were ignored. A
|
|
message will be ignored if it has a severity value
|
|
greater than clogMaxSeverity."
|
|
::= { clogBasic 4 }
|
|
|
|
clogMsgDrops OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
UNITS "messages"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of syslog messages which could not be
|
|
processed due to lack of system resources. Most
|
|
likely this will occur at the same time that syslog
|
|
messages are generated to indicate this lack of
|
|
resources. Increases in this object's value may serve
|
|
as an indication that system resource levels should be
|
|
examined via other mib objects. A message that is
|
|
dropped will not appear in the history table and
|
|
no notification will be sent for this message."
|
|
::= { clogBasic 5 }
|
|
|
|
clogOriginIDType OBJECT-TYPE
|
|
SYNTAX INTEGER {
|
|
none (1),
|
|
other (2),
|
|
hostName (3),
|
|
ipv4Address (4),
|
|
contextName (5),
|
|
userDefined (6)
|
|
}
|
|
MAX-ACCESS read-write
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This object identifies the type of value that
|
|
will be contained in clogOriginID object.
|
|
|
|
The possible value(s) are:
|
|
'none' : do not send origin identifier in
|
|
syslog messages.
|
|
'other' : type that is not identified by other
|
|
values specified in this object.
|
|
'hostName' : Send hostname of the system in syslog
|
|
messages.
|
|
'ipv4Address': Send IP address of the sending interface.
|
|
'contextName': Send context name of the security device.
|
|
'userDefined': Send user configured string in
|
|
syslog message.
|
|
|
|
The value 'other' and 'none' can not be set but
|
|
can only be read."
|
|
DEFVAL { none }
|
|
::= { clogBasic 6 }
|
|
|
|
clogOriginID OBJECT-TYPE
|
|
SYNTAX SnmpAdminString
|
|
MAX-ACCESS read-write
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This object is used for configuring the
|
|
origin identifier for the syslog messages.
|
|
|
|
The origin identifier is useful for identifying
|
|
the source of system logging messages in cases
|
|
syslog messages from multiple devices are sent
|
|
to a single syslog host.
|
|
The origin identifier is added to the beginning of
|
|
all system logging (syslog) messages sent to remote
|
|
hosts.
|
|
|
|
The type of the identifier is specified
|
|
by clogOriginIDType object.
|
|
|
|
This object can be written by the SNMP manager
|
|
only when clogOriginIDType is set to 'userDefined'.
|
|
|
|
For following value(s) of clogOriginIDType,
|
|
this object can not be set; the value of this
|
|
object is derived by the system in these cases:
|
|
'contextName'
|
|
'ipv4Address'
|
|
'hostName'
|
|
'other'
|
|
'none'
|
|
|
|
This object contains the context name
|
|
of the device, when clogOriginIDType is
|
|
set to 'contextName'.
|
|
|
|
This object contains IPv4 address
|
|
(in dotted decimal notation) of the sending
|
|
interface when clogOriginIDType is set to
|
|
'ipv4Address'.
|
|
|
|
This object contains hostname of the system
|
|
when clogOriginIDType is set to 'hostName'.
|
|
|
|
This object will contain zero length
|
|
octet string when clogOriginIDType is
|
|
either 'none' or 'other'."
|
|
DEFVAL { "" }
|
|
::= { clogBasic 7 }
|
|
|
|
-- Syslog message history table
|
|
|
|
clogHistTableMaxLength OBJECT-TYPE
|
|
SYNTAX Integer32 (0..500)
|
|
UNITS "entries"
|
|
MAX-ACCESS read-write
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The upper limit on the number of entries that the
|
|
clogHistoryTable may contain. A value of 0 will
|
|
prevent any history from being retained. When this
|
|
table is full, the oldest entry will be deleted and
|
|
a new one will be created."
|
|
DEFVAL { 1 }
|
|
::= { clogHistory 1 }
|
|
|
|
clogHistMsgsFlushed OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
UNITS "messages"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of entries that have been removed from
|
|
the clogHistoryTable in order to make room for new
|
|
entries. This object can be utilized to determine
|
|
whether your polling frequency on the history table
|
|
is fast enough and/or the size of your history table
|
|
is large enough such that you are not missing
|
|
messages."
|
|
::= { clogHistory 2 }
|
|
|
|
clogHistoryTable OBJECT-TYPE
|
|
SYNTAX SEQUENCE OF ClogHistoryEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A table of syslog messages generated by this device.
|
|
All 'interesting' syslog messages (i.e. severity <=
|
|
clogMaxSeverity) are entered into this table."
|
|
::= { clogHistory 3 }
|
|
|
|
clogHistoryEntry OBJECT-TYPE
|
|
SYNTAX ClogHistoryEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A syslog message that was previously generated by this
|
|
device. Each entry is indexed by a message index."
|
|
INDEX { clogHistIndex }
|
|
::= { clogHistoryTable 1 }
|
|
|
|
ClogHistoryEntry ::=
|
|
SEQUENCE {
|
|
clogHistIndex Integer32,
|
|
clogHistFacility DisplayString,
|
|
clogHistSeverity SyslogSeverity,
|
|
clogHistMsgName DisplayString,
|
|
clogHistMsgText DisplayString,
|
|
clogHistTimestamp TimeStamp
|
|
}
|
|
|
|
clogHistIndex OBJECT-TYPE
|
|
SYNTAX Integer32 (1..2147483647)
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A monotonically increasing integer for the sole
|
|
purpose of indexing messages. When it reaches the
|
|
maximum value the agent flushes the table and wraps
|
|
the value back to 1."
|
|
::= { clogHistoryEntry 1 }
|
|
|
|
clogHistFacility OBJECT-TYPE
|
|
SYNTAX DisplayString (SIZE (1..20))
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Name of the facility that generated this message.
|
|
For example: 'SYS'."
|
|
::= { clogHistoryEntry 2 }
|
|
|
|
clogHistSeverity OBJECT-TYPE
|
|
SYNTAX SyslogSeverity
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The severity of the message."
|
|
::= { clogHistoryEntry 3 }
|
|
|
|
clogHistMsgName OBJECT-TYPE
|
|
SYNTAX DisplayString (SIZE (1..30))
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A textual identification for the message type.
|
|
A facility name in conjunction with a message name
|
|
uniquely identifies a message type."
|
|
::= { clogHistoryEntry 4 }
|
|
|
|
clogHistMsgText OBJECT-TYPE
|
|
SYNTAX DisplayString (SIZE (1..255))
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The text of the message. If the text of the message
|
|
exceeds 255 bytes, the message will be truncated to
|
|
254 bytes and a '*' character will be appended -
|
|
indicating that the message has been truncated."
|
|
::= { clogHistoryEntry 5 }
|
|
|
|
clogHistTimestamp OBJECT-TYPE
|
|
SYNTAX TimeStamp
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The value of sysUpTime when this message was
|
|
generated."
|
|
::= { clogHistoryEntry 6 }
|
|
|
|
clogMaxServers OBJECT-TYPE
|
|
SYNTAX Unsigned32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The maximum number of syslog servers that can be
|
|
configured for the system in clogServerConfigTable.
|
|
|
|
A value of zero for this object indicates there is
|
|
no specified limit for the system and is only dictated
|
|
by system resources."
|
|
::= { clogServer 1 }
|
|
|
|
|
|
clogServerConfigTable OBJECT-TYPE
|
|
SYNTAX SEQUENCE OF ClogServerConfigEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This table contains entries that allow application
|
|
to configure syslog servers for the system.
|
|
|
|
The maximum number of entries that can be created
|
|
for this table is limited by the object
|
|
clogMaxServers."
|
|
::= { clogServer 2 }
|
|
|
|
clogServerConfigEntry OBJECT-TYPE
|
|
SYNTAX ClogServerConfigEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"An entry containing information about syslog servers
|
|
configured for the system."
|
|
INDEX { clogServerAddrType,
|
|
clogServerAddr }
|
|
::= { clogServerConfigTable 1 }
|
|
|
|
ClogServerConfigEntry ::=
|
|
SEQUENCE {
|
|
clogServerAddrType InetAddressType,
|
|
clogServerAddr InetAddress,
|
|
clogServerStatus RowStatus
|
|
}
|
|
|
|
clogServerAddrType OBJECT-TYPE
|
|
SYNTAX InetAddressType
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The type of Internet address of this syslog server."
|
|
::= { clogServerConfigEntry 1 }
|
|
|
|
clogServerAddr OBJECT-TYPE
|
|
SYNTAX InetAddress (SIZE(0..64))
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The Internet address of this syslog server.
|
|
The type of this address is determined by the
|
|
value of the clogServerAddrType object."
|
|
::= { clogServerConfigEntry 2 }
|
|
|
|
clogServerStatus OBJECT-TYPE
|
|
SYNTAX RowStatus
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The status object used to manage rows in this table.
|
|
|
|
A row may only be created by setting this object to
|
|
'createAndGo'.
|
|
|
|
A row may only be deleted by setting this object to
|
|
'destroy'."
|
|
::= { clogServerConfigEntry 3 }
|
|
|
|
-- notifications
|
|
|
|
ciscoSyslogMIBNotificationPrefix OBJECT IDENTIFIER
|
|
::= { ciscoSyslogMIB 2 }
|
|
ciscoSyslogMIBNotifications OBJECT IDENTIFIER
|
|
::= { ciscoSyslogMIBNotificationPrefix 0 }
|
|
|
|
clogMessageGenerated NOTIFICATION-TYPE
|
|
OBJECTS { clogHistFacility,
|
|
clogHistSeverity,
|
|
clogHistMsgName,
|
|
clogHistMsgText,
|
|
clogHistTimestamp
|
|
}
|
|
STATUS current
|
|
DESCRIPTION
|
|
"When a syslog message is generated by the device a
|
|
clogMessageGenerated notification is sent. The
|
|
sending of these notifications can be enabled/disabled
|
|
via the clogNotificationsEnabled object."
|
|
::= { ciscoSyslogMIBNotifications 1 }
|
|
|
|
-- conformance information
|
|
|
|
ciscoSyslogMIBConformance OBJECT IDENTIFIER ::= { ciscoSyslogMIB 3 }
|
|
ciscoSyslogMIBCompliances OBJECT IDENTIFIER
|
|
::= { ciscoSyslogMIBConformance 1 }
|
|
ciscoSyslogMIBGroups OBJECT IDENTIFIER
|
|
::= { ciscoSyslogMIBConformance 2 }
|
|
|
|
|
|
-- compliance statements
|
|
|
|
ciscoSyslogMIBCompliance MODULE-COMPLIANCE
|
|
STATUS deprecated -- superceded by ciscoSyslogMIBComplianceRev1
|
|
DESCRIPTION
|
|
"The compliance statement for entities which implement
|
|
the Cisco syslog MIB."
|
|
MODULE -- this module
|
|
MANDATORY-GROUPS { ciscoSyslogMIBGroup }
|
|
::= { ciscoSyslogMIBCompliances 1 }
|
|
|
|
ciscoSyslogMIBComplianceRev1 MODULE-COMPLIANCE
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The compliance statement for entities which implement
|
|
the Cisco syslog MIB."
|
|
MODULE -- this module
|
|
MANDATORY-GROUPS { ciscoSyslogMIBGroup }
|
|
|
|
GROUP clogServerGroup
|
|
DESCRIPTION
|
|
"The implementation of this group is
|
|
mandatory for those systems where
|
|
configuration of remote syslog server hosts
|
|
is supported."
|
|
|
|
GROUP clogOriginIDGroup
|
|
DESCRIPTION
|
|
"The implementation of this group is
|
|
mandatory for those systems where
|
|
syslog origin identifier is supported."
|
|
|
|
GROUP clogNotificationsGroup
|
|
DESCRIPTION
|
|
"The implementation of this group is
|
|
mandatory for those systems where
|
|
syslog notification is supported."
|
|
::= { ciscoSyslogMIBCompliances 2 }
|
|
|
|
-- units of conformance
|
|
|
|
ciscoSyslogMIBGroup OBJECT-GROUP
|
|
OBJECTS { clogNotificationsSent,
|
|
clogNotificationsEnabled,
|
|
clogMaxSeverity,
|
|
clogMsgIgnores,
|
|
clogMsgDrops,
|
|
clogHistTableMaxLength,
|
|
clogHistMsgsFlushed,
|
|
clogHistFacility,
|
|
clogHistSeverity,
|
|
clogHistMsgName,
|
|
clogHistMsgText,
|
|
clogHistTimestamp
|
|
}
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A collection of objects providing the syslog
|
|
MIB capability."
|
|
::= { ciscoSyslogMIBGroups 1 }
|
|
|
|
clogNotificationsGroup NOTIFICATION-GROUP
|
|
NOTIFICATIONS {
|
|
clogMessageGenerated
|
|
}
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A collection of notification(s) for syslog feature."
|
|
::= { ciscoSyslogMIBGroups 2 }
|
|
|
|
clogServerGroup OBJECT-GROUP
|
|
OBJECTS {
|
|
clogMaxServers,
|
|
clogServerStatus
|
|
}
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A collection of objects providing syslog server
|
|
information for the system."
|
|
::= { ciscoSyslogMIBGroups 3 }
|
|
|
|
clogOriginIDGroup OBJECT-GROUP
|
|
OBJECTS {
|
|
clogOriginIDType,
|
|
clogOriginID
|
|
}
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A collection of objects providing information
|
|
on origin of syslog messages."
|
|
::= { ciscoSyslogMIBGroups 4 }
|
|
END
|