path: root/MIBS/cisco/CISCO-SYSLOG-MIB

-- *****************************************************************
-- CISCO-SYSLOG-MIB.my:  Cisco syslog message MIB file
--
-- August 1995, Scott Mordock
--
-- Copyright (c) 1995-1997, 2005 by cisco Systems, Inc.
-- All rights reserved.
-- *****************************************************************
--

-- This MIB provides a means to gather syslog messages generated
-- by the Cisco IOS

-- Terminology:
-- Various textual messages are generated by the Cisco IOS.  The IOS
-- can be configured such that these messages are sent to a "syslog"
-- server.  With this MIB these same messages can also be received via
-- the SNMP.  These messages are hereupon referred to as "syslog
-- messages" in this document. Note: Messages generated as a result
-- of entering CLI debug commands are not made available via the SNMP
-- at this time.
--
-- All IOS syslog messages have the following attributes:
--      timestamp (optional), facility name (where the message came
--      from), severity, message name, message text
--
-- The following example is often seen:
--      %SYS-5-CONFIG_I: Configured from console ...
-- where facility=SYS, severity=5, message name=CONFIG_I

CISCO-SYSLOG-MIB DEFINITIONS ::= BEGIN

IMPORTS
        MODULE-IDENTITY,
        NOTIFICATION-TYPE,
        OBJECT-TYPE,
        Integer32,
        Counter32,
        Unsigned32
                FROM SNMPv2-SMI
        TEXTUAL-CONVENTION,
        DisplayString,
        TimeStamp,
        TruthValue,
        RowStatus
                FROM SNMPv2-TC
        MODULE-COMPLIANCE,
        OBJECT-GROUP,
        NOTIFICATION-GROUP
                FROM SNMPv2-CONF
        SnmpAdminString
                FROM SNMP-FRAMEWORK-MIB
        ciscoMgmt
                FROM CISCO-SMI
        InetAddress,
        InetAddressType
                FROM INET-ADDRESS-MIB;

ciscoSyslogMIB MODULE-IDENTITY
        LAST-UPDATED        "200512030000Z"
        ORGANIZATION        "Cisco Systems, Inc."
        CONTACT-INFO
                "       Cisco Systems
                        Customer Service

                Postal: 170 W Tasman Drive
                        San Jose, CA  95134
                        USA

                   Tel: +1 800 553-NETS

                E-mail: cs-snmp@cisco.com"
        DESCRIPTION
                "The MIB module to describe and store the system
                 messages generated by the IOS and any other
                 OS which supports syslogs."
        REVISION        "200512030000Z"
        DESCRIPTION
            "Removed UNITS clause for clogOriginIDType
            as UNITS clause is not applicable."

        REVISION        "200508110000Z"
        DESCRIPTION
                "Added following objects:
                   clogOriginIDType
                   clogOriginID"

        REVISION        "200506010000Z"
        DESCRIPTION
                "Added clogServerGroup."
        REVISION        "9508070000Z"
        DESCRIPTION
                "Initial version of this MIB module."
        ::= { ciscoMgmt 41 }

ciscoSyslogMIBObjects OBJECT IDENTIFIER ::= { ciscoSyslogMIB 1 }

-- Subgroups

clogBasic        OBJECT IDENTIFIER ::= { ciscoSyslogMIBObjects 1 }
clogHistory      OBJECT IDENTIFIER ::= { ciscoSyslogMIBObjects 2 }
clogServer       OBJECT IDENTIFIER ::= { ciscoSyslogMIBObjects 3 }

-- Textual Conventions

SyslogSeverity ::= TEXTUAL-CONVENTION
       STATUS  current
       DESCRIPTION
               "The severity of a syslog message.  The enumeration
                values are equal to the values that syslog uses + 1.
                For example, with syslog, emergency=0.

                 'emergency' : system is unusable
                 'alert'     : action must be taken immediately
                 'critical'  : critical conditions
                 'error'     : error conditions
                 'warning'   : warning conditions
                 'notice'    : normal but significant condition
                 'informational': informational messages 
                 'debug'        : debug-level messages."
       REFERENCE
           "RFC 3164, Section 4.1 - syslog Message Parts"
       SYNTAX  INTEGER {    emergency(1),
                            alert(2),
                            critical(3),
                            error(4),
                            warning(5),
                            notice(6),
                            info(7),
                            debug(8)
                }

-- Basic syslog objects

clogNotificationsSent OBJECT-TYPE
        SYNTAX     Counter32
        UNITS      "notifications"
        MAX-ACCESS read-only
        STATUS     current
        DESCRIPTION
                "The number of clogMessageGenerated notifications that
                 have been sent. This number may include notifications
                 that were prevented from being transmitted due to
                 reasons such as resource limitations and/or
                 non-connectivity.  If one is receiving notifications,
                 one can periodically poll this object to determine if
                 any notifications were missed.  If so, a poll of the
                 clogHistoryTable might be appropriate."
        ::= { clogBasic 1 }

clogNotificationsEnabled OBJECT-TYPE
        SYNTAX     TruthValue
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
                "Indicates whether clogMessageGenerated notifications
                 will or will not be sent when a syslog message is
                 generated by the device.  Disabling notifications
                 does not prevent syslog messages from being added
                 to the clogHistoryTable."
        DEFVAL { false }
        ::= { clogBasic 2 }

clogMaxSeverity OBJECT-TYPE
        SYNTAX     SyslogSeverity
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
                "Indicates which syslog severity levels will be
                 processed.  Any syslog message with a severity value
                 greater than this value will be ignored by the agent.
                 note: severity numeric values increase as their
                 severity decreases, e.g. 'error' is more severe than
                 'debug'."
        DEFVAL { warning }
        ::= { clogBasic 3 }

clogMsgIgnores OBJECT-TYPE
        SYNTAX     Counter32
        UNITS      "messages"
        MAX-ACCESS read-only
        STATUS     current
        DESCRIPTION
                "The number of syslog messages which were ignored.  A
                 message will be ignored if it has a severity value
                 greater than clogMaxSeverity."
        ::= { clogBasic 4 }

clogMsgDrops OBJECT-TYPE
        SYNTAX     Counter32
        UNITS      "messages"
        MAX-ACCESS read-only
        STATUS     current
        DESCRIPTION
                "The number of syslog messages which could not be
                 processed due to lack of system resources. Most
                 likely this will occur at the same time that syslog
                 messages are generated to indicate this lack of
                 resources.  Increases in this object's value may serve
                 as an indication that system resource levels should be
                 examined via other mib objects.  A message that is
                 dropped will not appear in the history table and
                 no notification will be sent for this message."
        ::= { clogBasic 5 }

clogOriginIDType OBJECT-TYPE
        SYNTAX     INTEGER {
                       none        (1),
                       other       (2),
                       hostName    (3),
                       ipv4Address (4),
                       contextName (5),
                       userDefined (6)
                   }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "This object identifies the type of value that
            will be contained in clogOriginID object.

            The possible value(s) are:
               'none'       : do not send origin identifier in 
                              syslog messages.
               'other'      : type that is not identified by other 
                              values specified in this object.
               'hostName'   : Send hostname of the system in syslog
                              messages.
               'ipv4Address': Send IP address of the sending interface.
               'contextName': Send context name of the security device.
               'userDefined': Send user configured string in
                              syslog message.

               The value 'other' and 'none' can not be set but
               can only be read."
        DEFVAL { none }
        ::= { clogBasic 6 }

clogOriginID OBJECT-TYPE
        SYNTAX     SnmpAdminString
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
                "This object is used for configuring the
                origin identifier for the syslog messages.

                The origin identifier is useful for identifying 
                the source of system logging messages in cases 
                syslog messages from multiple devices are sent 
                to a single syslog host.
                The origin identifier is added to the beginning of
                all system logging (syslog) messages sent to remote 
                hosts.

                The type of the identifier is specified
                by clogOriginIDType object.

                This object can be written by the SNMP manager
                only when clogOriginIDType is set to 'userDefined'.

                For following value(s) of clogOriginIDType,
                this object can not be set; the value of this
                object is derived by the system in these cases:
                   'contextName' 
                   'ipv4Address'
                   'hostName'
                   'other'     
                   'none'     

                This object contains the context name
                of the device, when clogOriginIDType is 
                set to 'contextName'.

                This object contains IPv4 address
                (in dotted decimal notation) of the sending 
                interface when clogOriginIDType is set to
                'ipv4Address'.

                This object contains hostname of the system
                when clogOriginIDType is set to 'hostName'.

                This object will contain zero length
                octet string when clogOriginIDType is
                either 'none' or 'other'."
        DEFVAL { "" }
        ::= { clogBasic 7 }

-- Syslog message history table

clogHistTableMaxLength OBJECT-TYPE
        SYNTAX     Integer32 (0..500)
        UNITS      "entries"
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
                "The upper limit on the number of entries that the
                 clogHistoryTable may contain.  A value of 0 will
                 prevent any history from being retained. When this
                 table is full, the oldest entry will be deleted and
                 a new one will be created."
        DEFVAL  { 1 }
        ::= { clogHistory 1 }

clogHistMsgsFlushed OBJECT-TYPE
        SYNTAX     Counter32
        UNITS      "messages"
        MAX-ACCESS read-only
        STATUS     current
        DESCRIPTION
                "The number of entries that have been removed from
                 the clogHistoryTable in order to make room for new
                 entries. This object can be utilized to determine
                 whether your polling frequency on the history table
                 is fast enough and/or the size of your history table
                 is large enough such that you are not missing
                 messages."
        ::= { clogHistory 2 }

clogHistoryTable OBJECT-TYPE
        SYNTAX     SEQUENCE OF ClogHistoryEntry
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
                "A table of syslog messages generated by this device.
                 All 'interesting' syslog messages (i.e. severity <=
                 clogMaxSeverity) are entered into this table."
        ::= { clogHistory 3 }

clogHistoryEntry OBJECT-TYPE
        SYNTAX     ClogHistoryEntry
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
                "A syslog message that was previously generated by this
                 device. Each entry is indexed by a message index."
        INDEX   { clogHistIndex }
        ::= { clogHistoryTable 1 }

ClogHistoryEntry ::=
    SEQUENCE {
        clogHistIndex     Integer32,
        clogHistFacility  DisplayString,
        clogHistSeverity  SyslogSeverity,
        clogHistMsgName   DisplayString,
        clogHistMsgText   DisplayString,
        clogHistTimestamp TimeStamp
    }

clogHistIndex OBJECT-TYPE
        SYNTAX     Integer32 (1..2147483647)
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
                "A monotonically increasing integer for the sole
                 purpose of indexing messages.  When it reaches the
                 maximum value the agent flushes the table and wraps
                 the value back to 1."
        ::= { clogHistoryEntry 1 }

clogHistFacility OBJECT-TYPE
        SYNTAX     DisplayString (SIZE (1..20))
        MAX-ACCESS read-only
        STATUS     current
        DESCRIPTION
                "Name of the facility that generated this message.
                 For example: 'SYS'."
        ::= { clogHistoryEntry 2 }

clogHistSeverity OBJECT-TYPE
        SYNTAX     SyslogSeverity
        MAX-ACCESS read-only
        STATUS     current
        DESCRIPTION
                "The severity of the message."
        ::= { clogHistoryEntry 3 }

clogHistMsgName OBJECT-TYPE
        SYNTAX     DisplayString (SIZE (1..30))
        MAX-ACCESS read-only
        STATUS     current
        DESCRIPTION
                "A textual identification for the message type.
                 A facility name in conjunction with a message name
                 uniquely identifies a message type."
        ::= { clogHistoryEntry 4 }

clogHistMsgText OBJECT-TYPE
        SYNTAX     DisplayString (SIZE (1..255))
        MAX-ACCESS read-only
        STATUS     current
        DESCRIPTION
                "The text of the message.  If the text of the message
                 exceeds 255 bytes, the message will be truncated to
                 254 bytes and a '*' character will be appended -
                 indicating that the message has been truncated."
        ::= { clogHistoryEntry 5 }

clogHistTimestamp OBJECT-TYPE
        SYNTAX     TimeStamp
        MAX-ACCESS read-only
        STATUS     current
        DESCRIPTION
                "The value of sysUpTime when this message was
                 generated."
        ::= { clogHistoryEntry 6 }

clogMaxServers OBJECT-TYPE
        SYNTAX     Unsigned32
        MAX-ACCESS read-only
        STATUS     current
        DESCRIPTION
                "The maximum number of syslog servers that can be
                 configured for the system in clogServerConfigTable.

                 A value of zero for this object indicates there is
                 no specified limit for the system and is only dictated
                 by system resources."
        ::= { clogServer 1 }


clogServerConfigTable OBJECT-TYPE
        SYNTAX     SEQUENCE OF ClogServerConfigEntry
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
                "This table contains entries that allow application
                 to configure syslog servers for the system.

                 The maximum number of entries that can be created
                 for this table is limited by the object
                 clogMaxServers."
        ::= { clogServer 2 }

clogServerConfigEntry OBJECT-TYPE
        SYNTAX     ClogServerConfigEntry
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
                "An entry containing information about syslog servers
                 configured for the system."
        INDEX   { clogServerAddrType,
                  clogServerAddr }
        ::= { clogServerConfigTable 1 }

ClogServerConfigEntry ::=
        SEQUENCE {
                clogServerAddrType InetAddressType,
                clogServerAddr     InetAddress,
                clogServerStatus   RowStatus
        }

clogServerAddrType OBJECT-TYPE
        SYNTAX     InetAddressType
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
                "The type of Internet address of this syslog server."
        ::= { clogServerConfigEntry 1 }

clogServerAddr OBJECT-TYPE
        SYNTAX     InetAddress (SIZE(0..64))
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
                "The Internet address of this syslog server.
                 The type of this address is determined by the
                 value of the clogServerAddrType object."
        ::= { clogServerConfigEntry 2 }

clogServerStatus OBJECT-TYPE
        SYNTAX     RowStatus
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "The status object used to manage rows in this table.

                 A row may only be created by setting this object to
                 'createAndGo'.

                 A row may only be deleted by setting this object to
                 'destroy'."
        ::= { clogServerConfigEntry 3 }

-- notifications

ciscoSyslogMIBNotificationPrefix    OBJECT IDENTIFIER
                              ::= { ciscoSyslogMIB 2 }
ciscoSyslogMIBNotifications         OBJECT IDENTIFIER
                              ::= { ciscoSyslogMIBNotificationPrefix 0 }

clogMessageGenerated NOTIFICATION-TYPE
        OBJECTS { clogHistFacility,
                  clogHistSeverity,
                  clogHistMsgName,
                  clogHistMsgText,
                  clogHistTimestamp
        }
        STATUS     current
        DESCRIPTION
                "When a syslog message is generated by the device a
                 clogMessageGenerated notification is sent.  The
                 sending of these notifications can be enabled/disabled
                 via the clogNotificationsEnabled object."
        ::= { ciscoSyslogMIBNotifications 1 }

-- conformance information

ciscoSyslogMIBConformance OBJECT IDENTIFIER ::= { ciscoSyslogMIB 3 }
ciscoSyslogMIBCompliances OBJECT IDENTIFIER
                                 ::= { ciscoSyslogMIBConformance 1 }
ciscoSyslogMIBGroups      OBJECT IDENTIFIER
                                 ::= { ciscoSyslogMIBConformance 2 }


-- compliance statements

ciscoSyslogMIBCompliance MODULE-COMPLIANCE
       STATUS  deprecated -- superceded by ciscoSyslogMIBComplianceRev1
       DESCRIPTION
               "The compliance statement for entities which implement
                the Cisco syslog MIB."
       MODULE  -- this module
               MANDATORY-GROUPS { ciscoSyslogMIBGroup }
       ::= { ciscoSyslogMIBCompliances 1 }

ciscoSyslogMIBComplianceRev1 MODULE-COMPLIANCE
       STATUS  current
       DESCRIPTION
               "The compliance statement for entities which implement
                the Cisco syslog MIB."
       MODULE  -- this module
               MANDATORY-GROUPS { ciscoSyslogMIBGroup }

       GROUP clogServerGroup
       DESCRIPTION
           "The implementation of this group is
           mandatory for those systems where
           configuration of remote syslog server hosts 
           is supported."

       GROUP clogOriginIDGroup
       DESCRIPTION
           "The implementation of this group is
           mandatory for those systems where
           syslog origin identifier is supported."

       GROUP clogNotificationsGroup
       DESCRIPTION
           "The implementation of this group is
           mandatory for those systems where
           syslog notification is supported."
       ::= { ciscoSyslogMIBCompliances 2 }
     
-- units of conformance

ciscoSyslogMIBGroup OBJECT-GROUP
       OBJECTS { clogNotificationsSent,
                 clogNotificationsEnabled,
                 clogMaxSeverity,
                 clogMsgIgnores,
                 clogMsgDrops,
                 clogHistTableMaxLength,
                 clogHistMsgsFlushed,
                 clogHistFacility,
                 clogHistSeverity,
                 clogHistMsgName,
                 clogHistMsgText,
                 clogHistTimestamp
       }
       STATUS  current
       DESCRIPTION
               "A collection of objects providing the syslog
                MIB capability."
      ::= { ciscoSyslogMIBGroups 1 }

clogNotificationsGroup NOTIFICATION-GROUP
       NOTIFICATIONS {
               clogMessageGenerated
       }
       STATUS  current
       DESCRIPTION
               "A collection of notification(s) for syslog feature."
       ::= { ciscoSyslogMIBGroups 2 }

clogServerGroup OBJECT-GROUP
       OBJECTS {
               clogMaxServers,
               clogServerStatus
       }
       STATUS  current
       DESCRIPTION
               "A collection of objects providing syslog server
                information for the system."
      ::= { ciscoSyslogMIBGroups 3 }

clogOriginIDGroup OBJECT-GROUP
       OBJECTS {
               clogOriginIDType,
               clogOriginID
       }
       STATUS  current
       DESCRIPTION
               "A collection of objects providing information
               on origin of syslog messages."
      ::= { ciscoSyslogMIBGroups 4 }
END