-- ***************************************************************** -- CISCO-SYSLOG-MIB.my: Cisco syslog message MIB file -- -- August 1995, Scott Mordock -- -- Copyright (c) 1995-1997, 2005 by cisco Systems, Inc. -- All rights reserved. -- ***************************************************************** -- -- This MIB provides a means to gather syslog messages generated -- by the Cisco IOS -- Terminology: -- Various textual messages are generated by the Cisco IOS. The IOS -- can be configured such that these messages are sent to a "syslog" -- server. With this MIB these same messages can also be received via -- the SNMP. These messages are hereupon referred to as "syslog -- messages" in this document. Note: Messages generated as a result -- of entering CLI debug commands are not made available via the SNMP -- at this time. -- -- All IOS syslog messages have the following attributes: -- timestamp (optional), facility name (where the message came -- from), severity, message name, message text -- -- The following example is often seen: -- %SYS-5-CONFIG_I: Configured from console ... -- where facility=SYS, severity=5, message name=CONFIG_I CISCO-SYSLOG-MIB DEFINITIONS ::= BEGIN IMPORTS MODULE-IDENTITY, NOTIFICATION-TYPE, OBJECT-TYPE, Integer32, Counter32, Unsigned32 FROM SNMPv2-SMI TEXTUAL-CONVENTION, DisplayString, TimeStamp, TruthValue, RowStatus FROM SNMPv2-TC MODULE-COMPLIANCE, OBJECT-GROUP, NOTIFICATION-GROUP FROM SNMPv2-CONF SnmpAdminString FROM SNMP-FRAMEWORK-MIB ciscoMgmt FROM CISCO-SMI InetAddress, InetAddressType FROM INET-ADDRESS-MIB; ciscoSyslogMIB MODULE-IDENTITY LAST-UPDATED "200512030000Z" ORGANIZATION "Cisco Systems, Inc." CONTACT-INFO " Cisco Systems Customer Service Postal: 170 W Tasman Drive San Jose, CA 95134 USA Tel: +1 800 553-NETS E-mail: cs-snmp@cisco.com" DESCRIPTION "The MIB module to describe and store the system messages generated by the IOS and any other OS which supports syslogs." REVISION "200512030000Z" DESCRIPTION "Removed UNITS clause for clogOriginIDType as UNITS clause is not applicable." REVISION "200508110000Z" DESCRIPTION "Added following objects: clogOriginIDType clogOriginID" REVISION "200506010000Z" DESCRIPTION "Added clogServerGroup." REVISION "9508070000Z" DESCRIPTION "Initial version of this MIB module." ::= { ciscoMgmt 41 } ciscoSyslogMIBObjects OBJECT IDENTIFIER ::= { ciscoSyslogMIB 1 } -- Subgroups clogBasic OBJECT IDENTIFIER ::= { ciscoSyslogMIBObjects 1 } clogHistory OBJECT IDENTIFIER ::= { ciscoSyslogMIBObjects 2 } clogServer OBJECT IDENTIFIER ::= { ciscoSyslogMIBObjects 3 } -- Textual Conventions SyslogSeverity ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "The severity of a syslog message. The enumeration values are equal to the values that syslog uses + 1. For example, with syslog, emergency=0. 'emergency' : system is unusable 'alert' : action must be taken immediately 'critical' : critical conditions 'error' : error conditions 'warning' : warning conditions 'notice' : normal but significant condition 'informational': informational messages 'debug' : debug-level messages." REFERENCE "RFC 3164, Section 4.1 - syslog Message Parts" SYNTAX INTEGER { emergency(1), alert(2), critical(3), error(4), warning(5), notice(6), info(7), debug(8) } -- Basic syslog objects clogNotificationsSent OBJECT-TYPE SYNTAX Counter32 UNITS "notifications" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of clogMessageGenerated notifications that have been sent. This number may include notifications that were prevented from being transmitted due to reasons such as resource limitations and/or non-connectivity. If one is receiving notifications, one can periodically poll this object to determine if any notifications were missed. If so, a poll of the clogHistoryTable might be appropriate." ::= { clogBasic 1 } clogNotificationsEnabled OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Indicates whether clogMessageGenerated notifications will or will not be sent when a syslog message is generated by the device. Disabling notifications does not prevent syslog messages from being added to the clogHistoryTable." DEFVAL { false } ::= { clogBasic 2 } clogMaxSeverity OBJECT-TYPE SYNTAX SyslogSeverity MAX-ACCESS read-write STATUS current DESCRIPTION "Indicates which syslog severity levels will be processed. Any syslog message with a severity value greater than this value will be ignored by the agent. note: severity numeric values increase as their severity decreases, e.g. 'error' is more severe than 'debug'." DEFVAL { warning } ::= { clogBasic 3 } clogMsgIgnores OBJECT-TYPE SYNTAX Counter32 UNITS "messages" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of syslog messages which were ignored. A message will be ignored if it has a severity value greater than clogMaxSeverity." ::= { clogBasic 4 } clogMsgDrops OBJECT-TYPE SYNTAX Counter32 UNITS "messages" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of syslog messages which could not be processed due to lack of system resources. Most likely this will occur at the same time that syslog messages are generated to indicate this lack of resources. Increases in this object's value may serve as an indication that system resource levels should be examined via other mib objects. A message that is dropped will not appear in the history table and no notification will be sent for this message." ::= { clogBasic 5 } clogOriginIDType OBJECT-TYPE SYNTAX INTEGER { none (1), other (2), hostName (3), ipv4Address (4), contextName (5), userDefined (6) } MAX-ACCESS read-write STATUS current DESCRIPTION "This object identifies the type of value that will be contained in clogOriginID object. The possible value(s) are: 'none' : do not send origin identifier in syslog messages. 'other' : type that is not identified by other values specified in this object. 'hostName' : Send hostname of the system in syslog messages. 'ipv4Address': Send IP address of the sending interface. 'contextName': Send context name of the security device. 'userDefined': Send user configured string in syslog message. The value 'other' and 'none' can not be set but can only be read." DEFVAL { none } ::= { clogBasic 6 } clogOriginID OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-write STATUS current DESCRIPTION "This object is used for configuring the origin identifier for the syslog messages. The origin identifier is useful for identifying the source of system logging messages in cases syslog messages from multiple devices are sent to a single syslog host. The origin identifier is added to the beginning of all system logging (syslog) messages sent to remote hosts. The type of the identifier is specified by clogOriginIDType object. This object can be written by the SNMP manager only when clogOriginIDType is set to 'userDefined'. For following value(s) of clogOriginIDType, this object can not be set; the value of this object is derived by the system in these cases: 'contextName' 'ipv4Address' 'hostName' 'other' 'none' This object contains the context name of the device, when clogOriginIDType is set to 'contextName'. This object contains IPv4 address (in dotted decimal notation) of the sending interface when clogOriginIDType is set to 'ipv4Address'. This object contains hostname of the system when clogOriginIDType is set to 'hostName'. This object will contain zero length octet string when clogOriginIDType is either 'none' or 'other'." DEFVAL { "" } ::= { clogBasic 7 } -- Syslog message history table clogHistTableMaxLength OBJECT-TYPE SYNTAX Integer32 (0..500) UNITS "entries" MAX-ACCESS read-write STATUS current DESCRIPTION "The upper limit on the number of entries that the clogHistoryTable may contain. A value of 0 will prevent any history from being retained. When this table is full, the oldest entry will be deleted and a new one will be created." DEFVAL { 1 } ::= { clogHistory 1 } clogHistMsgsFlushed OBJECT-TYPE SYNTAX Counter32 UNITS "messages" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of entries that have been removed from the clogHistoryTable in order to make room for new entries. This object can be utilized to determine whether your polling frequency on the history table is fast enough and/or the size of your history table is large enough such that you are not missing messages." ::= { clogHistory 2 } clogHistoryTable OBJECT-TYPE SYNTAX SEQUENCE OF ClogHistoryEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A table of syslog messages generated by this device. All 'interesting' syslog messages (i.e. severity <= clogMaxSeverity) are entered into this table." ::= { clogHistory 3 } clogHistoryEntry OBJECT-TYPE SYNTAX ClogHistoryEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A syslog message that was previously generated by this device. Each entry is indexed by a message index." INDEX { clogHistIndex } ::= { clogHistoryTable 1 } ClogHistoryEntry ::= SEQUENCE { clogHistIndex Integer32, clogHistFacility DisplayString, clogHistSeverity SyslogSeverity, clogHistMsgName DisplayString, clogHistMsgText DisplayString, clogHistTimestamp TimeStamp } clogHistIndex OBJECT-TYPE SYNTAX Integer32 (1..2147483647) MAX-ACCESS not-accessible STATUS current DESCRIPTION "A monotonically increasing integer for the sole purpose of indexing messages. When it reaches the maximum value the agent flushes the table and wraps the value back to 1." ::= { clogHistoryEntry 1 } clogHistFacility OBJECT-TYPE SYNTAX DisplayString (SIZE (1..20)) MAX-ACCESS read-only STATUS current DESCRIPTION "Name of the facility that generated this message. For example: 'SYS'." ::= { clogHistoryEntry 2 } clogHistSeverity OBJECT-TYPE SYNTAX SyslogSeverity MAX-ACCESS read-only STATUS current DESCRIPTION "The severity of the message." ::= { clogHistoryEntry 3 } clogHistMsgName OBJECT-TYPE SYNTAX DisplayString (SIZE (1..30)) MAX-ACCESS read-only STATUS current DESCRIPTION "A textual identification for the message type. A facility name in conjunction with a message name uniquely identifies a message type." ::= { clogHistoryEntry 4 } clogHistMsgText OBJECT-TYPE SYNTAX DisplayString (SIZE (1..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The text of the message. If the text of the message exceeds 255 bytes, the message will be truncated to 254 bytes and a '*' character will be appended - indicating that the message has been truncated." ::= { clogHistoryEntry 5 } clogHistTimestamp OBJECT-TYPE SYNTAX TimeStamp MAX-ACCESS read-only STATUS current DESCRIPTION "The value of sysUpTime when this message was generated." ::= { clogHistoryEntry 6 } clogMaxServers OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The maximum number of syslog servers that can be configured for the system in clogServerConfigTable. A value of zero for this object indicates there is no specified limit for the system and is only dictated by system resources." ::= { clogServer 1 } clogServerConfigTable OBJECT-TYPE SYNTAX SEQUENCE OF ClogServerConfigEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table contains entries that allow application to configure syslog servers for the system. The maximum number of entries that can be created for this table is limited by the object clogMaxServers." ::= { clogServer 2 } clogServerConfigEntry OBJECT-TYPE SYNTAX ClogServerConfigEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry containing information about syslog servers configured for the system." INDEX { clogServerAddrType, clogServerAddr } ::= { clogServerConfigTable 1 } ClogServerConfigEntry ::= SEQUENCE { clogServerAddrType InetAddressType, clogServerAddr InetAddress, clogServerStatus RowStatus } clogServerAddrType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS not-accessible STATUS current DESCRIPTION "The type of Internet address of this syslog server." ::= { clogServerConfigEntry 1 } clogServerAddr OBJECT-TYPE SYNTAX InetAddress (SIZE(0..64)) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The Internet address of this syslog server. The type of this address is determined by the value of the clogServerAddrType object." ::= { clogServerConfigEntry 2 } clogServerStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "The status object used to manage rows in this table. A row may only be created by setting this object to 'createAndGo'. A row may only be deleted by setting this object to 'destroy'." ::= { clogServerConfigEntry 3 } -- notifications ciscoSyslogMIBNotificationPrefix OBJECT IDENTIFIER ::= { ciscoSyslogMIB 2 } ciscoSyslogMIBNotifications OBJECT IDENTIFIER ::= { ciscoSyslogMIBNotificationPrefix 0 } clogMessageGenerated NOTIFICATION-TYPE OBJECTS { clogHistFacility, clogHistSeverity, clogHistMsgName, clogHistMsgText, clogHistTimestamp } STATUS current DESCRIPTION "When a syslog message is generated by the device a clogMessageGenerated notification is sent. The sending of these notifications can be enabled/disabled via the clogNotificationsEnabled object." ::= { ciscoSyslogMIBNotifications 1 } -- conformance information ciscoSyslogMIBConformance OBJECT IDENTIFIER ::= { ciscoSyslogMIB 3 } ciscoSyslogMIBCompliances OBJECT IDENTIFIER ::= { ciscoSyslogMIBConformance 1 } ciscoSyslogMIBGroups OBJECT IDENTIFIER ::= { ciscoSyslogMIBConformance 2 } -- compliance statements ciscoSyslogMIBCompliance MODULE-COMPLIANCE STATUS deprecated -- superceded by ciscoSyslogMIBComplianceRev1 DESCRIPTION "The compliance statement for entities which implement the Cisco syslog MIB." MODULE -- this module MANDATORY-GROUPS { ciscoSyslogMIBGroup } ::= { ciscoSyslogMIBCompliances 1 } ciscoSyslogMIBComplianceRev1 MODULE-COMPLIANCE STATUS current DESCRIPTION "The compliance statement for entities which implement the Cisco syslog MIB." MODULE -- this module MANDATORY-GROUPS { ciscoSyslogMIBGroup } GROUP clogServerGroup DESCRIPTION "The implementation of this group is mandatory for those systems where configuration of remote syslog server hosts is supported." GROUP clogOriginIDGroup DESCRIPTION "The implementation of this group is mandatory for those systems where syslog origin identifier is supported." GROUP clogNotificationsGroup DESCRIPTION "The implementation of this group is mandatory for those systems where syslog notification is supported." ::= { ciscoSyslogMIBCompliances 2 } -- units of conformance ciscoSyslogMIBGroup OBJECT-GROUP OBJECTS { clogNotificationsSent, clogNotificationsEnabled, clogMaxSeverity, clogMsgIgnores, clogMsgDrops, clogHistTableMaxLength, clogHistMsgsFlushed, clogHistFacility, clogHistSeverity, clogHistMsgName, clogHistMsgText, clogHistTimestamp } STATUS current DESCRIPTION "A collection of objects providing the syslog MIB capability." ::= { ciscoSyslogMIBGroups 1 } clogNotificationsGroup NOTIFICATION-GROUP NOTIFICATIONS { clogMessageGenerated } STATUS current DESCRIPTION "A collection of notification(s) for syslog feature." ::= { ciscoSyslogMIBGroups 2 } clogServerGroup OBJECT-GROUP OBJECTS { clogMaxServers, clogServerStatus } STATUS current DESCRIPTION "A collection of objects providing syslog server information for the system." ::= { ciscoSyslogMIBGroups 3 } clogOriginIDGroup OBJECT-GROUP OBJECTS { clogOriginIDType, clogOriginID } STATUS current DESCRIPTION "A collection of objects providing information on origin of syslog messages." ::= { ciscoSyslogMIBGroups 4 } END