ALARM-MIB

MIB Reference — IPNetwork Monitor

All MIBsALARM-MIB

Organization: IETF Distributed Management Working Group

Last Updated: 2004-09-09

Category: Alarm and Event Management

Description:

Provides a generic model for storing and managing active alarms on a device, including alarm models, severity levels, and state transitions.

Imported Objects

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From RMON2-MIB

ZeroBasedCounter32

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Counter64
Gauge32
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Opaque
TimeTicks
Unsigned32
mib-2
zeroDotZero

From SNMPv2-TC

DateAndTime
RowPointer
RowStatus
TEXTUAL-CONVENTION

What Is ALARM-MIB?

ALARM-MIB is a vendor-neutral IETF standards MIB (RFC 3877) that provides a generic model for storing and managing a device's list of currently active alarms, independent of the specific technology generating them. It defines alarm model tables describing state transitions, severity, and the varbind data associated with each alarm, plus a parallel active-alarm list reflecting alarms currently in effect on the device, all registered under the ALARM-MIB OID branch established by RFC 3877. This makes it directly useful for monitoring overall device fault status in a technology-agnostic way—any subsystem (power, temperature, interface, process) can register its faults here, so alarmActiveLastChanged and the active alarm table act as a single point of truth for "what's currently wrong with this box." It is explicitly designed to be referenced by other MIBs' notification definitions (via alarmModelNotificationId and alarmModelVarbindIndex/Value), giving it a coordinating dependency on whatever technology-specific MIB actually raised the alarm. It is deployed on any standards-compliant network element wanting a unified alarm/fault list, common in carrier-grade and NMS-integrated equipment.

IPNetwork Monitor allows you to monitor SNMP objects defined in ALARM-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

What Can Be Monitored

  • active alarm list
  • alarm state
  • alarm severity/description
  • alarm model last-changed timestamp
  • associated notification/varbind data

Supported Devices

  • vendor-neutral, standards-based MIB, not tied to a specific manufacturer
  • any SNMP-managed network element with an alarm subsystem

Monitoring Examples

An admin would poll alarmModelTable/alarmModelEntry, keyed by alarmModelIndex, checking alarmModelState for current alarm state and alarmModelDescription for a human-readable summary of what's wrong. alarmModelNotificationId and alarmModelVarbindIndex/alarmModelVarbindValue let a management station trace an active alarm back to the specific notification and varbind data that raised it, useful for correlating a generic alarm entry with a vendor-specific trap. A rising alarmActiveLastChanged timestamp signals that the active alarm list has just changed, prompting a re-poll to see what new fault appeared or cleared.

OIDs
OID symbolicOID numericTypeAccessDescription
alarmMIB1.3.6.1.2.1.118The MIB module describes a generic solution to model alarms and to store the current list of active alarms. Copyright (C) The Internet Society (2004). The initial version of this MIB module was published in RFC 3877. For full legal notices see the RFC itself. Supplementary information may be available on: http://www.ietf.org/copyrights/ianamib.html
alarmNotifications1.3.6.1.2.1.118.0
NTF alarmActiveState1.3.6.1.2.1.118.0.2An instance of the alarm indicated by alarmActiveModelPointer has been raised against the entity indicated by alarmActiveResourceId. The agent must throttle the generation of consecutive alarmActiveState traps so that there is at least a two-second gap between traps of this type against the same alarmActiveModelPointer and alarmActiveResourceId. When traps are throttled, they are dropped, not queued for sending at a future time. A management application should periodically check the value of alarmActiveLastChanged to detect any missed alarmActiveState notification-events, e.g., due to throttling or transmission loss.
NTF alarmClearState1.3.6.1.2.1.118.0.3An instance of the alarm indicated by alarmActiveModelPointer has been cleared against the entity indicated by alarmActiveResourceId. The agent must throttle the generation of consecutive alarmActiveClear traps so that there is at least a two-second gap between traps of this type against the same alarmActiveModelPointer and alarmActiveResourceId. When traps are throttled, they are dropped, not queued for sending at a future time. A management application should periodically check the value of alarmActiveLastChanged to detect any missed alarmClearState notification-events, e.g., due to throttling or transmission loss.
alarmObjects1.3.6.1.2.1.118.1
alarmModel1.3.6.1.2.1.118.1.1
TIK alarmModelLastChanged1.3.6.1.2.1.118.1.1.1TimeTicksread-onlyThe value of sysUpTime at the time of the last creation, deletion or modification of an entry in the alarmModelTable. If the number and content of entries has been unchanged since the last re-initialization of the local network management subsystem, then the value of this object MUST be zero.
alarmModelTable1.3.6.1.2.1.118.1.1.2not-accessibleA table of information about possible alarms on the system, and how they have been modelled.
alarmModelEntry1.3.6.1.2.1.118.1.1.2.1not-accessibleEntries appear in this table for each possible alarm state. This table MUST be persistent across system reboots.
U32 alarmModelIndex1.3.6.1.2.1.118.1.1.2.1.1Unsigned32not-accessibleAn integer that acts as an alarm Id to uniquely identify each alarm within the named alarm list.
U32 alarmModelState1.3.6.1.2.1.118.1.1.2.1.2Unsigned32not-accessibleA value of 1 MUST indicate a clear alarm state. The value of this object MUST be less than the alarmModelState of more severe alarm states for this alarm. The value of this object MUST be more than the alarmModelState of less severe alarm states for this alarm.
OID alarmModelNotificationId1.3.6.1.2.1.118.1.1.2.1.3OBJECT IDENTIFIERread-createThe NOTIFICATION-TYPE object identifier of this alarm state transition. If there is no notification associated with this alarm state, the value of this object MUST be '0.0'
U32 alarmModelVarbindIndex1.3.6.1.2.1.118.1.1.2.1.4Unsigned32read-createThe index into the varbind listing of the notification indicated by alarmModelNotificationId which helps signal that the given alarm has changed state. If there is no applicable varbind, the value of this object MUST be zero. Note that the value of alarmModelVarbindIndex acknowledges the existence of the first two obligatory varbinds in the InformRequest-PDU and SNMPv2-Trap-PDU (sysUpTime.0 and snmpTrapOID.0). That is, a value of 2 refers to the snmpTrapOID.0. If the incoming notification is instead an SNMPv1 Trap-PDU, then an appropriate value for sysUpTime.0 or snmpTrapOID.0 shall be determined by using the rules in section 3.1 of [RFC3584]
I32 alarmModelVarbindValue1.3.6.1.2.1.118.1.1.2.1.5Integer32read-createThe value that the varbind indicated by alarmModelVarbindIndex takes to indicate that the alarm has entered this state. If alarmModelVarbindIndex has a value of 0, so MUST alarmModelVarbindValue.
STR alarmModelDescription1.3.6.1.2.1.118.1.1.2.1.6SnmpAdminStringread-createA brief description of this alarm and state suitable to display to operators.
NUM alarmModelSpecificPointer1.3.6.1.2.1.118.1.1.2.1.7RowPointerread-createIf no additional, model-specific Alarm MIB is supported by the system the value of this object is `0.0'and attempts to set it to any other value MUST be rejected appropriately. When a model-specific Alarm MIB is supported, this object MUST refer to the first accessible object in a corresponding row of the model definition in one of these model-specific MIB and attempts to set this object to { 0 0 } or any other value MUST be rejected appropriately.
OID alarmModelVarbindSubtree1.3.6.1.2.1.118.1.1.2.1.8OBJECT IDENTIFIERread-createThe name portion of each VarBind in the notification, in order, is compared to the value of this object. If the name is equal to or a subtree of the value of this object, for purposes of computing the value of AlarmActiveResourceID the 'prefix' will be the matching portion, and the 'indexes' will be any remainder. The examination of varbinds ends with the first match. If the value of this object is 0.0, then the first varbind, or in the case of v2, the first varbind after the timestamp and the trap OID, will always be matched.
OID alarmModelResourcePrefix1.3.6.1.2.1.118.1.1.2.1.9OBJECT IDENTIFIERread-createThe value of AlarmActiveResourceId is computed by appending any indexes extracted in accordance with the description of alarmModelVarbindSubtree onto the value of this object. If this object's value is 0.0, then the 'prefix' extracted is used instead.
ROW alarmModelRowStatus1.3.6.1.2.1.118.1.1.2.1.10RowStatusread-createControl for creating and deleting entries. Entries may be modified while active. Alarms whose alarmModelRowStatus is not active will not appear in either the alarmActiveTable or the alarmClearTable. Setting this object to notInService cannot be used as an alarm suppression mechanism. Entries that are notInService will disappear as described in RFC2579. This row can not be modified while it is being referenced by a value of alarmActiveModelPointer. In these cases, an error of `inconsistentValue' will be returned to the manager. This entry may be deleted while it is being referenced by a value of alarmActiveModelPointer. This results in the deletion of this entry and entries in the active alarms referencing this entry via an alarmActiveModelPointer. As all read-create objects in this table have a DEFVAL clause, there is no requirement that any object be explicitly set before this row can become active. Note that a row consisting only of default values is not very meaningful.
alarmActive1.3.6.1.2.1.118.1.2
TIK alarmActiveLastChanged1.3.6.1.2.1.118.1.2.1TimeTicksread-onlyThe value of sysUpTime at the time of the last creation or deletion of an entry in the alarmActiveTable. If the number of entries has been unchanged since the last re-initialization of the local network management subsystem, then this object contains a zero value.
alarmActiveTable1.3.6.1.2.1.118.1.2.2not-accessibleA table of Active Alarms entries.
alarmActiveEntry1.3.6.1.2.1.118.1.2.2.1not-accessibleEntries appear in this table when alarms are raised. They are removed when the alarm is cleared. If under extreme resource constraint the system is unable to add any more entries into this table, then the alarmActiveOverflow statistic will be increased by one.
STR alarmListName1.3.6.1.2.1.118.1.2.2.1.1SnmpAdminStringnot-accessibleThe name of the list of alarms. This SHOULD be the same as nlmLogName if the Notification Log MIB [RFC3014] is supported. This SHOULD be the same as, or contain as a prefix, the applicable snmpNotifyFilterProfileName if the SNMP-NOTIFICATION-MIB DEFINITIONS [RFC3413] is supported. An implementation may allow multiple named alarm lists, up to some implementation-specific limit (which may be none). A zero-length list name is reserved for creation and deletion by the managed system, and MUST be used as the default log name by systems that do not support named alarm lists.
DAT alarmActiveDateAndTime1.3.6.1.2.1.118.1.2.2.1.2DateAndTimenot-accessibleThe local date and time when the error occurred. This object facilitates retrieving all instances of alarms that have been raised or have changed state since a given point in time. Implementations MUST include the offset from UTC, if available. Implementation in environments in which the UTC offset is not available is NOT RECOMMENDED.
U32 alarmActiveIndex1.3.6.1.2.1.118.1.2.2.1.3Unsigned32not-accessibleA strictly monotonically increasing integer which acts as the index of entries within the named alarm list. It wraps back to 1 after it reaches its maximum value.
LOC alarmActiveEngineID1.3.6.1.2.1.118.1.2.2.1.4LocalSnmpEngineOrZeroLenStrread-onlyThe identification of the SNMP engine at which the alarm originated. If the alarm is from an SNMPv1 system this object is a zero length string.
IPt alarmActiveEngineAddressType1.3.6.1.2.1.118.1.2.2.1.5InetAddressTyperead-onlyThis object indicates what type of address is stored in the alarmActiveEngineAddress object - IPv4, IPv6, DNS, etc.
IP alarmActiveEngineAddress1.3.6.1.2.1.118.1.2.2.1.6InetAddressread-onlyThe address of the SNMP engine on which the alarm is occurring. This object MUST always be instantiated, even if the list can contain alarms from only one engine.
STR alarmActiveContextName1.3.6.1.2.1.118.1.2.2.1.7SnmpAdminStringread-onlyThe name of the SNMP MIB context from which the alarm came. For SNMPv1 alarms this is the community string from the Trap. Note that care MUST be taken when selecting community strings to ensure that these can be represented as a well-formed SnmpAdminString. Community or Context names that are not well-formed SnmpAdminStrings will be mapped to zero length strings. If the alarm's source SNMP engine is known not to support multiple contexts, this object is a zero length string.
U32 alarmActiveVariables1.3.6.1.2.1.118.1.2.2.1.8Unsigned32read-onlyThe number of variables in alarmActiveVariableTable for this alarm.
OID alarmActiveNotificationID1.3.6.1.2.1.118.1.2.2.1.9OBJECT IDENTIFIERread-onlyThe NOTIFICATION-TYPE object identifier of the alarm state transition that is occurring.
RES alarmActiveResourceId1.3.6.1.2.1.118.1.2.2.1.10ResourceIdread-onlyThis object identifies the resource under alarm. If there is no corresponding resource, then the value of this object MUST be 0.0.
STR alarmActiveDescription1.3.6.1.2.1.118.1.2.2.1.11SnmpAdminStringread-onlyThis object provides a textual description of the active alarm. This text is generated dynamically by the notification generator to provide useful information to the human operator. This information SHOULD provide information allowing the operator to locate the resource for which this alarm is being generated. This information is not intended for consumption by automated tools.
NUM alarmActiveLogPointer1.3.6.1.2.1.118.1.2.2.1.12RowPointerread-onlyA pointer to the corresponding row in a notification logging MIB where the state change notification for this active alarm is logged. If no log entry applies to this active alarm, then this object MUST have the value of 0.0
NUM alarmActiveModelPointer1.3.6.1.2.1.118.1.2.2.1.13RowPointerread-onlyA pointer to the corresponding row in the alarmModelTable for this active alarm. This points not only to the alarm model being instantiated, but also to the specific alarm state that is active.
NUM alarmActiveSpecificPointer1.3.6.1.2.1.118.1.2.2.1.14RowPointerread-onlyIf no additional, model-specific, Alarm MIB is supported by the system this object is `0.0'. When a model-specific Alarm MIB is supported, this object is the instance pointer to the specific model-specific active alarm list.
alarmActiveVariableTable1.3.6.1.2.1.118.1.2.3not-accessibleA table of variables to go with active alarm entries.
alarmActiveVariableEntry1.3.6.1.2.1.118.1.2.3.1not-accessibleEntries appear in this table when there are variables in the varbind list of a corresponding alarm in alarmActiveTable. Entries appear in this table as though the trap/notification had been transported using a SNMPv2-Trap-PDU, as defined in [RFC3416] - i.e., the alarmActiveVariableIndex 1 will always be sysUpTime and alarmActiveVariableIndex 2 will always be snmpTrapOID. If the incoming notification is instead an SNMPv1 Trap-PDU and the value of alarmModelVarbindIndex is 1 or 2, an appropriate value for sysUpTime.0 or snmpTrapOID.0 shall be determined by using the rules in section 3.1 of [RFC3584].
U32 alarmActiveVariableIndex1.3.6.1.2.1.118.1.2.3.1.1Unsigned32not-accessibleA strictly monotonically increasing integer, starting at 1 for a given alarmActiveIndex, for indexing variables within the active alarm variable list.
OID alarmActiveVariableID1.3.6.1.2.1.118.1.2.3.1.2OBJECT IDENTIFIERread-onlyThe alarm variable's object identifier.
INT alarmActiveVariableValueType1.3.6.1.2.1.118.1.2.3.1.3INTEGERread-onlyThe type of the value. One and only one of the value objects that follow is used for a given row in this table, based on this type.
C32 alarmActiveVariableCounter32Val1.3.6.1.2.1.118.1.2.3.1.4Counter32read-onlyThe value when alarmActiveVariableType is 'counter32'.
U32 alarmActiveVariableUnsigned32Val1.3.6.1.2.1.118.1.2.3.1.5Unsigned32read-onlyThe value when alarmActiveVariableType is 'unsigned32'.
TIK alarmActiveVariableTimeTicksVal1.3.6.1.2.1.118.1.2.3.1.6TimeTicksread-onlyThe value when alarmActiveVariableType is 'timeTicks'.
I32 alarmActiveVariableInteger32Val1.3.6.1.2.1.118.1.2.3.1.7Integer32read-onlyThe value when alarmActiveVariableType is 'integer32'.
OCT alarmActiveVariableOctetStringVal1.3.6.1.2.1.118.1.2.3.1.8OCTET STRINGread-onlyThe value when alarmActiveVariableType is 'octetString'.
IP alarmActiveVariableIpAddressVal1.3.6.1.2.1.118.1.2.3.1.9IpAddressread-onlyThe value when alarmActiveVariableType is 'ipAddress'.
OID alarmActiveVariableOidVal1.3.6.1.2.1.118.1.2.3.1.10OBJECT IDENTIFIERread-onlyThe value when alarmActiveVariableType is 'objectId'.
C64 alarmActiveVariableCounter64Val1.3.6.1.2.1.118.1.2.3.1.11Counter64read-onlyThe value when alarmActiveVariableType is 'counter64'.
OPA alarmActiveVariableOpaqueVal1.3.6.1.2.1.118.1.2.3.1.12Opaqueread-onlyThe value when alarmActiveVariableType is 'opaque'. Note that although RFC2578 [RFC2578] forbids the use of Opaque in 'standard' MIB modules, this particular usage is driven by the need to be able to accurately represent any well-formed notification, and justified by the need for backward compatibility.
alarmActiveStatsTable1.3.6.1.2.1.118.1.2.4not-accessibleThis table represents the alarm statistics information.
alarmActiveStatsEntry1.3.6.1.2.1.118.1.2.4.1not-accessibleStatistics on the current active alarms.
G32 alarmActiveStatsActiveCurrent1.3.6.1.2.1.118.1.2.4.1.1Gauge32read-onlyThe total number of currently active alarms on the system.
NUM alarmActiveStatsActives1.3.6.1.2.1.118.1.2.4.1.2ZeroBasedCounter32read-onlyThe total number of active alarms since system restarted.
TIK alarmActiveStatsLastRaise1.3.6.1.2.1.118.1.2.4.1.3TimeTicksread-onlyThe value of sysUpTime at the time of the last alarm raise for this alarm list. If no alarm raises have occurred since the last re-initialization of the local network management subsystem, then this object contains a zero value.
TIK alarmActiveStatsLastClear1.3.6.1.2.1.118.1.2.4.1.4TimeTicksread-onlyThe value of sysUpTime at the time of the last alarm clear for this alarm list. If no alarm clears have occurred since the last re-initialization of the local network management subsystem, then this object contains a zero value.
C32 alarmActiveOverflow1.3.6.1.2.1.118.1.2.5Counter32read-onlyThe number of active alarms that have not been put into the alarmActiveTable since system restart as a result of extreme resource constraints.
alarmClear1.3.6.1.2.1.118.1.3
U32 alarmClearMaximum1.3.6.1.2.1.118.1.3.1Unsigned32read-writeThis object specifies the maximum number of cleared alarms to store in the alarmClearTable. When this number is reached, the cleared alarms with the earliest clear time will be removed from the table.
alarmClearTable1.3.6.1.2.1.118.1.3.2not-accessibleThis table contains information on cleared alarms.
alarmClearEntry1.3.6.1.2.1.118.1.3.2.1not-accessibleInformation on a cleared alarm.
U32 alarmClearIndex1.3.6.1.2.1.118.1.3.2.1.1Unsigned32not-accessibleAn integer which acts as the index of entries within the named alarm list. It wraps back to 1 after it reaches its maximum value. This object has the same value as the alarmActiveIndex that this alarm instance had when it was active.
DAT alarmClearDateAndTime1.3.6.1.2.1.118.1.3.2.1.2DateAndTimenot-accessibleThe local date and time when the alarm cleared. This object facilitates retrieving all instances of alarms that have been cleared since a given point in time. Implementations MUST include the offset from UTC, if available. Implementation in environments in which the UTC offset is not available is NOT RECOMMENDED.
LOC alarmClearEngineID1.3.6.1.2.1.118.1.3.2.1.3LocalSnmpEngineOrZeroLenStrread-onlyThe identification of the SNMP engine at which the alarm originated. If the alarm is from an SNMPv1 system this object is a zero length string.
IPt alarmClearEngineAddressType1.3.6.1.2.1.118.1.3.2.1.4InetAddressTyperead-onlyThis object indicates what type of address is stored in the alarmActiveEngineAddress object - IPv4, IPv6, DNS, etc.
IP alarmClearEngineAddress1.3.6.1.2.1.118.1.3.2.1.5InetAddressread-onlyThe Address of the SNMP engine on which the alarm was occurring. This is used to identify the source of an SNMPv1 trap, since an alarmActiveEngineId cannot be extracted from the SNMPv1 trap PDU. This object MUST always be instantiated, even if the list can contain alarms from only one engine.
STR alarmClearContextName1.3.6.1.2.1.118.1.3.2.1.6SnmpAdminStringread-onlyThe name of the SNMP MIB context from which the alarm came. For SNMPv1 traps this is the community string from the Trap. Note that care needs to be taken when selecting community strings to ensure that these can be represented as a well-formed SnmpAdminString. Community or Context names that are not well-formed SnmpAdminStrings will be mapped to zero length strings. If the alarm's source SNMP engine is known not to support multiple contexts, this object is a zero length string.
OID alarmClearNotificationID1.3.6.1.2.1.118.1.3.2.1.7OBJECT IDENTIFIERread-onlyThe NOTIFICATION-TYPE object identifier of the alarm clear.
RES alarmClearResourceId1.3.6.1.2.1.118.1.3.2.1.8ResourceIdread-onlyThis object identifies the resource that was under alarm. If there is no corresponding resource, then the value of this object MUST be 0.0.
U32 alarmClearLogIndex1.3.6.1.2.1.118.1.3.2.1.9Unsigned32read-onlyThis number MUST be the same as the log index of the applicable row in the notification log MIB, if it exists. If no log index applies to the trap, then this object MUST have the value of 0.
NUM alarmClearModelPointer1.3.6.1.2.1.118.1.3.2.1.10RowPointerread-onlyA pointer to the corresponding row in the alarmModelTable for this cleared alarm.
alarmConformance1.3.6.1.2.1.118.2
alarmCompliances1.3.6.1.2.1.118.2.1
alarmCompliance1.3.6.1.2.1.118.2.1.1The compliance statement for systems supporting the Alarm MIB.
alarmGroups1.3.6.1.2.1.118.2.2
alarmModelGroup1.3.6.1.2.1.118.2.2.1Alarm model group.
alarmActiveGroup1.3.6.1.2.1.118.2.2.2Active Alarm list group.
alarmActiveStatsGroup1.3.6.1.2.1.118.2.2.3Active alarm summary group.
alarmClearGroup1.3.6.1.2.1.118.2.2.4Cleared alarm group.
alarmNotificationsGroup1.3.6.1.2.1.118.2.2.6The collection of notifications that can be used to model alarms for faults lacking pre-existing notification definitions.

RFC description

Generic alarm management system for modeling and storing active alarms in network equipment (RFC 3877).

Start monitoring SNMP-managed network devices (alarm subsystem) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ALARM-MIB