AVUPDATE-STATISTICS-MIB

All MIBs › AVUPDATE-STATISTICS-MIB

Organization: www.kaspersky.com

Last Updated: 2016-02-24

Category: VPN and Security, Vendor: Kaspersky

Description: Tracks Kaspersky AntiVirus update statistics, including last update time, update success/failure counts, and database version.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is AVUPDATE-STATISTICS-MIB?

AVUPDATE-STATISTICS-MIB is a vendor-specific MIB (associated with Kaspersky) that tracks antivirus signature/database update activity on a managed security appliance or host agent. It exposes statistics such as the time of the last update attempt, counts of successful and failed update operations, and the currently installed antivirus database version. This is fundamentally a software-status MIB: it lets an administrator confirm the antivirus engine is receiving timely signature updates and quickly flag hosts whose database has gone stale or whose updates are repeatedly failing, which is a critical security-posture indicator. No sample objects were provided in the source data, so exact object names cannot be grounded here, but the description implies a small table or scalar group covering these update metrics. It is deployed wherever Kaspersky (or compatible) antivirus agents report update health via SNMP, typically in centrally managed endpoint or gateway security environments. Engineers can download the AVUPDATE-STATISTICS-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in AVUPDATE-STATISTICS-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

host or gateway running Kaspersky AntiVirus agent

Monitoring Examples

Given the empty sample_objects list, no concrete object names can be cited; a realistic monitoring scenario would involve an admin checking the last-update-time and update-failure-count objects to identify hosts whose antivirus database has not refreshed in several days, indicating a broken update mechanism or lost connectivity to the update server.

What Can Be Monitored

last update time
successful update count
failed update count
antivirus database version

Imported Objects

From KAV4FS-STATISTICS-MIB

statistics

MODULE-IDENTITY

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-SMI

Counter32
Counter64
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DateAndTime
DisplayString
TimeStamp

How to Use in IPNetwork Monitor

Example using avUpdateStatisticsCurrentBasesRecords OID:

Select a Servers/endpoints running Kaspersky Anti-Viru as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type avUpdateStatisticsCurrentBasesRecords into the Find box to locate it in the OID tree, then select it and click OK. The current number of records in the antivirus signature database. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
avUpdateStatistics	1.3.6.1.4.1.23668.1046.2.7			Update statistics till current time period
DAT avUpdateStatisticsCurrentAVBasesDate	1.3.6.1.4.1.23668.1046.2.7.1	DateAndTime	read-only
DAT avUpdateStatisticsLastUpdateAVBasesDate	1.3.6.1.4.1.23668.1046.2.7.2	DateAndTime	read-only
STR avUpdateStatisticsCurrentBasesState	1.3.6.1.4.1.23668.1046.2.7.3	DisplayString	read-only
C64 avUpdateStatisticsCurrentBasesRecordsEx	1.3.6.1.4.1.23668.1046.2.7.4	Counter64	read-only
C64 avUpdateStatisticsUpdateAttempts	1.3.6.1.4.1.23668.1046.2.7.5	Counter64	read-only
C64 avUpdateStatisticsSuccessfulUpdates	1.3.6.1.4.1.23668.1046.2.7.6	Counter64	read-only
C64 avUpdateStatisticsUpdateManualStops	1.3.6.1.4.1.23668.1046.2.7.7	Counter64	read-only
C64 avUpdateStatisticsFailedUpdates	1.3.6.1.4.1.23668.1046.2.7.8	Counter64	read-only

RFC description

Tracks antivirus update statistics including base update dates, update attempts, and success metrics for Kaspersky security systems.

Start monitoring Servers/endpoints running Kaspersky Anti-Virus with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download AVUPDATE-STATISTICS-MIB