BLUECOAT-AV-MIB

All MIBs › BLUECOAT-AV-MIB

Organization: Blue Coat Systems, Inc.

Last Updated: 2007-04-16

Category: Vendor: Blue Coat

Description: Monitors anti-virus scanning engine status and update information on Blue Coat SG proxy appliances.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is BLUECOAT-AV-MIB?

BLUECOAT-AV-MIB is a Blue Coat (now Symantec/Broadcom) vendor MIB for the antivirus scanning feature built into ProxySG secure web gateway appliances. It exposes scan-engine activity counters, virus detection counts, pattern/signature and engine version information, firmware version state, and ICAP-related connection health for the AV service. Its primary monitoring value is software status: confirming the antivirus pattern file and engine version are current, tracking license expiration (avLicenseDaysRemaining), detecting update failures, and watching for scanning bottlenecks (slow ICAP connections) that indicate the AV engine is falling behind. It depends on the ICAP protocol/service running on the appliance and is often correlated with BLUECOAT-SG-ICAP-MIB for the underlying connection-level statistics. It is deployed wherever a Blue Coat ProxySG is used as a secure web/content gateway with integrated or ICAP-offloaded antivirus scanning, typically at an enterprise internet edge. Engineers can download the BLUECOAT-AV-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in BLUECOAT-AV-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Blue Coat ProxySG secure web gateway appliance

Monitoring Examples

An admin would poll avFilesScanned and avVirusesDetected over time to trend scanning volume and threat rate, and check avPatternDateTime/avPatternVersion against avEngineVersion to verify signatures are up to date. A rising avSlowICAPConnections count alongside a non-empty avUpdateFailureReason would indicate the AV engine is struggling to fetch updates or keep pace with scan load, risking unscanned traffic passing through. avLicenseDaysRemaining nearing zero would trigger a renewal alert before protection lapses.

What Can Be Monitored

files scanned
viruses detected
antivirus pattern/signature version and date
AV engine and firmware version
license days remaining
slow/failed ICAP scanning connections

Imported Objects

From BLUECOAT-MIB

blueCoatMgmt

OBJECT-IDENTITY

From SNMPv2-SMI

Counter32
Gauge32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

DateAndTime
DisplayString

OIDs

OID symbolic	OID numeric	Type	Access	Description
blueCoatAvMib	1.3.6.1.4.1.3417.2.10			The AV MIB is used to monitor antivirus related info.
blueCoatAvMibObjects	1.3.6.1.4.1.3417.2.10.1
C32 avFilesScanned	1.3.6.1.4.1.3417.2.10.1.1	Counter32	read-only	Number of files scanned. An archive containing multiple files will count as one file.
C32 avVirusesDetected	1.3.6.1.4.1.3417.2.10.1.2	Counter32	read-only	Number of infected files detected. A file containing multiple infections will count as one infected file.
STR avPatternVersion	1.3.6.1.4.1.3417.2.10.1.3	DisplayString	read-only	AV pattern version.
DAT avPatternDateTime	1.3.6.1.4.1.3417.2.10.1.4	DateAndTime	read-only	Release date and time of the av pattern.
STR avEngineVersion	1.3.6.1.4.1.3417.2.10.1.5	DisplayString	read-only	AV engine version.
STR avVendorName	1.3.6.1.4.1.3417.2.10.1.6	DisplayString	read-only	AV vendor name.
INT avLicenseDaysRemaining	1.3.6.1.4.1.3417.2.10.1.7	INTEGER	read-only	AV license days remaining.
STR avPublishedFirmwareVersion	1.3.6.1.4.1.3417.2.10.1.8	DisplayString	read-only	ProxyAV version published on the automatic update location.
STR avInstalledFirmwareVersion	1.3.6.1.4.1.3417.2.10.1.9	DisplayString	read-only	Currently installed ProxyAV firmware version.
G32 avSlowICAPConnections	1.3.6.1.4.1.3417.2.10.1.10	Gauge32	read-only	The number of ICAP connections that are considered 'slow' - receiving data for more than the configured time threshold (by default 60 seconds).
blueCoatAvMibNotificationObjects	1.3.6.1.4.1.3417.2.10.2
STR avUpdateFailureReason	1.3.6.1.4.1.3417.2.10.2.1	DisplayString	not-accessible	The reason why the av engine/pattern/firmware update failed.
STR avUrl	1.3.6.1.4.1.3417.2.10.2.2	DisplayString	not-accessible	The URL for use in notifications.
STR avVirusName	1.3.6.1.4.1.3417.2.10.2.3	DisplayString	not-accessible	The name of the infection found.
STR avVirusDetails	1.3.6.1.4.1.3417.2.10.2.4	DisplayString	not-accessible	More details about the infection found.
STR avErrorCode	1.3.6.1.4.1.3417.2.10.2.5	DisplayString	not-accessible	Error code identifying the scan exception, like max_file_size_exceeded.
STR avErrorDetails	1.3.6.1.4.1.3417.2.10.2.6	DisplayString	not-accessible	More details about the scan exception.
STR avPreviousFirmwareVersion	1.3.6.1.4.1.3417.2.10.2.7	DisplayString	not-accessible	The firmware version before the firmware update.
STR avICTMWarningReason	1.3.6.1.4.1.3417.2.10.2.8	DisplayString	not-accessible	The reason of the Intelligent Connection Traffic Monitoring warning.
blueCoatAvMibNotifications	1.3.6.1.4.1.3417.2.10.3
NTF avAntivirusUpdateSuccess	1.3.6.1.4.1.3417.2.10.3.1			Successful av engine/pattern update.
NTF avAntivirusUpdateFailed	1.3.6.1.4.1.3417.2.10.3.2			Av engine/pattern update failed, avUpdateFailureReason provides more details.
NTF avVirusDetected	1.3.6.1.4.1.3417.2.10.3.3			Infected file detected at avUrl.
NTF avFileServed	1.3.6.1.4.1.3417.2.10.3.4			File served without scanning. It could not be scanned completely due to a scan exception.
NTF avFileBlocked	1.3.6.1.4.1.3417.2.10.3.5			File blocked. It could not be scanned completely due to a scan exception.
NTF avNewFirmwareAvailable	1.3.6.1.4.1.3417.2.10.3.6			New firmware version published at the Blue Coat download location.
NTF avFirmwareUpdateSuccess	1.3.6.1.4.1.3417.2.10.3.7			Firmware update completed successfully.
NTF avFirmwareUpdateFailed	1.3.6.1.4.1.3417.2.10.3.8			Firmware update failed.
NTF avAntivirusLicenseWarning	1.3.6.1.4.1.3417.2.10.3.9			The antivirus license is about to expire.
NTF avICTMWarning	1.3.6.1.4.1.3417.2.10.3.10			The warning from the Intelligent Connection Traffic Monitoring feature that the number of 'slow' connections has crossed the threshold value.

RFC description

Monitors antivirus engine status, file scanning statistics, and pattern version on Blue Coat systems.

Start monitoring Blue Coat secure web gateway appliances with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download BLUECOAT-AV-MIB

What Is BLUECOAT-AV-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description