BLUECOAT-SG-ICAP-MIB

All MIBs › BLUECOAT-SG-ICAP-MIB

Organization: Blue Coat Systems, Inc.

Last Updated: 2013-02-08

Category: Vendor: Blue Coat, Web and Application Servers

Description: Monitors ICAP (Internet Content Adaptation Protocol) service connections and statistics on Blue Coat SG proxies.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is BLUECOAT-SG-ICAP-MIB?

BLUECOAT-SG-ICAP-MIB monitors the Internet Content Adaptation Protocol (ICAP) service on Blue Coat ProxySG appliances, which offloads content scanning (such as antivirus or content filtering) to external ICAP servers. It exposes per-service connection and request statistics, including plain and secured (TLS) connection counts, active and queued/deferred requests, and bytes received from each ICAP service. Its monitoring role is squarely about service/software health: detecting when an ICAP service is overloaded (rising queued or deferred requests), losing capacity (falling active connections), or when secure vs. plain connection usage shifts unexpectedly, all of which affect whether traffic is being scanned in time. It is directly dependent on external ICAP server infrastructure (e.g., Proxy-AV) and is commonly correlated with BLUECOAT-AV-MIB when the ICAP service is doing antivirus scanning. Deployment context is enterprise secure web gateways where ProxySG offloads content inspection to one or more ICAP-compliant scanning servers. Engineers can download the BLUECOAT-SG-ICAP-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in BLUECOAT-SG-ICAP-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Blue Coat ProxySG secure web gateway appliance

Monitoring Examples

An admin would poll icapServiceStatsTable/icapServiceStatsEntry by icapServiceStatsName to compare icapServiceStatsPlainActvReqs and icapServiceStatsSecureActvReqs against icapServiceStatsQueuedReqs, spotting when queued or deferred requests climb because an ICAP server can't keep up. Tracking icapServiceStatsRcvdBytes over time shows scanning throughput trends. A sudden rise in icapServiceStatsDeferredReqs with flat active connections would suggest the ICAP backend is saturated or unreachable.

What Can Be Monitored

ICAP connections (plain/secured)
active ICAP requests
queued/deferred ICAP requests
bytes received per ICAP service
per-service ICAP request load

Imported Objects

From BLUECOAT-MIB

blueCoatMgmt

OBJECT-IDENTITY

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter64
Gauge32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

TEXTUAL-CONVENTION

How to Use in IPNetwork Monitor

Example using icapServiceStatsRcvdBytes OID:

Select a Blue Coat secure web gateway appliance as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type icapServiceStatsRcvdBytes into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the number of data bytes received from the ICAP service or service group. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
bluecoatSGICAPMIB	1.3.6.1.4.1.3417.2.14			Internet Content Adaptation Protocol (ICAP) is an open standard protocol that allows content engines to send HTTP-based content to an ICAP server for performing value added services. The ProxySG appliance, when integrated with a supported ICAP server such as the Proxy-AV, provides content scanning, filtering, and repair service for Internet-based malicious code, in addition to reducing bandwidth usage and latency. This is the MIB module for ProxySG ICAP feature.
bluecoatSgICAPMIBObjects	1.3.6.1.4.1.3417.2.14.1
bluecoatSgICAPValues	1.3.6.1.4.1.3417.2.14.1.1
icapService	1.3.6.1.4.1.3417.2.14.1.1.1
icapServiceStatsTable	1.3.6.1.4.1.3417.2.14.1.1.1.1		not-accessible	This table represents various operational statistics of ICAP services and service groups in an ProxySG appliance.
icapServiceStatsTableEntry	1.3.6.1.4.1.3417.2.14.1.1.1.1.1		not-accessible	An entry in this table represents the statistics for an ICAP service entity. An entity is uniquely identified by the service name (icapServiceStatsEntityName).
U32 icapServiceStatsIndex	1.3.6.1.4.1.3417.2.14.1.1.1.1.1.1	Unsigned32	not-accessible	This is the index of the table and is an unique identifier of the entity.
OCT icapServiceStatsName	1.3.6.1.4.1.3417.2.14.1.1.1.1.1.2	OCTET STRING	read-only	This attribute represents the configured name of the service or the service group.
ICA icapServiceStatsEntityType	1.3.6.1.4.1.3417.2.14.1.1.1.1.1.3	ICAPServiceEntityType	read-only	This attribute defines the entity type: service or service group. The service group statistics represent the sum of all the services that are members of the group.
G32 icapServiceStatsPlainConns	1.3.6.1.4.1.3417.2.14.1.1.1.1.1.4	Gauge32	read-only	Number of ICAP scanning transactions that are not encrypted.
G32 icapServiceStatsSecuredConns	1.3.6.1.4.1.3417.2.14.1.1.1.1.1.5	Gauge32	read-only	Number of ICAP scanning transactions that are encrypted and tunneled over SSL.
G32 icapServiceStatsPlainActvReqs	1.3.6.1.4.1.3417.2.14.1.1.1.1.1.6	Gauge32	read-only	Line of communication between the ProxySG appliance and an ICAP server across which plain ICAP scanning requests are sent. This statistic is not tracked for service groups.
G32 icapServiceStatsSecureActvReqs	1.3.6.1.4.1.3417.2.14.1.1.1.1.1.7	Gauge32	read-only	Secure line of communication between the ProxySG appliance and an ICAP server across which encrypted ICAP scanning requests are sent. This statistic is not tracked for service groups.
G32 icapServiceStatsQueuedReqs	1.3.6.1.4.1.3417.2.14.1.1.1.1.1.8	Gauge32	read-only	ICAP scanning transactions that are waiting for an available connection.
G32 icapServiceStatsDeferredReqs	1.3.6.1.4.1.3417.2.14.1.1.1.1.1.9	Gauge32	read-only	Number of ICAP scanning transactions that have been deferred until the full object has been received.
C64 icapServiceStatsRcvdBytesEx	1.3.6.1.4.1.3417.2.14.1.1.1.1.1.10	Counter64	read-only	Number of data bytes received from the ICAP service or service group.
C64 icapServiceStatsSentBytes	1.3.6.1.4.1.3417.2.14.1.1.1.1.1.11	Counter64	read-only	Number of bytes of ICAP data sent to the ICAP service or service group.
C64 icapServiceStatsFailedReqs	1.3.6.1.4.1.3417.2.14.1.1.1.1.1.12	Counter64	read-only	Number of ICAP scanning transactions that failed because of a scanning timeout, connection failure, server error, or a variety of other situations.
C64 icapServiceStatsSuccessfullReqs	1.3.6.1.4.1.3417.2.14.1.1.1.1.1.13	Counter64	read-only	Number of ICAP scanning transactions that completed successfully.
ICA sgICAPNotification	1.3.6.1.4.1.3417.2.14.1.1.2	ICAPServiceNotificationType	read-only	A notification type that describes an ICAP event.
bluecoatSgICAPMIBNotifications	1.3.6.1.4.1.3417.2.14.2
sgICAPMIBNotificationsPrefix	1.3.6.1.4.1.3417.2.14.2.0
NTF sgICAPTrap	1.3.6.1.4.1.3417.2.14.2.0.1			A notification that represents an ICAP- related event on an ProxySG appliance. The attributes of an ICAP notification include: sgICAPNotification - defines the event type. icapServiceStatsName - the service on which the event has occurred icapServiceStatsDeferredReqs - the number of deferred connections on the service, at the time of event icapServiceStatsQueuedReqs - the number of queued connections on the service, at the time of event.
bluecoatSgICAPMIBConformance	1.3.6.1.4.1.3417.2.14.3
bluecoatSgICAPMIBCompliances	1.3.6.1.4.1.3417.2.14.3.1
bluecoatSgICAPMIBCompliance	1.3.6.1.4.1.3417.2.14.3.1.1			The compliance statement for ICAP Module.
bluecoatSgICAPMIBGroups	1.3.6.1.4.1.3417.2.14.3.2
bluecoatSgICAPMIBGroup	1.3.6.1.4.1.3417.2.14.3.2.1			Group of ICAP-related objects implemented in ProxySG appliances.
bluecoatSgICAPMIBNotifGroups	1.3.6.1.4.1.3417.2.14.3.3
bluecoatSgICAPMIBNotifGroup	1.3.6.1.4.1.3417.2.14.3.3.1			Group of ICAP notifications implemented in ProxySG appliances.

RFC description

Manages Internet Content Adaptation Protocol (ICAP) integration with Blue Coat ProxySG appliances for content scanning and filtering.

Start monitoring Blue Coat secure web gateway appliances with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download BLUECOAT-SG-ICAP-MIB