CISCO-FIREPOWER-EVENT-MIB

All MIBs › CISCO-FIREPOWER-EVENT-MIB

Organization: Cisco Systems Inc.

Last Updated: 2022-08-25

Category: Cisco Devices, Hardware and Environment

Description: Provides management objects for monitoring system events, event channels, and event subscriptions on Cisco UCS/Firepower platforms.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-FIREPOWER-EVENT-MIB?

CISCO-FIREPOWER-EVENT-MIB models the internal event subsystem of Cisco UCS/Firepower platforms, covering event channel control and event holder/queue objects used to buffer and dispatch system events. It exposes control-plane objects for event severity level and revert timeout, plus holder tables tracking queued or retained events. The MIB is fundamentally about monitoring software status: it reveals whether the platform's own event/logging pipeline is healthy, including the severity threshold in force and whether event holders are backing up, which would indicate the management plane is not draining events properly. It belongs to the Cisco UCS/Firepower management information model and shares DN/RN addressing with the rest of the Firepower MIB family. It is deployed on Cisco Firepower/UCS fabric interconnects and chassis managers for event-pipeline health monitoring. Engineers can download the CISCO-FIREPOWER-EVENT-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-FIREPOWER-EVENT-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco Firepower/UCS fabric interconnects and chassis managers

Monitoring Examples

An administrator would poll cfprEventEpCtrlTable, reading cfprEventEpCtrlLevel to confirm the configured event severity threshold and cfprEventEpCtrlRevertTimeout for temporary overrides, then check cfprEventHolderTable entries (identified by cfprEventHolderDn) for growth in queued events. A steadily growing number of entries in cfprEventHolderTable without corresponding drains would suggest the event processing pipeline is stalled or overwhelmed.

What Can Be Monitored

event severity level threshold
event control revert timeout
queued/held event entries
event holder identifiers

Imported Objects

From CISCO-FIREPOWER-MIB

CfprManagedObjectDn
CfprManagedObjectId
ciscoFirepowerMIBObjects	OBJECT-IDENTITY

From CISCO-FIREPOWER-TC-MIB

CfprConditionActionIndicator
CfprConditionCause
CfprConditionCode
CfprConditionRule
CfprConditionSeverity
CfprConditionTag
CfprConditionType
CfprEventEpCtrlLevel
CfprPolicyPolicyOwner

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From CISCO-TC

CiscoAlarmSeverity
CiscoInetAddressMask
CiscoNetworkAddress
TimeIntervalSec
Unsigned64

From INET-ADDRESS-MIB

InetAddressIPv4
InetAddressIPv6

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-SMI

Counter32
Counter64
Gauge32
MODULE-IDENTITY
OBJECT-TYPE
TimeTicks
Unsigned32

From SNMPv2-TC

DateAndTime
DisplayString
MacAddress
RowPointer
TEXTUAL-CONVENTION
TimeInterval
TimeStamp
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
CFP cfprEventEpCtrlDn	1.3.6.1.4.1.9.9.826.1.22.1.1.2	CfprManagedObjectDn	read-only	Cisco Firepower event:EpCtrl:dn managed object property
cfprEventEpCtrlEntry	1.3.6.1.4.1.9.9.826.1.22.1.1		not-accessible	Entry for the cfprEventEpCtrlTable table.
CFP cfprEventEpCtrlInstanceId	1.3.6.1.4.1.9.9.826.1.22.1.1.1	CfprManagedObjectId	not-accessible	Instance identifier of the managed object.
CFP cfprEventEpCtrlLevel	1.3.6.1.4.1.9.9.826.1.22.1.1.4	CfprEventEpCtrlLevel	read-only	Cisco Firepower event:EpCtrl:level managed object property
NUM cfprEventEpCtrlRevertTimeout	1.3.6.1.4.1.9.9.826.1.22.1.1.5	TimeIntervalSec	read-only	Cisco Firepower event:EpCtrl:revertTimeout managed object property
STR cfprEventEpCtrlRn	1.3.6.1.4.1.9.9.826.1.22.1.1.3	SnmpAdminString	read-only	Cisco Firepower event:EpCtrl:rn managed object property
cfprEventEpCtrlTable	1.3.6.1.4.1.9.9.826.1.22.1		not-accessible	Cisco Firepower event:EpCtrl managed object table
CFP cfprEventHolderDn	1.3.6.1.4.1.9.9.826.1.22.2.1.2	CfprManagedObjectDn	read-only	Cisco Firepower event:Holder:dn managed object property
cfprEventHolderEntry	1.3.6.1.4.1.9.9.826.1.22.2.1		not-accessible	Entry for the cfprEventHolderTable table.
CFP cfprEventHolderInstanceId	1.3.6.1.4.1.9.9.826.1.22.2.1.1	CfprManagedObjectId	not-accessible	Instance identifier of the managed object.
STR cfprEventHolderName	1.3.6.1.4.1.9.9.826.1.22.2.1.4	SnmpAdminString	read-only	Cisco Firepower event:Holder:name managed object property
STR cfprEventHolderRn	1.3.6.1.4.1.9.9.826.1.22.2.1.3	SnmpAdminString	read-only	Cisco Firepower event:Holder:rn managed object property
cfprEventHolderTable	1.3.6.1.4.1.9.9.826.1.22.2		not-accessible	Cisco Firepower event:Holder managed object table
CFP cfprEventInstCause	1.3.6.1.4.1.9.9.826.1.22.3.1.4	CfprConditionCause	read-only	Cisco Firepower event:Inst:cause managed object property
STR cfprEventInstChangeSet	1.3.6.1.4.1.9.9.826.1.22.3.1.5	SnmpAdminString	read-only	Cisco Firepower event:Inst:changeSet managed object property
CFP cfprEventInstCode	1.3.6.1.4.1.9.9.826.1.22.3.1.6	CfprConditionCode	read-only	Cisco Firepower event:Inst:code managed object property
DAT cfprEventInstCreated	1.3.6.1.4.1.9.9.826.1.22.3.1.7	DateAndTime	read-only	Cisco Firepower event:Inst:created managed object property
STR cfprEventInstDescr	1.3.6.1.4.1.9.9.826.1.22.3.1.8	SnmpAdminString	read-only	Cisco Firepower event:Inst:descr managed object property
CFP cfprEventInstDn	1.3.6.1.4.1.9.9.826.1.22.3.1.2	CfprManagedObjectDn	read-only	Cisco Firepower event:Inst:dn managed object property
cfprEventInstEntry	1.3.6.1.4.1.9.9.826.1.22.3.1		not-accessible	Entry for the cfprEventInstTable table.
UNS cfprEventInstId	1.3.6.1.4.1.9.9.826.1.22.3.1.9	Unsigned64	read-only	Cisco Firepower event:Inst:id managed object property
CFP cfprEventInstInstanceId	1.3.6.1.4.1.9.9.826.1.22.3.1.1	CfprManagedObjectId	not-accessible	Instance identifier of the managed object.
STR cfprEventInstRn	1.3.6.1.4.1.9.9.826.1.22.3.1.3	SnmpAdminString	read-only	Cisco Firepower event:Inst:rn managed object property
CFP cfprEventInstRule	1.3.6.1.4.1.9.9.826.1.22.3.1.10	CfprConditionRule	read-only	Cisco Firepower event:Inst:rule managed object property
CFP cfprEventInstSeverity	1.3.6.1.4.1.9.9.826.1.22.3.1.11	CfprConditionSeverity	read-only	Cisco Firepower event:Inst:severity managed object property
cfprEventInstTable	1.3.6.1.4.1.9.9.826.1.22.3		not-accessible	Cisco Firepower event:Inst managed object table
CFP cfprEventInstTags	1.3.6.1.4.1.9.9.826.1.22.3.1.12	CfprConditionTag	read-only	Cisco Firepower event:Inst:tags managed object property
CFP cfprEventInstType	1.3.6.1.4.1.9.9.826.1.22.3.1.13	CfprConditionType	read-only	Cisco Firepower event:Inst:type managed object property
CFP cfprEventLogDn	1.3.6.1.4.1.9.9.826.1.22.4.1.2	CfprManagedObjectDn	read-only	Cisco Firepower event:Log:dn managed object property
cfprEventLogEntry	1.3.6.1.4.1.9.9.826.1.22.4.1		not-accessible	Entry for the cfprEventLogTable table.
CFP cfprEventLogInstanceId	1.3.6.1.4.1.9.9.826.1.22.4.1.1	CfprManagedObjectId	not-accessible	Instance identifier of the managed object.
G32 cfprEventLogMaxSize	1.3.6.1.4.1.9.9.826.1.22.4.1.4	Gauge32	read-only	Cisco Firepower event:Log:maxSize managed object property
G32 cfprEventLogPurgeWindow	1.3.6.1.4.1.9.9.826.1.22.4.1.5	Gauge32	read-only	Cisco Firepower event:Log:purgeWindow managed object property
STR cfprEventLogRn	1.3.6.1.4.1.9.9.826.1.22.4.1.3	SnmpAdminString	read-only	Cisco Firepower event:Log:rn managed object property
G32 cfprEventLogSize	1.3.6.1.4.1.9.9.826.1.22.4.1.6	Gauge32	read-only	Cisco Firepower event:Log:size managed object property
cfprEventLogTable	1.3.6.1.4.1.9.9.826.1.22.4		not-accessible	Cisco Firepower event:Log managed object table
cfprEventObjects	1.3.6.1.4.1.9.9.826.1.22			MIB representation of the Cisco Firepower EVENT management information model package
STR cfprEventPolicyDescr	1.3.6.1.4.1.9.9.826.1.22.5.1.4	SnmpAdminString	read-only	Cisco Firepower event:Policy:descr managed object property
CFP cfprEventPolicyDn	1.3.6.1.4.1.9.9.826.1.22.5.1.2	CfprManagedObjectDn	read-only	Cisco Firepower event:Policy:dn managed object property
cfprEventPolicyEntry	1.3.6.1.4.1.9.9.826.1.22.5.1		not-accessible	Entry for the cfprEventPolicyTable table.
CFP cfprEventPolicyInstanceId	1.3.6.1.4.1.9.9.826.1.22.5.1.1	CfprManagedObjectId	not-accessible	Instance identifier of the managed object.
STR cfprEventPolicyIntId	1.3.6.1.4.1.9.9.826.1.22.5.1.5	SnmpAdminString	read-only	Cisco Firepower event:Policy:intId managed object property
STR cfprEventPolicyName	1.3.6.1.4.1.9.9.826.1.22.5.1.6	SnmpAdminString	read-only	Cisco Firepower event:Policy:name managed object property
G32 cfprEventPolicyPolicyLevel	1.3.6.1.4.1.9.9.826.1.22.5.1.7	Gauge32	read-only	Cisco Firepower event:Policy:policyLevel managed object property
CFP cfprEventPolicyPolicyOwner	1.3.6.1.4.1.9.9.826.1.22.5.1.8	CfprPolicyPolicyOwner	read-only	Cisco Firepower event:Policy:policyOwner managed object property
NUM cfprEventPolicyRetentionInterval	1.3.6.1.4.1.9.9.826.1.22.5.1.9	TimeIntervalSec	read-only	Cisco Firepower event:Policy:retentionInterval managed object property
STR cfprEventPolicyRn	1.3.6.1.4.1.9.9.826.1.22.5.1.3	SnmpAdminString	read-only	Cisco Firepower event:Policy:rn managed object property
G32 cfprEventPolicySizeLimit	1.3.6.1.4.1.9.9.826.1.22.5.1.10	Gauge32	read-only	Cisco Firepower event:Policy:sizeLimit managed object property
cfprEventPolicyTable	1.3.6.1.4.1.9.9.826.1.22.5		not-accessible	Cisco Firepower event:Policy managed object table
STR cfprEventRecordAffected	1.3.6.1.4.1.9.9.826.1.22.6.1.4	SnmpAdminString	read-only	Cisco Firepower event:Record:affected managed object property
CFP cfprEventRecordCause	1.3.6.1.4.1.9.9.826.1.22.6.1.5	CfprConditionCause	read-only	Cisco Firepower event:Record:cause managed object property
STR cfprEventRecordChangeSet	1.3.6.1.4.1.9.9.826.1.22.6.1.6	SnmpAdminString	read-only	Cisco Firepower event:Record:changeSet managed object property
CFP cfprEventRecordCode	1.3.6.1.4.1.9.9.826.1.22.6.1.7	CfprConditionCode	read-only	Cisco Firepower event:Record:code managed object property
DAT cfprEventRecordCreated	1.3.6.1.4.1.9.9.826.1.22.6.1.8	DateAndTime	read-only	Cisco Firepower event:Record:created managed object property
STR cfprEventRecordDescr	1.3.6.1.4.1.9.9.826.1.22.6.1.9	SnmpAdminString	read-only	Cisco Firepower event:Record:descr managed object property
CFP cfprEventRecordDn	1.3.6.1.4.1.9.9.826.1.22.6.1.2	CfprManagedObjectDn	read-only	Cisco Firepower event:Record:dn managed object property
cfprEventRecordEntry	1.3.6.1.4.1.9.9.826.1.22.6.1		not-accessible	Entry for the cfprEventRecordTable table.
G32 cfprEventRecordId	1.3.6.1.4.1.9.9.826.1.22.6.1.10	Gauge32	read-only	Cisco Firepower event:Record:id managed object property
CFP cfprEventRecordInd	1.3.6.1.4.1.9.9.826.1.22.6.1.11	CfprConditionActionIndicator	read-only	Cisco Firepower event:Record:ind managed object property
CFP cfprEventRecordInstanceId	1.3.6.1.4.1.9.9.826.1.22.6.1.1	CfprManagedObjectId	not-accessible	Instance identifier of the managed object.
STR cfprEventRecordRn	1.3.6.1.4.1.9.9.826.1.22.6.1.3	SnmpAdminString	read-only	Cisco Firepower event:Record:rn managed object property
STR cfprEventRecordSessionId	1.3.6.1.4.1.9.9.826.1.22.6.1.12	SnmpAdminString	read-only	Cisco Firepower event:Record:sessionId managed object property
CFP cfprEventRecordSeverity	1.3.6.1.4.1.9.9.826.1.22.6.1.13	CfprConditionSeverity	read-only	Cisco Firepower event:Record:severity managed object property
cfprEventRecordTable	1.3.6.1.4.1.9.9.826.1.22.6		not-accessible	Cisco Firepower event:Record managed object table
G32 cfprEventRecordTrig	1.3.6.1.4.1.9.9.826.1.22.6.1.14	Gauge32	read-only	Cisco Firepower event:Record:trig managed object property
UNS cfprEventRecordTxId	1.3.6.1.4.1.9.9.826.1.22.6.1.15	Unsigned64	read-only	Cisco Firepower event:Record:txId managed object property
STR cfprEventRecordUser	1.3.6.1.4.1.9.9.826.1.22.6.1.16	SnmpAdminString	read-only	Cisco Firepower event:Record:user managed object property

RFC description

MIB representation of Cisco Firepower event management information model tracking system conditions, rules, and event processing.

Start monitoring Cisco Firepower/UCS fabric interconnects and chassis managers with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-FIREPOWER-EVENT-MIB

What Is CISCO-FIREPOWER-EVENT-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description