CISCO-IMAGE-CHECK-MIB

All MIBs › CISCO-IMAGE-CHECK-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2003-05-15

Category: Cisco Devices, Device Management

Description: Manages software image integrity verification using checksums or digital signatures on Cisco devices.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-IMAGE-CHECK-MIB?

CISCO-IMAGE-CHECK-MIB is a Cisco proprietary module for verifying the integrity of software images on Cisco devices using checksums or digital signatures. It exposes an operation table for initiating an image-check request and a results table reporting per-feature/capability check outcomes. Its purpose is explicitly to monitor software integrity and version status — confirming that a firmware or software image has not been corrupted or tampered with before or after an upgrade — rather than any physical hardware attribute. It is closely tied to Cisco's broader image and file-management infrastructure (such as CISCO-FLASH-MIB-style naming) for identifying the image being checked, though it can function largely on its own. It is typically used in network operations workflows around firmware upgrades and security compliance auditing on Cisco IOS/IOS-XE devices, typically starting with a CISCO-IMAGE-CHECK-MIB download to load the module into their management tools.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-IMAGE-CHECK-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco routers and switches (IOS/IOS-XE)

Monitoring Examples

An administrator would populate ciscoImageCheckImageName and ciscoImageCheckSerialNum in ciscoImageCheckOpTable to trigger a checksum/signature verification, then poll ciscoImageCheckStatus and ciscoImageCheckEntryStatus for completion and row lifecycle. Results are read from ciscoImgChkResultsTable, where ciscoImgChkFeatureName and ciscoImgChkCapabilityName identify which feature/capability combination passed or failed. A ciscoImageCheckStatus stuck in a failure state, or an unexpected capability mismatch in the results table, would indicate a corrupted or tampered software image before it is promoted to production.

What Can Be Monitored

image check status
checksum/signature verification result
per-feature check results
capability check results
image name under verification

Imported Objects

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

RowStatus

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoImageCheckMIB	1.3.6.1.4.1.9.9.99990			Initial version of Image Check MIB.
ciscoImageCheckMIBObjects	1.3.6.1.4.1.9.9.99990.1
ciscoImageCheck	1.3.6.1.4.1.9.9.99990.1.1
ciscoImageCheckOpTable	1.3.6.1.4.1.9.9.99990.1.1.1		not-accessible	A table of Image check operation entries. Each entry represents an Image check operation that has been initiated.
ciscoImageCheckOpEntry	1.3.6.1.4.1.9.9.99990.1.1.1.1		not-accessible	An Image check operation entry. Each entry consists of an image name, current status of the check operation and a row status. A management station wishing to create an entry should first generate a pseudo-random serial number to be used as the index to this sparse table. The station should then create the associated instance of the row status object. It must also, create the associated instance of the image name. This image is checked for compatibility with the image already running on the active supervisor. Once the appropriate instances of all the mandatory objects have been created, either by an explicit SNMP set request or by default, the row status should be set to active to initiate the operation. Note that this entire procedure may be initiated via a single set request which specifies a row status of createAndGo. Once an operation has been activated, it cannot be stopped. Once the operation completes, the management station should retrieve the value of the status object and delete the entry. In order to prevent old entries from clogging the table, entries will be aged out, but an entry will never be deleted within 5 minutes of completing.
I32 ciscoImageCheckSerialNum	1.3.6.1.4.1.9.9.99990.1.1.1.1.1	Integer32	not-accessible	Object which specifies a unique entry in the table. A management station wishing to initiate a check operation should use a pseudo-random value for this object when creating or modifying an instance of a ciscoImageCheckOpEntry.
STR ciscoImageCheckImageName	1.3.6.1.4.1.9.9.99990.1.1.1.1.2	SnmpAdminString	read-create	Image file name that needs the verification. If the Image name is NULL then it is assumed that the image check is to be done with the image on standby supervisor.
INT ciscoImageCheckStatus	1.3.6.1.4.1.9.9.99990.1.1.1.1.3	INTEGER	read-only	The current status of the image check operation. If the status is inCompatLoose(3) or inCompatStrict(4), one can look at the detail reasons of incompatibilities by looking at ciscoImgChkResultsTable described below. If the status is compatible, then there is no need to look at the ciscoImgChkResultsTable. If the status is noStandby(6), pssErr(7), extractFail(8), fileParseErr(9) or getIncompatErr(10), there is some internal error in even starting the check compatibility process, and hence the ciscoImgChkResultsTable should not be read for any details. inProgress(2) - Image check is in progress inCompatLoose(3) - Loose incompatibility inCompatStrict(4) - Strict incompatibility compatible(5) - images are compatible noStandby(6) - standby supervisor is absent pssErr(7) - internal error extractFail(8) - Could not extract image fileParseErr(9) - Could not parse image getIncompatErr(10) - internal error in determining incompatibilities.
ROW ciscoImageCheckEntryStatus	1.3.6.1.4.1.9.9.99990.1.1.1.1.4	RowStatus	read-create	The status of this table entry.
ciscoImgChkResultsTable	1.3.6.1.4.1.9.9.99990.1.1.2		not-accessible	This table lists the features and capabilities that are incompatible for the request that was made corresponding to the instance of ciscoImgChkFeatureIndex in the ciscoImageCheckOpTable.
ciscoImgChkResultsEntry	1.3.6.1.4.1.9.9.99990.1.1.2.1		not-accessible	An entry of ciscoImgChkResultsTable.
I32 ciscoImgChkFeatureIndex	1.3.6.1.4.1.9.9.99990.1.1.2.1.1	Integer32	not-accessible	The index of the incompatible feature.
I32 ciscoImgChkCapabIndex	1.3.6.1.4.1.9.9.99990.1.1.2.1.2	Integer32	not-accessible	The index of the incompatible capability.
STR ciscoImgChkFeatureName	1.3.6.1.4.1.9.9.99990.1.1.2.1.3	SnmpAdminString	read-only	The name of the incompatible feature. The list of features is subject to implementation in a given software release. The current list of features is as follows - fspf - FSPF Routing Protocol Application fcmpls - Multi-Protocol Label Switching fib - FIB Manager flogi - F Port Server rscn - RSCN Module fcns - Name Server fcdomain - Domain Manager fc-tunnel - FC MPLS tunnel ipfc - Ipfc Manager ipconf - IP Configuration Manager ips - IPS Manager port - Port Manager port-channel - Port Channel Manager span - Switch Port Analyzer sysmgr-ver - System Manager version controller vrrp-cfg - VRRP Configuration vsan - VSAN manager zone - Zone Server
STR ciscoImgChkCapabilityName	1.3.6.1.4.1.9.9.99990.1.1.2.1.4	SnmpAdminString	read-only	The name of the incompatible capability. The list of capabilities is subject to implementation in a given software release. The current list of capabilities is as follows - CAP_FEATURE_SPAN_FCFWD_STBY_POP_ENABLED CAP_FEATURE_SPAN_IF_VSAN_SRC_MIX_NOT_ALLOWED CAP_FEATURE_SPAN_IF_SRC_VSAN_FILTER_NOT_ALLOWED CAP_FEATURE_SPAN_FC_TUNNEL_CFG CAP_FEATURE_SPAN_ST_PORT_CFG CAP_FEATURE_SPAN_FCIP_SRC_CFG CAP_FEATURE_SPAN_ISCSI_SRC_CFG CAP_FEATURE_ZS_READ_ONLY_ZONING CAP_FEATURE_ZS_LUN_ZONING CAP_FEATURE_PORT_MODE_ST_CFG CAP_FEATURE_FC_TUNNEL_CFG CAP_FEATURE_PORT_PERFORMANCE_BUF
INT ciscoImgChkCapabilityReq	1.3.6.1.4.1.9.9.99990.1.1.2.1.5	INTEGER	read-only	Whether capability check is strict or loose.
STR ciscoImgChkInCompDescr	1.3.6.1.4.1.9.9.99990.1.1.2.1.6	SnmpAdminString	read-only	Description of the incompatibilty. For example, if the name of the incompatibilty (the instance of ciscoImgChkCapabilityName) is CAP_FEATURE_ZS_READ_ONLY_ZONING, then the description will be - 'Zone Server - Read-only zoning configured'. For each incompatibility name that appears in ciscoImgChkCapabilityName, there will be a corresponding description described by the instance of this object.
ciscoImageCheckMIBConformance	1.3.6.1.4.1.9.9.99990.2
ciscoImageCheckMIBCompliances	1.3.6.1.4.1.9.9.99990.2.1
ciscoImageCheckMIBCompliance	1.3.6.1.4.1.9.9.99990.2.1.1			The compliance statement for entities which implement the CISCO-IMAGE-CHECK-MIB.
ciscoImageCheckMIBGroups	1.3.6.1.4.1.9.9.99990.2.2
ciscoImageCheckOpGroup	1.3.6.1.4.1.9.9.99990.2.2.1			A collection of objects for Image Check Operations group.
ciscoImgChkResultsGroup	1.3.6.1.4.1.9.9.99990.2.2.2			A collection of objects for Image check results group.

RFC description

Performs high-availability compatibility checks between active and standby supervisor images.

Start monitoring Cisco routers and switches (IOS/IOS-XE image integrity) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-IMAGE-CHECK-MIB

What Is CISCO-IMAGE-CHECK-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description