CISCO-SYSLOG-EVENT-EXT-MIB

All MIBs › CISCO-SYSLOG-EVENT-EXT-MIB

Organization: Cisco System Inc.

Last Updated: 2002-02-12

Category: Alarm and Event Management, Cisco Devices, Device Management

Description: Extends syslog event management with Cisco-specific attributes for enhanced log filtering and event correlation.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-SYSLOG-EVENT-EXT-MIB?

CISCO-SYSLOG-EVENT-EXT-MIB is a Cisco-proprietary MIB that extends the standard Cisco Syslog MIB, adding richer classification and display attributes for syslog-based device events across Cisco network equipment. It exposes configuration data describing how syslog messages of different severities should be displayed (console, HTML GUI) and a disposition table tracking event counts by severity and disposition. Rather than monitoring hardware sensors directly, this MIB supports software/event-level health monitoring: tracking the volume and severity distribution of logged events (errors, warnings, faults) a device has generated, a key indicator of software or configuration problems needing attention. It explicitly depends on and extends the Cisco Syslog MIB for its base event/message model. It is typically deployed on Cisco routers, switches, and other network devices where centralized event/log correlation and severity-based alerting are required by network management systems. Engineers can download the CISCO-SYSLOG-EVENT-EXT-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-SYSLOG-EVENT-EXT-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco routers and switches

Monitoring Examples

A monitoring system can poll cslogEventDispositionTable/cslogEventDispositionEntry to read cslogEventDispositionSeverity alongside cslogEventDispositionCount, revealing a spike in high-severity event counts warranting investigation. The cslogEventDetailDefault and cslogEventSeverityDispConsole/cslogEventSeverityDispHtmlGUI objects let an administrator confirm which severities are configured to surface prominently in console or GUI displays. A sudden rise in cslogEventDisposition counts for a given severity level on a device is a common early indicator of a developing hardware or software fault before it triggers a hard failure.

What Can Be Monitored

syslog event counts by severity
event disposition/display configuration
severity-based event thresholds

Imported Objects

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From CISCO-SYSLOG-MIB

SyslogSeverity

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

TEXTUAL-CONVENTION

How to Use in IPNetwork Monitor

Example using cslogEventDispositionCount OID:

Select a Cisco router or switch (syslog event extensions) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type cslogEventDispositionCount into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. This is the number of Syslog messages of a specific severity. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoSyslogEventExtMIB	1.3.6.1.4.1.9.9.270			This MIB module extends the Cisco Syslog MIB and provides network management support to handle and process Syslog messages as device events.
ciscoSyslogEventExtMIBObjects	1.3.6.1.4.1.9.9.270.1
cslogEventConfig	1.3.6.1.4.1.9.9.270.1.1
INT cslogEventDetailDefault	1.3.6.1.4.1.9.9.270.1.1.1	INTEGER	read-write	This object defines the detail level at which Syslog messages are displayed on the console or HTML user interface. Detail level classifications are: noDisplay(1) - No display at all. sparseDetail(2) - Minimum detail. normalDetail(3) - General detail. verboseDetail(4) - Verbose detail. exhaustiveDetail(5) - Full detail.
SYS cslogEventSeverityDispConsole	1.3.6.1.4.1.9.9.270.1.1.2	SyslogSeverity	read-write	This object indicates which syslog severity level messages can be displayed on the console. A high severity value implies a low severity. If the display bit on the object cslogEventDisposition is set for this severity, all messages have severity values less than or equal to clogMaxSeverity and this object will be displayed on the console.
SYS cslogEventSeverityDispHtmlGUI	1.3.6.1.4.1.9.9.270.1.1.3	SyslogSeverity	read-write	This object indicates which syslog severity level messages can be displayed on the event log GUI. A high severity value implies a low severity. If the display bit on the object cslogEventDisposition is set for this severity, all messages have severity values less than or equal to clogMaxSeverity and this object will be displayed on the event log GUI web pages.
SYS cslogEventSeverityDispHtmlConsol	1.3.6.1.4.1.9.9.270.1.1.4	SyslogSeverity	read-write	This object indicates which syslog severity level messages can be displayed on the HTML event log console. A high severity value implies a low severity. If the display bit on the object cslogEventDisposition is set for this severity, all messages have severity values less than or equal to clogMaxSeverity and this object will be displayed on the GUI browser console page.
cslogEventDispositionTable	1.3.6.1.4.1.9.9.270.1.1.5		not-accessible	This table contains parameters to configure Syslog message disposition mechanisms and keep message counts.
cslogEventDispositionEntry	1.3.6.1.4.1.9.9.270.1.1.5.1		not-accessible	There is one entry per Syslog severity in the cslogEventDispositionTable. Each entry contains parameters for message disposition and count.
SYS cslogEventDispositionSeverity	1.3.6.1.4.1.9.9.270.1.1.5.1.1	SyslogSeverity	not-accessible	This object defines the Syslog serverity.
CSL cslogEventDisposition	1.3.6.1.4.1.9.9.270.1.1.5.1.2	CslogEventDisposition	read-write	This object defines the disposition method for Syslog messages of a specific severity.
C32 cslogEventDispositionCountEx	1.3.6.1.4.1.9.9.270.1.1.5.1.3	Counter32	read-only	This is the number of Syslog messages of a specific severity.
ciscoSlogEventExtMIBConformance	1.3.6.1.4.1.9.9.270.2
ciscoSlogEventExtMIBCompliances	1.3.6.1.4.1.9.9.270.2.1
ciscoSlogEventExtCompliance	1.3.6.1.4.1.9.9.270.2.1.1			The compliance statement for the cslogEventExt groups.
ciscoSlogEventExtMIBGroups	1.3.6.1.4.1.9.9.270.2.2
ciscoSlogEventExtConfigGroup	1.3.6.1.4.1.9.9.270.2.2.1			These are objects supporting Syslog event configuration.
ciscoSlogEventExtStatsGroup	1.3.6.1.4.1.9.9.270.2.2.2			These are objects to provide Syslog event statistics.

RFC description

Cisco Syslog Event Extension MIB for monitoring and managing syslog event generation and severity levels

Start monitoring Cisco routers and switches (syslog event extensions) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-SYSLOG-EVENT-EXT-MIB