CISCO-SYSLOG-EXT-MIB

All MIBs › CISCO-SYSLOG-EXT-MIB

Organization: Cisco Systems Inc.

Last Updated: 2005-01-30

Category: Alarm and Event Management, Cisco Devices, Device Management, Routing Protocols

Description: Extends Cisco syslog management with enhanced filtering, rate limiting, and remote server configuration options.

IPNetwork Monitor uses several OIDs from this MIB in network discovery and polling the applicable devices. Start monitoring CISCO-SYSLOG-EXT-MIB with a free 30-day trial of IPNetwork Monitor.

What Is CISCO-SYSLOG-EXT-MIB?

CISCO-SYSLOG-EXT-MIB is a Cisco enterprise MIB that extends system logging management beyond the base RFC 3164 syslog model, providing configuration and monitoring for console logging, file-based logging, and remote syslog server delivery. It exposes objects for console logging enable/severity, log file name and severity filtering, file-logging disable state, and a table of remote syslog servers with address, address type, and per-server severity level. Its monitoring value is in software/logging-subsystem status: administrators verify that console and file logging are enabled at the correct severity, confirm the configured log file destination, and check that remote syslog servers are correctly addressed and receiving messages at the intended severity, which is critical for ensuring fault and event visibility is not silently lost. It builds on and extends the IETF/BSD syslog protocol (RFC 3164) referenced explicitly in its description. It is deployed broadly across Cisco routers and switches wherever centralized log collection and severity-based filtering are required. Engineers can download the CISCO-SYSLOG-EXT-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-SYSLOG-EXT-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco router
Cisco switch

Monitoring Examples

An administrator would check cseSyslogConsoleEnable and cseSyslogConsoleMsgSeverity to confirm console logging is on at the desired severity, then inspect cseSyslogLogFileName and cseSyslogLogFileMsgSeverity to verify local file logging destination and filter level. Walking cseSyslogServerTable/cseSyslogServerEntry for cseSyslogServerAddress and cseSyslogServerMsgSeverity per cseSyslogServerIndex would confirm each remote syslog collector is correctly configured. A remote server entry with an unreachable cseSyslogServerAddress or a severity level set too high (filtering out needed events) would explain missing log entries at a central syslog collector.

What Can Be Monitored

console logging enable/severity
log file name and severity filter
file logging disable state
remote syslog server address and severity per server

Imported Objects

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From CISCO-SYSLOG-MIB

SyslogSeverity

From INET-ADDRESS-MIB

InetAddress
InetAddressType
InetPortNumber

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

RowStatus
TEXTUAL-CONVENTION
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoSyslogExtMIB	1.3.6.1.4.1.9.9.301			MIB module for configuring and monitoring System Log related management parameters as defined by RFC 3164.
ciscoSyslogExtMIBObjects	1.3.6.1.4.1.9.9.301.1
cseSyslogConfigurationGroup	1.3.6.1.4.1.9.9.301.1.1
T/F cseSyslogConsoleEnable	1.3.6.1.4.1.9.9.301.1.1.1	TruthValue	read-write	Indicate whether the Syslog messages should be sent to the console.
SYS cseSyslogConsoleMsgSeverity	1.3.6.1.4.1.9.9.301.1.1.2	SyslogSeverity	read-write	Minimum severity of the message that are sent to the Console.
STR cseSyslogLogFileName	1.3.6.1.4.1.9.9.301.1.1.3	SnmpAdminString	read-write	Name of file to which the Syslog messages are logged. Set operation with a zero length will fail.
SYS cseSyslogLogFileMsgSeverity	1.3.6.1.4.1.9.9.301.1.1.4	SyslogSeverity	read-write	Minimum severity of the message that are sent to the log file (cseSyslogLogFileName).
INT cseSyslogFileLoggingDisable	1.3.6.1.4.1.9.9.301.1.1.5	INTEGER	read-write	Indicates whether the Syslog messages should be sent to the file indicated by cseSyslogLogFileName. Once this object is set to 'true', the Syslog messages are no longer sent to the file. The value of 'cseSyslogLogFileName' is set to zero length string. To restart the file logging, the cseSyslogLogFileName should be set to a valid file name. No action is taken if this object is set to 'noOp'. The value of the object when read is always 'noOp'.
U32 cseSyslogServerTableMaxEntries	1.3.6.1.4.1.9.9.301.1.1.6	Unsigned32	read-only	The maximum number of entries that the agent supports in the cseSyslogServerTable.
cseSyslogServerTable	1.3.6.1.4.1.9.9.301.1.1.7		not-accessible	This table contains all the Syslog servers which are configured.
cseSyslogServerEntry	1.3.6.1.4.1.9.9.301.1.1.7.1		not-accessible	An entry containing information about a Syslog server.
U32 cseSyslogServerIndex	1.3.6.1.4.1.9.9.301.1.1.7.1.1	Unsigned32	not-accessible	An arbitrary integer value, greater than zero, and less than and equal to cseSyslogServerTableMaxEntries, which identifies a Syslog server row in this table.
IPt cseSyslogServerAddressType	1.3.6.1.4.1.9.9.301.1.1.7.1.2	InetAddressType	read-create	The type of the address of the Syslog server which is given by the corresponding value of cseSyslogServerAddress.
IP cseSyslogServerAddress	1.3.6.1.4.1.9.9.301.1.1.7.1.3	InetAddress	read-create	The address of the Syslog server.
SYS cseSyslogServerMsgSeverity	1.3.6.1.4.1.9.9.301.1.1.7.1.4	SyslogSeverity	read-create	Minimum severity of the message that are sent to this Syslog server.
ROW cseSyslogServerStatus	1.3.6.1.4.1.9.9.301.1.1.7.1.5	RowStatus	read-create	The status of this row. A row can not become 'active' until the values for cseSyslogServerAddressType and cseSyslogServerAddress in that row have both been set. A row cannot be created until corresponding instances of following objects are instantiated. - cseSyslogServerAddressType - cseSyslogServerAddress The following objects may not be modified while the value of this object is active (1): - cseSyslogServerAddressType - cseSyslogServerAddress.
SYS cseSyslogServerFacility	1.3.6.1.4.1.9.9.301.1.1.7.1.6	SyslogFacility	read-create	The facility to be used when sending Syslog messages to this server.
SYS cseSyslogServerProtocol	1.3.6.1.4.1.9.9.301.1.1.7.1.7	SyslogProtocol	read-create	The transport protocol used for sending syslog messages to syslog server.
INE cseSyslogServerPort	1.3.6.1.4.1.9.9.301.1.1.7.1.8	InetPortNumber	read-create	The port number of the syslog server to which syslog messages are sent. The default value in case of 'cseSyslogServerProtocol' value of 'udp' is 514. The default value in case of 'cseSyslogServerProtocol' value of 'tcp' is 1468.
SYS cseSyslogServerProtocolFallback	1.3.6.1.4.1.9.9.301.1.1.7.1.9	SyslogProtocol	read-create	This object is used for specifying the protcol to fallback to if the sending of syslog messages using the protocol configured in 'cseSyslogServerProtocol' fails. If the value of this object is same as the value specified in 'cseSyslogServerProtocol', then protocol fallback in case of failure is not supported.
cseSyslogMessageControlTable	1.3.6.1.4.1.9.9.301.1.1.8		not-accessible	This table contains the information about what system log messages should be sent to Syslog host, console, log file, and/or logged into the internal buffer.
cseSyslogMessageControlEntry	1.3.6.1.4.1.9.9.301.1.1.8.1		not-accessible	A system log message control table entry. Each entry specifies a severity for a particular 'facility' which generates Syslog messages. Any generated message which is at least as severe as the specified severity will be logged.
SYS cseSyslogMessageFacility	1.3.6.1.4.1.9.9.301.1.1.8.1.1	SyslogExFacility	not-accessible	System log message facility.
SYS cseSyslogMessageSeverity	1.3.6.1.4.1.9.9.301.1.1.8.1.2	SyslogSeverity	read-write	Minimum severity of the message that are generated by this Syslog message facility.
T/F cseSyslogTerminalEnable	1.3.6.1.4.1.9.9.301.1.1.9	TruthValue	read-write	Indicate whether the Syslog messages should be sent to the terminals.
SYS cseSyslogTerminalMsgSeverity	1.3.6.1.4.1.9.9.301.1.1.10	SyslogSeverity	read-write	Minimum severity of the message that are sent to the terminals.
T/F cseSyslogLinecardEnable	1.3.6.1.4.1.9.9.301.1.1.11	TruthValue	read-write	Indicate whether the Syslog messages should be generated at the line cards.
SYS cseSyslogLinecardMsgSeverity	1.3.6.1.4.1.9.9.301.1.1.12	SyslogSeverity	read-write	Minimum severity of the message that are sent from linecards.
ciscoSyslogExtMIBConformance	1.3.6.1.4.1.9.9.301.2
ciscoSyslogExtMIBCompliances	1.3.6.1.4.1.9.9.301.2.1
ciscoSyslogExtMIBCompliance	1.3.6.1.4.1.9.9.301.2.1.1			The compliance statement for entities which implement the CISCO-SYSLOG-EXT-MIB.
ciscoSyslogExtMIBComplianceRev2	1.3.6.1.4.1.9.9.301.2.1.2			The compliance statement for entities which implement the CISCO-SYSLOG-EXT-MIB.
ciscoSyslogExtMIBGroups	1.3.6.1.4.1.9.9.301.2.2
ciscoSyslogExtGroup	1.3.6.1.4.1.9.9.301.2.2.1			A collection of objects for Syslog management.
ciscoSyslogProtocolGroup	1.3.6.1.4.1.9.9.301.2.2.2			A collection of objects referring to protocol related objects in syslog configuration.

RFC description

Vendor-private MIB extending syslog management per RFC 3164, supporting multiple syslog servers with protocol and facility configuration.

Start monitoring Cisco router/switch (syslog extensions) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-SYSLOG-EXT-MIB

What Is CISCO-SYSLOG-EXT-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description