CISCOSB-SYSLOG-MIB

All MIBs › CISCOSB-SYSLOG-MIB

Organization: Cisco Small Business

Last Updated: 2006-02-12

Category: Alarm and Event Management, Vendor: RADLAN/Cisco SB

Description: Manages syslog server destinations, severity filters, and log message buffering on Cisco Small Business devices.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCOSB-SYSLOG-MIB?

CISCOSB-SYSLOG-MIB is a Cisco Small Business private MIB governing the device's syslog subsystem, including global logging enable, minimum severity thresholds for console/file/cache logging, and a table of recent log entries. It exposes control objects to clear the log file or cache, plus per-entry log data such as a counter, timestamp, and application mnemonic identifying the software module that generated each message. This is a software-status/fault-visibility MIB: it lets an administrator confirm logging is enabled at appropriate severity levels and retrieve recent log entries via SNMP to spot recurring errors, unexpected reboots, or configuration changes reflected in the log stream. It is a self-contained CISCOSB private-tree MIB, though it parallels the general-purpose IETF SYSLOG-MSG-MIB concept. It is used on small-business switches/routers where centralized fault visibility is needed without direct console or syslog-server access. Network engineers evaluating or troubleshooting this functionality can download the CISCOSB-SYSLOG-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCOSB-SYSLOG-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco Small Business switches and routers

Monitoring Examples

An administrator would poll rlSyslogLogTable/rlSyslogLogEntry to read rlSyslogLogDateTime and rlSyslogLogAppMnemonic for recent entries, checking rlSyslogLogCounter to see how many messages have accumulated since the last check. Verifying rlSyslogMinLogToCacheSeverity and rlSyslogMinLogToFileSeverity confirms that critical-level events are being captured rather than filtered out. A rapidly incrementing rlSyslogLogCounter combined with repeated entries from the same rlSyslogLogAppMnemonic typically signals a flapping interface or repeating software fault worth investigating.

What Can Be Monitored

logging enable status
minimum severity thresholds (console/file/cache)
log entry count
log entry timestamp and source module
log file/cache clear status

Imported Objects

From CISCOSB-MIB

switch001

MODULE-IDENTITY

From SNMPv2-SMI

Counter32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
RowStatus
TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using rlSyslogConsoleMessagesIgnored OID:

Select a Cisco Small Business switch or router as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type rlSyslogConsoleMessagesIgnored into the Find box to locate it in the OID tree, then select it and click OK. This is a count of messages not sent to the console because the severity level of the message was above rlSyslogMinLogToConsoleSeverity, the higher the level, the lower the severity. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
rlSyslog	1.3.6.1.4.1.9.6.1.101.82			The private MIB module definition for SYSLOG services in CISCOSB devices.
rlSyslogPrivate	1.3.6.1.4.1.9.6.1.101.82.2
T/F rlSyslogGlobalEnable	1.3.6.1.4.1.9.6.1.101.82.2.1	TruthValue	read-write	Global enable for syslog flash, syslog cache and syslog UDP. When set to false, only console logging is performed.
RLS rlSyslogMinLogToConsoleSeverity	1.3.6.1.4.1.9.6.1.101.82.2.2	RlSyslogSeverity	read-write	The minimal severity to log to console. Lower severity will not be written to console. Value notActive indicate this activity is disabled.
RLS rlSyslogMinLogToFileSeverity	1.3.6.1.4.1.9.6.1.101.82.2.3	RlSyslogSeverity	read-write	The minimal severity to log to LogFile. Lower severity will not be written to the LogFile. Value notActive indicates this activity is disabled.
RLS rlSyslogMinLogToCacheSeverity	1.3.6.1.4.1.9.6.1.101.82.2.4	RlSyslogSeverity	read-write	The minimal severity to log to memory cache. Lower severity will not be read from cache. Value notActive indicate this activity is disabled. Note that all events are logged to cache unless its severity is notActive.
U32 rlSyslogClearLogfile	1.3.6.1.4.1.9.6.1.101.82.2.5	Unsigned32	read-write	Setting to a value other than 0 results in deleting the log file.
U32 rlSyslogClearCache	1.3.6.1.4.1.9.6.1.101.82.2.6	Unsigned32	read-write	Setting to a value other than 0 results in clearing the memory cache.
INT rlSyslogMibVersion	1.3.6.1.4.1.9.6.1.101.82.2.7	INTEGER	read-only	The Syslog MIB's version. It's 1.
rlSyslogLogTable	1.3.6.1.4.1.9.6.1.101.82.2.8		not-accessible	A table containing events sent to the system log file.
rlSyslogLogEntry	1.3.6.1.4.1.9.6.1.101.82.2.8.1		not-accessible	A log entry
U32 rlSyslogLogCounter	1.3.6.1.4.1.9.6.1.101.82.2.8.1.1	Unsigned32	read-only	A counter that identifies this entry - used to differentiate logged entries. And the order given is the order of logging. A entries may not form sequence of this value. (Time is not a differentiating element as logged entries may come in a sequence.
STR rlSyslogLogDateTime	1.3.6.1.4.1.9.6.1.101.82.2.8.1.2	DisplayString	read-only	The time in string (formated DD-MMM-YYYY HH:MM:SS e.g 14-Apr-2002 10:33:31), when the error was logged..
STR rlSyslogLogAppMnemonic	1.3.6.1.4.1.9.6.1.101.82.2.8.1.3	DisplayString	read-only	Application that created this error.
RLS rlSyslogLogSeverity	1.3.6.1.4.1.9.6.1.101.82.2.8.1.4	RlSyslogSeverity	read-only	Severity of the reported error.
STR rlSyslogLogMessageMnemonic	1.3.6.1.4.1.9.6.1.101.82.2.8.1.5	DisplayString	read-only	Short identifier of this message that created this error.
STR rlSyslogLogText1	1.3.6.1.4.1.9.6.1.101.82.2.8.1.6	DisplayString	read-only	The text of the logged message without time and date - part 1.
STR rlSyslogLogText2	1.3.6.1.4.1.9.6.1.101.82.2.8.1.7	DisplayString	read-only	The text of the logged message without time and date - part 2.
STR rlSyslogLogText3	1.3.6.1.4.1.9.6.1.101.82.2.8.1.8	DisplayString	read-only	The text of the logged message without time and date - part 3.
STR rlSyslogLogText4	1.3.6.1.4.1.9.6.1.101.82.2.8.1.9	DisplayString	read-only	The text of the logged message without time and date - part 4.
rlSyslogLogCacheTable	1.3.6.1.4.1.9.6.1.101.82.2.9		not-accessible	A table containing errors registered to system cache.
rlSyslogLogCacheEntry	1.3.6.1.4.1.9.6.1.101.82.2.9.1		not-accessible	A log history entry
U32 rlSyslogLogCacheCounter	1.3.6.1.4.1.9.6.1.101.82.2.9.1.1	Unsigned32	read-only	A counter that identifies this entry - used to differentiate logged entries. And the order given is the order of logging. A entries may not form sequence of this value. (Time is not a differentiating element as logged entries may come in a sequence.
STR rlSyslogLogCacheDateTime	1.3.6.1.4.1.9.6.1.101.82.2.9.1.2	DisplayString	read-only	The time in string (formated DD-MMM-YYYY HH:MM:SS e.g 14-Apr-2002 10:33:31), when the eroor was logged..
STR rlSyslogLogCacheAppMnemonic	1.3.6.1.4.1.9.6.1.101.82.2.9.1.3	DisplayString	read-only	Application that created this error.
RLS rlSyslogLogCacheSeverity	1.3.6.1.4.1.9.6.1.101.82.2.9.1.4	RlSyslogSeverity	read-only	Severity of the reported error.
STR rlSyslogLogCacheMessageMnemonic	1.3.6.1.4.1.9.6.1.101.82.2.9.1.5	DisplayString	read-only	Short identifier of this message that created this error.
STR rlSyslogLogCacheText1	1.3.6.1.4.1.9.6.1.101.82.2.9.1.6	DisplayString	read-only	The text of the logged message without time and date - part 1.
STR rlSyslogLogCacheText2	1.3.6.1.4.1.9.6.1.101.82.2.9.1.7	DisplayString	read-only	The text of the logged message without time and date - part 2.
STR rlSyslogLogCacheText3	1.3.6.1.4.1.9.6.1.101.82.2.9.1.8	DisplayString	read-only	The text of the logged message without time and date - part 3.
STR rlSyslogLogCacheText4	1.3.6.1.4.1.9.6.1.101.82.2.9.1.9	DisplayString	read-only	The text of the logged message without time and date - part 4.
C32 rlSyslogConsoleMessagesIgnoredEx	1.3.6.1.4.1.9.6.1.101.82.2.10	Counter32	read-only	This is a count of messages not sent to the console because the severity level of the message was above rlSyslogMinLogToConsoleSeverity, the higher the level, the lower the severity.
C32 rlSyslogFileMessagesIgnored	1.3.6.1.4.1.9.6.1.101.82.2.11	Counter32	read-only	This is a count of messages not sent to the file because the severity level of the message was above rlSyslogMinLogToFileSeverity, the higher the level, the lower the severity.
C32 rlSyslogFileMessagesLogged	1.3.6.1.4.1.9.6.1.101.82.2.12	Counter32	read-only	This is a count of all the messages currently held in the Log file.
C32 rlSyslogCacheTotalMessages	1.3.6.1.4.1.9.6.1.101.82.2.13	Counter32	read-only	This is a count of all the messages currently held in the cache.
T/F rlSyslogAggregationEnable	1.3.6.1.4.1.9.6.1.101.82.2.14	TruthValue	read-write	enable/disable Syslog aggregation
U32 rlSyslogAggregationAgingTime	1.3.6.1.4.1.9.6.1.101.82.2.15	Unsigned32	read-write	aging time for Syslog aggregated messages
RLS rlSyslogMinLogToWebSeverity	1.3.6.1.4.1.9.6.1.101.82.2.16	RlSyslogSeverity	read-write	The minimal severity to log to WEB client. Lower severity will not be displayed in WEB client. Value notActive indicate this activity is disabled.
T/F rlSyslogAlarmFlag	1.3.6.1.4.1.9.6.1.101.82.2.17	TruthValue	read-write	The MIB is initiated by false and it is set to true every time when a syslog message with severity >= min_severity_to_alarm_threshold (host parameter) is generated.
INT rlSyslogOriginId	1.3.6.1.4.1.9.6.1.101.82.2.18	INTEGER	read-write	Defines the origin field of the SYSLOG message packets sent to the SYSLOG server
STR rlSyslogOriginIdString	1.3.6.1.4.1.9.6.1.101.82.2.19	DisplayString	read-write	Defines the string origin of the SYSLOG message packets sent to the SYSLOG server
T/F rlSyslogHeaderSendingEnabled	1.3.6.1.4.1.9.6.1.101.82.2.20	TruthValue	read-write	Enabled sending/not sending of syslog header in syslog messages to syslog collectors.
rlSyslogPhaseOneTests	1.3.6.1.4.1.9.6.1.101.82.3
INT rlSyslogPhaseOneTestGenerator	1.3.6.1.4.1.9.6.1.101.82.3.1	INTEGER	read-write	Writing a value to this leaf results in a test being run on the host.

RFC description

Cisco Small Business private MIB for syslog services configuration managing console, file, and UDP logging severity levels.

Start monitoring Cisco Small Business switches and routers with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCOSB-SYSLOG-MIB