DLINK-3100-SYSLOG-MIB

All MIBs › DLINK-3100-SYSLOG-MIB

Organization: Dlink, Inc.

Last Updated: 2006-02-12

Category: Technology: Logging/Syslog, Vendor: D-Link

Description: Configures system logging destinations, severity levels, and message buffering on D-Link 3100 series switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is DLINK-3100-SYSLOG-MIB?

DLINK-3100-SYSLOG-MIB is a proprietary D-Link MIB for the 3100 series switches that configures and monitors the device's system log subsystem, including global logging enable, per-destination (console, file, cache) minimum severity thresholds, log-clearing operations, and access to buffered log entries. It exposes both configuration (global enable, severity thresholds per destination) and runtime data (a log table with counters, timestamps, and application mnemonics for each stored message). This is a software-health MIB in the fullest sense: it is the channel through which the switch reports internal software faults, warnings, and diagnostic events, and rlSyslogLogTable can be polled to detect recent high-severity entries indicating a problem elsewhere on the device. It is a self-contained private MIB playing a role similar to the standard SYSLOG-MIB concept but with D-Link's own object set. It is deployed on D-Link DES-3100 switches for centralized event logging and as an early-warning source feeding external log/monitoring collectors. Engineers can download the DLINK-3100-SYSLOG-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in DLINK-3100-SYSLOG-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

D-Link DES-3100 series switch

Monitoring Examples

A monitoring system would periodically walk rlSyslogLogTable/rlSyslogLogEntry, reading rlSyslogLogCounter, rlSyslogLogDateTime, and rlSyslogLogAppMnemonic to detect new high-severity entries since the last poll. If rlSyslogMinLogToCacheSeverity is set too high, expected warning-level events might never appear in the cache, so an admin would verify this threshold matches monitoring expectations. Invocations of rlSyslogClearLogfile or rlSyslogClearCache would be tracked to ensure log history isn't being wiped to hide evidence of a fault.

What Can Be Monitored

syslog global enable state
per-destination minimum severity thresholds
logged event count and timestamps
log application source (mnemonic)
log/cache clear events

Imported Objects

From DLINK-3100-MIB

rnd	MODULE-IDENTITY

From SNMPv2-SMI

Counter32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
RowStatus
TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using rlSyslogConsoleMessagesIgnored OID:

Select a D-Link 3100 series switch (DES/DGS-3100), syslog subsystem as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type rlSyslogConsoleMessagesIgnored into the Find box to locate it in the OID tree, then select it and click OK. This is a count of messages not sent to the console because the severity level of the message was above rlSyslogMinLogToConsoleSeverity, the higher the level, the lower the severity. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
rlSyslog	1.3.6.1.4.1.171.10.94.89.89.82			The private MIB module definition for SYSLOG services in DLINK-3100 devices.
rlSyslogPrivate	1.3.6.1.4.1.171.10.94.89.89.82.2
T/F rlSyslogGlobalEnable	1.3.6.1.4.1.171.10.94.89.89.82.2.1	TruthValue	read-write	Global enable for syslog flash, syslog cache and syslog UDP. When set to false, only console logging is performed.
RLS rlSyslogMinLogToConsoleSeverity	1.3.6.1.4.1.171.10.94.89.89.82.2.2	RlSyslogSeverity	read-write	The minimal severity to log to console. Lower severity will not be written to console. Value notActive indicate this activity is disabled.
RLS rlSyslogMinLogToFileSeverity	1.3.6.1.4.1.171.10.94.89.89.82.2.3	RlSyslogSeverity	read-write	The minimal severity to log to LogFile. Lower severity will not be written to the LogFile. Value notActive indicates this activity is disabled.
RLS rlSyslogMinLogToCacheSeverity	1.3.6.1.4.1.171.10.94.89.89.82.2.4	RlSyslogSeverity	read-write	The minimal severity to log to memory cache. Lower severity will not be read from cache. Value notActive indicate this activity is disabled. Note that all events are logged to cache unless its severity is notActive.
U32 rlSyslogClearLogfile	1.3.6.1.4.1.171.10.94.89.89.82.2.5	Unsigned32	read-write	Setting to a value other than 0 results in deleting the log file.
U32 rlSyslogClearCache	1.3.6.1.4.1.171.10.94.89.89.82.2.6	Unsigned32	read-write	Setting to a value other than 0 results in clearing the memory cache.
INT rlSyslogMibVersion	1.3.6.1.4.1.171.10.94.89.89.82.2.7	INTEGER	read-only	The Syslog MIB's version. It's 1.
rlSyslogLogTable	1.3.6.1.4.1.171.10.94.89.89.82.2.8		not-accessible	A table containing events sent to the system log file.
rlSyslogLogEntry	1.3.6.1.4.1.171.10.94.89.89.82.2.8.1		not-accessible	A log entry
U32 rlSyslogLogCounter	1.3.6.1.4.1.171.10.94.89.89.82.2.8.1.1	Unsigned32	read-only	A counter that identifies this entry - used to differentiate logged entries. And the order given is the order of logging. A entries may not form sequence of this value. (Time is not a differentiating element as logged entries may come in a sequence.
STR rlSyslogLogDateTime	1.3.6.1.4.1.171.10.94.89.89.82.2.8.1.2	DisplayString	read-only	The time in string (formated DD-MMM-YYYY HH:MM:SS e.g 14-Apr-2002 10:33:31), when the error was logged..
STR rlSyslogLogAppMnemonic	1.3.6.1.4.1.171.10.94.89.89.82.2.8.1.3	DisplayString	read-only	Application that created this error.
RLS rlSyslogLogSeverity	1.3.6.1.4.1.171.10.94.89.89.82.2.8.1.4	RlSyslogSeverity	read-only	Severity of the reported error.
STR rlSyslogLogMessageMnemonic	1.3.6.1.4.1.171.10.94.89.89.82.2.8.1.5	DisplayString	read-only	Short identifier of this message that created this error.
STR rlSyslogLogText1	1.3.6.1.4.1.171.10.94.89.89.82.2.8.1.6	DisplayString	read-only	The text of the logged message without time and date - part 1.
STR rlSyslogLogText2	1.3.6.1.4.1.171.10.94.89.89.82.2.8.1.7	DisplayString	read-only	The text of the logged message without time and date - part 2.
STR rlSyslogLogText3	1.3.6.1.4.1.171.10.94.89.89.82.2.8.1.8	DisplayString	read-only	The text of the logged message without time and date - part 3.
STR rlSyslogLogText4	1.3.6.1.4.1.171.10.94.89.89.82.2.8.1.9	DisplayString	read-only	The text of the logged message without time and date - part 4.
rlSyslogLogCacheTable	1.3.6.1.4.1.171.10.94.89.89.82.2.9		not-accessible	A table containing errors registered to system cache.
rlSyslogLogCacheEntry	1.3.6.1.4.1.171.10.94.89.89.82.2.9.1		not-accessible	A log history entry
U32 rlSyslogLogCacheCounter	1.3.6.1.4.1.171.10.94.89.89.82.2.9.1.1	Unsigned32	read-only	A counter that identifies this entry - used to differentiate logged entries. And the order given is the order of logging. A entries may not form sequence of this value. (Time is not a differentiating element as logged entries may come in a sequence.
STR rlSyslogLogCacheDateTime	1.3.6.1.4.1.171.10.94.89.89.82.2.9.1.2	DisplayString	read-only	The time in string (formated DD-MMM-YYYY HH:MM:SS e.g 14-Apr-2002 10:33:31), when the eroor was logged..
STR rlSyslogLogCacheAppMnemonic	1.3.6.1.4.1.171.10.94.89.89.82.2.9.1.3	DisplayString	read-only	Application that created this error.
RLS rlSyslogLogCacheSeverity	1.3.6.1.4.1.171.10.94.89.89.82.2.9.1.4	RlSyslogSeverity	read-only	Severity of the reported error.
STR rlSyslogLogCacheMessageMnemonic	1.3.6.1.4.1.171.10.94.89.89.82.2.9.1.5	DisplayString	read-only	Short identifier of this message that created this error.
STR rlSyslogLogCacheText1	1.3.6.1.4.1.171.10.94.89.89.82.2.9.1.6	DisplayString	read-only	The text of the logged message without time and date - part 1.
STR rlSyslogLogCacheText2	1.3.6.1.4.1.171.10.94.89.89.82.2.9.1.7	DisplayString	read-only	The text of the logged message without time and date - part 2.
STR rlSyslogLogCacheText3	1.3.6.1.4.1.171.10.94.89.89.82.2.9.1.8	DisplayString	read-only	The text of the logged message without time and date - part 3.
STR rlSyslogLogCacheText4	1.3.6.1.4.1.171.10.94.89.89.82.2.9.1.9	DisplayString	read-only	The text of the logged message without time and date - part 4.
C32 rlSyslogConsoleMessagesIgnoredEx	1.3.6.1.4.1.171.10.94.89.89.82.2.10	Counter32	read-only	This is a count of messages not sent to the console because the severity level of the message was above rlSyslogMinLogToConsoleSeverity, the higher the level, the lower the severity.
C32 rlSyslogFileMessagesIgnored	1.3.6.1.4.1.171.10.94.89.89.82.2.11	Counter32	read-only	This is a count of messages not sent to the file because the severity level of the message was above rlSyslogMinLogToFileSeverity, the higher the level, the lower the severity.
C32 rlSyslogFileMessagesLogged	1.3.6.1.4.1.171.10.94.89.89.82.2.12	Counter32	read-only	This is a count of all the messages currently held in the Log file.
C32 rlSyslogCacheTotalMessages	1.3.6.1.4.1.171.10.94.89.89.82.2.13	Counter32	read-only	This is a count of all the messages currently held in the cache.
T/F rlSyslogAggregationEnable	1.3.6.1.4.1.171.10.94.89.89.82.2.14	TruthValue	read-write	enable/disable Syslog aggregation
U32 rlSyslogAggregationAgingTime	1.3.6.1.4.1.171.10.94.89.89.82.2.15	Unsigned32	read-write	aging time for Syslog aggregated messages
rlSyslogPhaseOneTests	1.3.6.1.4.1.171.10.94.89.89.82.3
INT rlSyslogPhaseOneTestGenerator	1.3.6.1.4.1.171.10.94.89.89.82.3.1	INTEGER	read-write	Writing a value to this leaf results in a test being run on the host.

RFC description

Manages syslog service configuration and severity filtering for system event logging on D-Link 3100 switches.

Start monitoring D-Link 3100 series switch (DES/DGS-3100), syslog subsystem with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download DLINK-3100-SYSLOG-MIB