DRAFT-IETF-SYSLOG-MIB

All MIBs › DRAFT-IETF-SYSLOG-MIB

Organization: IETF Syslog Working Group

Last Updated: 2002-12-25

Category: Standard: IETF, Technology: Logging/Syslog

Description: Draft IETF MIB for managing syslog configuration, message formatting, and destination server settings.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is DRAFT-IETF-SYSLOG-MIB?

DRAFT-IETF-SYSLOG-MIB is a draft IETF, vendor-neutral MIB covering the reception, processing, and formatting of Syslog-compatible messages on a device, complementing the device-side generation MIB. It is expected to expose configuration for syslog message severity filtering, formatting options, and destination settings, though no sample objects were available in this batch to confirm specific table names. Its monitoring relevance is largely on the software/logging-configuration side, verifying that a device's syslog processing is correctly configured rather than reporting hardware sensor data. It is a companion standard to DRAFT-IETF-SYSLOG-DEVICE-MIB and the underlying RFC 3164/5424 syslog protocol definitions. It is deployed on network devices and hosts that need standardized, SNMP-manageable syslog configuration across a mixed-vendor network. Engineers implementing or auditing this functionality typically reference the DRAFT-IETF-SYSLOG-MIB RFC/standard documentation for the authoritative specification.

IPNetwork Monitor allows you to monitor SNMP objects defined in DRAFT-IETF-SYSLOG-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

vendor-neutral, standards-based MIB, not tied to a specific manufacturer
any network device or host generating/processing syslog messages

Monitoring Examples

No sample objects were provided for this module, so specific object or table names cannot be confirmed from source; based on the module description, it would be expected to define objects for configuring syslog message severity thresholds and destination server settings, analogous to the collector table seen in the companion DRAFT-IETF-SYSLOG-DEVICE-MIB, but this cannot be verified without the actual MIB objects.

What Can Be Monitored

syslog message formatting configuration
syslog destination server settings

Imported Objects

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Integer32
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32
mib-2

From SNMPv2-TC

RowStatus
TEXTUAL-CONVENTION
TimeStamp

OIDs

OID symbolic	OID numeric	Type	Access	Description
IP syslogAllowedHostsAddress	1.3.6.1.2.1.999999.2.3.1.2	InetAddress	read-create	The IP address or hostname specification of the host from which the syslog process will accept messages.
IPt syslogAllowedHostsAddressType	1.3.6.1.2.1.999999.2.3.1.1	InetAddressType	read-create	The type of Internet address which follows in syslogAllowedHostsAddress.
syslogAllowedHostsEntry	1.3.6.1.2.1.999999.2.3.1		not-accessible	The host information.
I32 syslogAllowedHostsMaskLen	1.3.6.1.2.1.999999.2.3.1.3	Integer32	read-create	If the syslogAllowedHostsAddressType is ipv4(1), ipv6(2) this object represents the number of bits that will be taken into account when the address of the originating is being compared with syslogAllowedHostsAddress. The default value of this MO will be the length of the corresponding syslogAllowedHostsAddress. If the syslogAllowedHostsAddressType is not ipv4(1) or ipv6(2) this object is not used.
SYS syslogAllowedHostsPort	1.3.6.1.2.1.999999.2.3.1.5	SyslogService	read-create	The Port specification that will be used to decide whether the messsage will be accepted from a host or not.
ROW syslogAllowedHostsRowStatus	1.3.6.1.2.1.999999.2.3.1.6	RowStatus	read-create	This object is used to create and delete rows in the syslogAllowedHostsTable.
syslogAllowedHostsTable	1.3.6.1.2.1.999999.2.3		not-accessible	A table containing information about the Hosts from which messages will be accepted (rejected).
SYS syslogAllowedHostsTransport	1.3.6.1.2.1.999999.2.3.1.4	SyslogTransport	read-create	The Transport specification that will be used to decide whether the messsage will be accepted from a host or not.
syslogCompliance	1.3.6.1.2.1.999999.4.2.1			The compliance statement for an agent implememting the syslog MIB.
syslogCompliances	1.3.6.1.2.1.999999.4.2
syslogConformance	1.3.6.1.2.1.999999.4
syslogControl	1.3.6.1.2.1.999999.3
syslogControlGroup	1.3.6.1.2.1.999999.4.1.4			A collection of objects that represent the rules that describe how a message will be selected, and the action(s) that will be carried out on the selected message.
I32 syslogCtlActionIndex	1.3.6.1.2.1.999999.3.1.1.1	Integer32	not-accessible	An index that uniquely identifies an action group in the Table.
IP syslogCtlForwardActionAddr	1.3.6.1.2.1.999999.3.4.1.4	InetAddress	read-create	The Internet address for the Syslog message collector. The type of the address is specified in the preceeding syslogCtlForwardActionAddrType object. The use of DNS domain names is discouraged, and agent support for them is optional. Deciding when, and how often, to resolve them is an issue. Not resolving them often enough could lead to loss synchronization with the associated entry in the DNS server, and resolving them too often might lead to significant overhead during critical network events.
IPt syslogCtlForwardActionAddrType	1.3.6.1.2.1.999999.3.4.1.3	InetAddressType	read-create	The type of Internet address which follows in syslogCtlForwardActionAddr.
STR syslogCtlForwardActionDescr	1.3.6.1.2.1.999999.3.4.1.2	SnmpAdminString	read-create	Administratively assigned textual description of this syslogForwardAction.
syslogCtlForwardActionEntry	1.3.6.1.2.1.999999.3.4.1		not-accessible	Defines the information pertaining to a syslog collector to which a syslog messages will be relayed. Entries within this table with an access level of read- create MUST be considered non-volatile and MUST be maintained across entity resets.
SYS syslogCtlForwardActionFacility	1.3.6.1.2.1.999999.3.4.1.7	SyslogFacility	read-create	The syslog facility code that will added to messages forwarded to this collector, if, a priority level is not defined in the received message.
U32 syslogCtlForwardActionIndex	1.3.6.1.2.1.999999.3.4.1.1	Unsigned32	not-accessible	A unique identifier for this syslogForwardAction entry.
SYS syslogCtlForwardActionPort	1.3.6.1.2.1.999999.3.4.1.6	SyslogService	read-create	The port number on the destination to which the syslog message will be forwarded over the transport specified by syslogCtlForwardActionTransport.
ROW syslogCtlForwardActionRowStatus	1.3.6.1.2.1.999999.3.4.1.9	RowStatus	read-create	This object is used to create and delete rows in the syslogCtlForwardActionTable.
SYS syslogCtlForwardActionSeverity	1.3.6.1.2.1.999999.3.4.1.8	SyslogSeverity	read-create	The syslog severity code that will added to messages forwarded to this collector, if, a priority level is not defined in the received message.
syslogCtlForwardActionTable	1.3.6.1.2.1.999999.3.4		not-accessible	A table containing Syslog collector information.
SYS syslogCtlForwardActionTransport	1.3.6.1.2.1.999999.3.4.1.5	SyslogTransport	read-create	The Transport that will be used to forward the message.
syslogCtlLogActionEntry	1.3.6.1.2.1.999999.3.2.1		not-accessible	Defines the information to generate syslog messages to an aggregating agent or collector. Entries within this table with an access level of read- create MUST be considered non-volatile and MUST be maintained across entity resets.
STR syslogCtlLogActionFileName	1.3.6.1.2.1.999999.3.2.1.1	SnmpAdminString	read-create	The fullpath name of the file in which the message will be logged. This file should be existing before the syslog process attempts to append messages to it.
ROW syslogCtlLogActionRowStatus	1.3.6.1.2.1.999999.3.2.1.2	RowStatus	read-create	This object is used to create and delete rows in the syslogCtlLogTable.
syslogCtlLogActionTable	1.3.6.1.2.1.999999.3.2		not-accessible	A table containing Syslog LogAction Entries.
STR syslogCtlPipeActionCmd	1.3.6.1.2.1.999999.3.5.1.1	SnmpAdminString	read-create	The command to which the selected message will be piped.
syslogCtlPipeActionEntry	1.3.6.1.2.1.999999.3.5.1		not-accessible	A user to whom the message should be notified.
ROW syslogCtlPipeActionRowStatus	1.3.6.1.2.1.999999.3.5.1.2	RowStatus	read-create	This object is used to create and delete rows in the syslogCtlPipeActionTable.
syslogCtlPipeActionTable	1.3.6.1.2.1.999999.3.5		not-accessible	A table containing commands to which selected messages will be piped.
STR syslogCtlSelectionDescr	1.3.6.1.2.1.999999.3.1.1.3	SnmpAdminString	read-create	A description of the Selection
syslogCtlSelectionEntry	1.3.6.1.2.1.999999.3.1.1		not-accessible	Defines the information to generate syslog messages to an aggregating agent or collector. Entries within this table with an access level of read- create MUST be considered non-volatile and MUST be maintained across entity resets.
SYS syslogCtlSelectionFacility	1.3.6.1.2.1.999999.3.1.1.9	SyslogFacility	read-create	The facility represented by the row.
STR syslogCtlSelectionHostname	1.3.6.1.2.1.999999.3.1.1.5	SnmpAdminString	read-create	The hostname represented by the row. An asterisk indicates all hosts.
INT syslogCtlSelectionHostNameIncl	1.3.6.1.2.1.999999.3.1.1.4	INTEGER	read-create	Indicates whether the corresponding instance of syslogCtlSelectionHostName define a hostname which is included or excluded from the selection for the action.
I32 syslogCtlSelectionIndex	1.3.6.1.2.1.999999.3.1.1.2	Integer32	not-accessible	An index that uniquely identifies the row within the set of rows belonging to the same action group.
INT syslogCtlSelectionPriorityIncl	1.3.6.1.2.1.999999.3.1.1.8	INTEGER	read-create	Indicates whether the corresponding instances of syslogCtlSelectionFacility and syslogCtlSelectionSeverity define a priority which is included or excluded from the selection for the action.
STR syslogCtlSelectionProgName	1.3.6.1.2.1.999999.3.1.1.7	SnmpAdminString	read-create	The program name represented by the row. An asterisk indicates all hosts.
INT syslogCtlSelectionProgNameIncl	1.3.6.1.2.1.999999.3.1.1.6	INTEGER	read-create	Indicates whether the corresponding instance of syslogCtlSelectionProgName define a program name which is included or excluded from the selection for the action.
ROW syslogCtlSelectionRowStatus	1.3.6.1.2.1.999999.3.1.1.12	RowStatus	read-create	This object is used to create and delete rows in the syslogCtlSelectionTable.
SYS syslogCtlSelectionSeverity	1.3.6.1.2.1.999999.3.1.1.11	SyslogSeverity	read-create	The severity represented by the row.
SYS syslogCtlSelectionSeverityCompOP	1.3.6.1.2.1.999999.3.1.1.10	SyslogSeverityCompOP	read-create	Represents the operator that should apply to the syslogCtlSelectionSeverity MO before the selection takes place.
syslogCtlSelectionTable	1.3.6.1.2.1.999999.3.1		not-accessible	A table which defines the rules for selection of syslog messages for some specified actions.
syslogCtlUserActionEntry	1.3.6.1.2.1.999999.3.3.1		not-accessible	A user to whom the message should be notified.
U32 syslogCtlUserActionIndex	1.3.6.1.2.1.999999.3.3.1.1	Unsigned32	not-accessible	An index to uniquely identify the userID among the group of userIDs.
ROW syslogCtlUserActionRowStatus	1.3.6.1.2.1.999999.3.3.1.3	RowStatus	read-create	This object is used to create and delete rows in the syslogCtlUserActionTable.
syslogCtlUserActionTable	1.3.6.1.2.1.999999.3.3		not-accessible	A table containing list of users to whom a notification will be sent (by displaying the message on the users' console, if the user is logged in.
STR syslogCtlUserActionUserID	1.3.6.1.2.1.999999.3.3.1.2	SnmpAdminString	read-create	The userid of the user to whom the message will be displayed on the console if, the user is logged in. Note: the userid ''*'' denotes all users.
SYS syslogDefaultFacility	1.3.6.1.2.1.999999.1.3	SyslogFacility	read-write	The default syslog facility that will be added to syslog messages when the message needs to be relayed and does not have priority specified.
SYS syslogDefaultService	1.3.6.1.2.1.999999.1.2	SyslogService	read-write	The default service name or port number that a syslog process will use to send syslog messages.
SYS syslogDefaultSeverity	1.3.6.1.2.1.999999.1.4	SyslogSeverity	read-write	The default syslog severity that will be added to syslog messages when the message needs to be relayed and does not have priority specified.
SYS syslogDefaultTransport	1.3.6.1.2.1.999999.1.1	SyslogTransport	read-write	The default transport that a syslog process will use to send syslog messages.
syslogGroups	1.3.6.1.2.1.999999.4.1
U32 syslogMaxMessageSize	1.3.6.1.2.1.999999.1.5	Unsigned32	read-write	The the maximum size of the syslog messages in bytes.
syslogMIB	1.3.6.1.2.1.999999			The MIB module pertaining to the reception and processing of Syslog compatible messages.
IP syslogParamsBindAddr	1.3.6.1.2.1.999999.2.2.1.3	InetAddress	read-create	The specific IP address or hostname the syslog process will bind to. If a hostname is specified, the IPv4 or IPv6 address which corresponds to will be used.
IPt syslogParamsBindAddrType	1.3.6.1.2.1.999999.2.2.1.2	InetAddressType	read-create	The type of Internet address which follows in syslogParamsBindAddr.
INT syslogParamsCompression	1.3.6.1.2.1.999999.2.2.1.5	INTEGER	read-write	If 'off', disable the compression of repeated instances of the same line into a single line of the form ``last message repeated N times''. If 'offIfPipe' disable the compression when the output is a pipe to another program. Otherwise the compression is enabled.
STR syslogParamsConfFileName	1.3.6.1.2.1.999999.2.2.1.6	SnmpAdminString	read-create	The fullpath name of the configuration file where the syslog process's message selection and corresponding action rules will be read from and stored.
INT syslogParamsDNSLookup	1.3.6.1.2.1.999999.2.2.1.9	INTEGER	read-write	If doNotUseLocalCache is on, fresh DNS lookups will be carried out everytime a hostname is encountered. Else, DNS lookups will be carried it only once for each hostname.
syslogParamsEntry	1.3.6.1.2.1.999999.2.2.1		not-accessible	The parameters pertaining to a syslog process.
INT syslogParamsFacilityTranslation	1.3.6.1.2.1.999999.2.2.1.7	INTEGER	read-write	If off, disable Disable the translation of messages received with facility ``kern'' to facility ``user''. Usually the ``kern'' facility is reserved for messages read directly from /dev/klog.
syslogParamsGroup	1.3.6.1.2.1.999999.4.1.3			A collection of objects representing the run time parameters for the syslog processes.
STR syslogParamsPIDFileName	1.3.6.1.2.1.999999.2.2.1.8	SnmpAdminString	read-create	The fullpath name of the file where the syslog process ID will be recorded.
STR syslogParamsProcDescr	1.3.6.1.2.1.999999.2.2.1.1	SnmpAdminString	read-create	A description of the syslog process.
INT syslogParamsProcessStatus	1.3.6.1.2.1.999999.2.2.1.12	INTEGER	read-create	''started'' indicates that the process should be started if it is not already running. ''stopped'' indicates that the process should be stopped if it is running.
ROW syslogParamsRowStatus	1.3.6.1.2.1.999999.2.2.1.13	RowStatus	read-create	This object is used to create and delete rows in the syslogParamsTable.
INT syslogParamsSecuritySpecs	1.3.6.1.2.1.999999.2.2.1.11	INTEGER	read-create	If doNotRecvFromRemoteHosts is selected then the corresponding syslog process will receive messages from remote hosts. If doNotOpenNetworkSockets is selected then the syslog process will not receive from or forward to remote hosts.
INT syslogParamsSendToAllAddresses	1.3.6.1.2.1.999999.2.2.1.4	INTEGER	read-create	If the destination host, for a message to be forwarded, has more than one A or AAAA record process, Send the message to all the addresses (true) else send to only one of the addresses.
SYS syslogParamsSeverityCompOP	1.3.6.1.2.1.999999.2.2.1.10	SyslogSeverityCompOP	read-create	The default value of the operator that should apply to the syslogCtlSelectionSeverity in before the selection takes place.
syslogParamsTable	1.3.6.1.2.1.999999.2.2		not-accessible	A table containing information about the parameters that control the syslog processes.
syslogProc	1.3.6.1.2.1.999999.2
syslogProcEntry	1.3.6.1.2.1.999999.2.1.1		not-accessible	The information pertaining to a syslog process.
I32 syslogProcIndex	1.3.6.1.2.1.999999.2.1.1.1	Integer32	not-accessible	The Index that uniquely identifies the syslog process in the syslogProcess table.
TIM syslogProcLastMsgDeliveredTime	1.3.6.1.2.1.999999.2.1.1.8	TimeStamp	read-only	The local time when the last message was delivered by the syslog process.
TIM syslogProcLastMsgRecdTime	1.3.6.1.2.1.999999.2.1.1.7	TimeStamp	read-only	The local time when the last message was received by the syslog process locally or from a remote syslog process.
C32 syslogProcMsgsDropped	1.3.6.1.2.1.999999.2.1.1.4	Counter32	read-only	The number of messages that could not be relayed (could not be queued for transmitting).
C32 syslogProcMsgsIgnored	1.3.6.1.2.1.999999.2.1.1.5	Counter32	read-only	The number of messages that were not processed by the syslog process because the message did not meet the specification of 'allowed specifications' ( either the program name or the priority level of the message or both did not match any selection specified for this process in the syslogCtlSelectionTable).
C32 syslogProcMsgsReceived	1.3.6.1.2.1.999999.2.1.1.2	Counter32	read-only	The number of messages received by the syslog process. This includes messages that were ignored.
C32 syslogProcMsgsRejected	1.3.6.1.2.1.999999.2.1.1.6	Counter32	read-only	The number of messages that were rejected by the syslog process because the messsage was from a host/service that did not match any selection specified for this process in the syslogCtlSelectionTable and was not on the allowed host/services list.
C32 syslogProcMsgsRelayed	1.3.6.1.2.1.999999.2.1.1.3	Counter32	read-only	The number of messages relayed by the syslog process to other syslog processes.
syslogProcTable	1.3.6.1.2.1.999999.2.1		not-accessible	A table containing information about the syslog processes serviced by an SNMP agent.
syslogStatsGroup	1.3.6.1.2.1.999999.4.1.2			A collection of objects providing message related statistics.
syslogSystem	1.3.6.1.2.1.999999.1
syslogSystemGroup	1.3.6.1.2.1.999999.4.1.1			A collection of objects providing system-wide parameters for syslog processes.

RFC description

Manages reception and processing of syslog messages across different facilities and severity levels for network devices.

Start monitoring Network device/host processing syslog messages (vendor-neutral IETF draft standard) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download DRAFT-IETF-SYSLOG-MIB

What Is DRAFT-IETF-SYSLOG-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description