EXPRESSION-MIB

MIB Reference — IPNetwork Monitor · Updated October 05, 2026

All MIBs › EXPRESSION-MIB

Organization: IETF Distributed Management Working Group

Last Updated: 2005-11-24

Category: SNMP Framework

Description: Defines managed objects for creating user-defined MIB objects based on mathematical or logical expressions combining other MIB objects.

IPNetwork Monitor uses several OIDs from this MIB in network discovery and polling the applicable devices. Start monitoring EXPRESSION-MIB with a free 30-day trial of IPNetwork Monitor.

What Is EXPRESSION-MIB?

EXPRESSION-MIB is a vendor-neutral IETF module (an early snapshot of work later published as RFC 2982) that defines a generic mechanism for creating computed MIB objects derived from mathematical or logical expressions combining other existing MIB objects. Rather than exposing hardware-specific data itself, it provides a meta-monitoring framework: administrators define named expressions and resource/delta thresholds, and the agent evaluates and exposes the results as new synthetic objects. This makes it broadly useful for monitoring derived conditions such as rate-of-change thresholds, wildcard instance counts, or resource exhaustion warnings computed from any combination of counters, gauges, or other MIB objects already present on the device - effectively building custom performance/fault indicators without vendor-specific code. It fundamentally depends on whatever other standard or vendor MIBs are present on the target device, since expressions reference arbitrary existing objects by OID. It is typically used by advanced NMS deployments needing custom derived metrics (e.g., percentage utilization, delta rates) beyond what any single vendor MIB natively exposes. Engineers implementing or auditing this functionality typically reference the EXPRESSION-MIB RFC/standard documentation for the authoritative specification.

IPNetwork Monitor allows you to monitor SNMP objects defined in EXPRESSION-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

  • vendor-neutral, standards-based MIB, not tied to a specific manufacturer; applicable to any SNMP-managed network device or host

Monitoring Examples

An administrator would define an entry in expNameTable/expNameEntry (keyed by expName and expExpressionIndex) that computes a derived value, then monitor expNameLastChange to detect when the expression definition itself was last modified. expResourceDeltaWildcardInstances and expResourceDeltaWildcardInstanceMaximum would be checked to see how many wildcarded instances an expression is currently tracking versus its configured maximum, while expResourceDeltaWildcardInstanceResourceLacks would flag when the agent lacked sufficient resources to track all matching instances - a sign the expression needs retuning. expNameHighestIndex helps enumerate all currently defined expressions on the agent.

What Can Be Monitored

  • custom/derived expression values
  • expression definition last-change time
  • wildcard instance counts vs. maximum
  • resource shortage for wildcard tracking
  • count of defined expressions
Imported Objects

From CISCO-SMI

ciscoExperimentOBJECT-IDENTITY

From RFC1213-MIB

sysUpTime

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Counter64
Gauge32
Integer32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32
zeroDotZero

From SNMPv2-TC

DisplayString
RowStatus
TEXTUAL-CONVENTION
TimeStamp
TruthValue

How to Use in IPNetwork Monitor

Example using expResourceDeltaWildcardInstanceResourceLacks OID:

Select a SNMP-managed network device or host, any vendor (derived/computed MIB expressions, vendor-neutral IETF draft) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type expResourceDeltaWildcardInstanceResourceLacks into the Find box to locate it in the OID tree, then select it and click OK. The number of times this system could not evaluate an expression because that would have created a value instance in excess of expResourceDeltaWildcardInstanceMaximum. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline (in instances), since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.
OIDs

RFC description

Defines customizable expressions and calculations on MIB objects for advanced network monitoring and alerting.

Start monitoring SNMP-managed network device or host, any vendor (derived/computed MIB expressions, vendor-neutral IETF draft) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download EXPRESSION-MIB