HC-ALARM-MIB

All MIBs › HC-ALARM-MIB

Organization: IETF RMONMIB Working Group

Last Updated: 2002-12-16

Category: Alarm and Event Management, Network Monitoring (RMON)

Description: Defines managed objects extending RMON alarm thresholding to support 64-bit Counter64 data types.

IPNetwork Monitor uses several OIDs from this MIB in network discovery and polling the applicable devices. Start monitoring HC-ALARM-MIB with a free 30-day trial of IPNetwork Monitor.

What Is HC-ALARM-MIB?

HC-ALARM-MIB is the vendor-neutral High Capacity Alarm extension to the RMON MIB, standardized in RFC 3434, and is not tied to any specific manufacturer. It extends the classic RMON alarm table to support 64-bit Counter64 sample values, letting devices threshold on high-speed counters that overflow a 32-bit counter too quickly to be useful. Its data centers on performance monitoring rather than physical hardware health: it defines alarm entries that periodically sample a MIB variable, compare it against configured rising/falling thresholds, and track whether the alarm is currently in an active or normal value-status state. It has an explicit dependency on the base RMON MIB (RFC 2819) alarm mechanism, which it extends, and on whatever high-capacity counter object is being sampled. It is typically deployed on routers, switches, or monitoring probes wherever an administrator needs proactive threshold alarms on high-speed traffic or error counters without relying on external NMS polling. Engineers implementing or auditing this functionality typically reference the HC-ALARM-MIB RFC/standard documentation for the authoritative specification.

IPNetwork Monitor allows you to monitor SNMP objects defined in HC-ALARM-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

vendor-neutral, standards-based MIB, not tied to a specific manufacturer
routers and switches supporting RMON high-capacity alarms
network probes/monitoring appliances

Monitoring Examples

An administrator would configure an hcAlarmEntry pointing hcAlarmVariable at a high-speed traffic counter, setting hcAlarmRisingThreshAbsValueLo/Hi to define the 64-bit threshold split across two 32-bit halves, and would then poll hcAlarmValueStatus to see whether the alarm is currently active. The hcAlarmSampleType and hcAlarmAbsValue objects show whether the alarm samples absolute or delta values and what the current sampled value is. If hcAlarmValueStatus flips to the alarm state after a threshold crossing, it reveals that the underlying high-speed counter has exceeded its configured bound, an event that would go undetected on a legacy 32-bit RMON alarm due to counter wraparound.

What Can Be Monitored

high-speed counter threshold alarms
alarm sample interval
rising/falling threshold values
current alarm value status
startup alarm configuration

Imported Objects

From HCNUM-TC

CounterBasedGauge64

From RMON-MIB

OwnerString
rmon	OBJECT-IDENTITY
rmonEventGroup	OBJECT-GROUP

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

RowStatus
StorageType
TEXTUAL-CONVENTION
VariablePointer

How to Use in IPNetwork Monitor

Example using hcAlarmValueFailedAttempts OID:

Select a device implementing HC-ALARM-MIB as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hcAlarmValueFailedAttempts into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The number of times the associated hcAlarmVariable instance was polled on behalf of this hcAlarmEntry, (while in the active state) and the value was not available. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
hcAlarmMIB	1.3.6.1.2.1.16.29			This module defines Remote Monitoring MIB extensions for High Capacity Alarms. Copyright (C) The Internet Society (2002). This version of this MIB module is part of RFC 3434; see the RFC itself for full legal notices.
hcAlarmObjects	1.3.6.1.2.1.16.29.1
hcAlarmControlObjects	1.3.6.1.2.1.16.29.1.1
hcAlarmTable	1.3.6.1.2.1.16.29.1.1.1		not-accessible	A list of entries for the configuration of high capacity alarms.
hcAlarmEntry	1.3.6.1.2.1.16.29.1.1.1.1		not-accessible	A conceptual row in the hcAlarmTable. Entries are usually created in this table by management application action, but may also be created by agent action as well.
I32 hcAlarmIndex	1.3.6.1.2.1.16.29.1.1.1.1.1	Integer32	not-accessible	An arbitrary integer index value used to uniquely identify this high capacity alarm entry.
I32 hcAlarmInterval	1.3.6.1.2.1.16.29.1.1.1.1.2	Integer32	read-create	The interval in seconds over which the data is sampled and compared with the rising and falling thresholds. When setting this variable, care should be taken in the case of deltaValue sampling - the interval should be set short enough that the sampled variable is very unlikely to increase or decrease by more than 2^63 - 1 during a single sampling interval. This object may not be modified if the associated hcAlarmStatus object is equal to active(1).
NUM hcAlarmVariable	1.3.6.1.2.1.16.29.1.1.1.1.3	VariablePointer	read-create	The object identifier of the particular variable to be sampled. Only variables that resolve to an ASN.1 primitive type of INTEGER (INTEGER, Integer32, Counter32, Counter64, Gauge, or TimeTicks) may be sampled. Because SNMP access control is articulated entirely in terms of the contents of MIB views, no access control mechanism exists that can restrict the value of this object to identify only those objects that exist in a particular MIB view. Because there is thus no acceptable means of restricting the read access that could be obtained through the alarm mechanism, the probe must only grant write access to this object in those views that have read access to all objects on the probe. This object may not be modified if the associated hcAlarmStatus object is equal to active(1).
INT hcAlarmSampleType	1.3.6.1.2.1.16.29.1.1.1.1.4	INTEGER	read-create	The method of sampling the selected variable and calculating the value to be compared against the thresholds. If the value of this object is absoluteValue(1), the value of the selected variable will be compared directly with the thresholds at the end of the sampling interval. If the value of this object is deltaValue(2), the value of the selected variable at the last sample will be subtracted from the current value, and the difference compared with the thresholds. If the associated hcAlarmVariable instance could not be obtained at the previous sample interval, then a delta sample is not possible, and the value of the associated hcAlarmValueStatus object for this interval will be valueNotAvailable(1). This object may not be modified if the associated hcAlarmStatus object is equal to active(1).
NUM hcAlarmAbsValue	1.3.6.1.2.1.16.29.1.1.1.1.5	CounterBasedGauge64	read-only	The absolute value (i.e., unsigned value) of the hcAlarmVariable statistic during the last sampling period. The value during the current sampling period is not made available until the period is completed. To obtain the true value for this sampling interval, the associated instance of hcAlarmValueStatus must be checked, and the value of this object adjusted as necessary. If the MIB instance could not be accessed during the sampling interval, then this object will have a value of zero and the associated instance of hcAlarmValueStatus will be set to 'valueNotAvailable(1)'.
HCV hcAlarmValueStatus	1.3.6.1.2.1.16.29.1.1.1.1.6	HcValueStatus	read-only	This object indicates the validity and sign of the data for the hcAlarmAbsValue object, as described in the HcValueStatus textual convention.
INT hcAlarmStartupAlarm	1.3.6.1.2.1.16.29.1.1.1.1.7	INTEGER	read-create	The alarm that may be sent when this entry is first set to active. If the first sample after this entry becomes active is greater than or equal to the rising threshold and this object is equal to risingAlarm(1) or risingOrFallingAlarm(3), then a single rising alarm will be generated. If the first sample after this entry becomes valid is less than or equal to the falling threshold and this object is equal to fallingAlarm(2) or risingOrFallingAlarm(3), then a single falling alarm will be generated. This object may not be modified if the associated hcAlarmStatus object is equal to active(1).
U32 hcAlarmRisingThreshAbsValueLo	1.3.6.1.2.1.16.29.1.1.1.1.8	Unsigned32	read-create	The lower 32 bits of the absolute value for threshold for the sampled statistic. The actual threshold value is determined by the associated instances of the hcAlarmRisingThreshAbsValueHi and hcAlarmRisingThresholdValStatus objects, as follows: ABS(threshold) = hcAlarmRisingThreshAbsValueLo + (hcAlarmRisingThreshAbsValueHi * 2^^32) The absolute value of the threshold is adjusted as required, as described in the HcValueStatus textual convention. These three object instances are conceptually combined to represent the rising threshold for this entry. When the current sampled value is greater than or equal to this threshold, and the value at the last sampling interval was less than this threshold, a single event will be generated. A single event will also be generated if the first sample after this entry becomes valid is greater than or equal to this threshold and the associated hcAlarmStartupAlarm is equal to risingAlarm(1) or risingOrFallingAlarm(3). After a rising event is generated, another such event will not be generated until the sampled value falls below this threshold and reaches the threshold identified by the hcAlarmFallingThreshAbsValueLo, hcAlarmFallingThreshAbsValueHi, and hcAlarmFallingThresholdValStatus objects. This object may not be modified if the associated hcAlarmStatus object is equal to active(1).
U32 hcAlarmRisingThreshAbsValueHi	1.3.6.1.2.1.16.29.1.1.1.1.9	Unsigned32	read-create	The upper 32 bits of the absolute value for threshold for the sampled statistic. The actual threshold value is determined by the associated instances of the hcAlarmRisingThreshAbsValueLo and hcAlarmRisingThresholdValStatus objects, as follows: ABS(threshold) = hcAlarmRisingThreshAbsValueLo + (hcAlarmRisingThreshAbsValueHi * 2^^32) The absolute value of the threshold is adjusted as required, as described in the HcValueStatus textual convention. These three object instances are conceptually combined to represent the rising threshold for this entry. When the current sampled value is greater than or equal to this threshold, and the value at the last sampling interval was less than this threshold, a single event will be generated. A single event will also be generated if the first sample after this entry becomes valid is greater than or equal to this threshold and the associated hcAlarmStartupAlarm is equal to risingAlarm(1) or risingOrFallingAlarm(3). After a rising event is generated, another such event will not be generated until the sampled value falls below this threshold and reaches the threshold identified by the hcAlarmFallingThreshAbsValueLo, hcAlarmFallingThreshAbsValueHi, and hcAlarmFallingThresholdValStatus objects. This object may not be modified if the associated hcAlarmStatus object is equal to active(1).
HCV hcAlarmRisingThresholdValStatus	1.3.6.1.2.1.16.29.1.1.1.1.10	HcValueStatus	read-create	This object indicates the sign of the data for the rising threshold, as defined by the hcAlarmRisingThresAbsValueLo and hcAlarmRisingThresAbsValueHi objects, as described in the HcValueStatus textual convention. The enumeration 'valueNotAvailable(1)' is not allowed, and the associated hcAlarmStatus object cannot be equal to 'active(1)' if this object is set to this value. This object may not be modified if the associated hcAlarmStatus object is equal to active(1).
U32 hcAlarmFallingThreshAbsValueLo	1.3.6.1.2.1.16.29.1.1.1.1.11	Unsigned32	read-create	The lower 32 bits of the absolute value for threshold for the sampled statistic. The actual threshold value is determined by the associated instances of the hcAlarmFallingThreshAbsValueHi and hcAlarmFallingThresholdValStatus objects, as follows: ABS(threshold) = hcAlarmFallingThreshAbsValueLo + (hcAlarmFallingThreshAbsValueHi * 2^^32) The absolute value of the threshold is adjusted as required, as described in the HcValueStatus textual convention. These three object instances are conceptually combined to represent the falling threshold for this entry. When the current sampled value is less than or equal to this threshold, and the value at the last sampling interval was greater than this threshold, a single event will be generated. A single event will also be generated if the first sample after this entry becomes valid is less than or equal to this threshold and the associated hcAlarmStartupAlarm is equal to fallingAlarm(2) or risingOrFallingAlarm(3). After a falling event is generated, another such event will not be generated until the sampled value rises above this threshold and reaches the threshold identified by the hcAlarmRisingThreshAbsValueLo, hcAlarmRisingThreshAbsValueHi, and hcAlarmRisingThresholdValStatus objects. This object may not be modified if the associated hcAlarmStatus object is equal to active(1).
U32 hcAlarmFallingThreshAbsValueHi	1.3.6.1.2.1.16.29.1.1.1.1.12	Unsigned32	read-create	The upper 32 bits of the absolute value for threshold for the sampled statistic. The actual threshold value is determined by the associated instances of the hcAlarmFallingThreshAbsValueLo and hcAlarmFallingThresholdValStatus objects, as follows: ABS(threshold) = hcAlarmFallingThreshAbsValueLo + (hcAlarmFallingThreshAbsValueHi * 2^^32) The absolute value of the threshold is adjusted as required, as described in the HcValueStatus textual convention. These three object instances are conceptually combined to represent the falling threshold for this entry. When the current sampled value is less than or equal to this threshold, and the value at the last sampling interval was greater than this threshold, a single event will be generated. A single event will also be generated if the first sample after this entry becomes valid is less than or equal to this threshold and the associated hcAlarmStartupAlarm is equal to fallingAlarm(2) or risingOrFallingAlarm(3). After a falling event is generated, another such event will not be generated until the sampled value rises above this threshold and reaches the threshold identified by the hcAlarmRisingThreshAbsValueLo, hcAlarmRisingThreshAbsValueHi, and hcAlarmRisingThresholdValStatus objects. This object may not be modified if the associated hcAlarmStatus object is equal to active(1).
HCV hcAlarmFallingThresholdValStatus	1.3.6.1.2.1.16.29.1.1.1.1.13	HcValueStatus	read-create	This object indicates the sign of the data for the falling threshold, as defined by the hcAlarmFallingThreshAbsValueLo and hcAlarmFallingThreshAbsValueHi objects, as described in the HcValueStatus textual convention. The enumeration 'valueNotAvailable(1)' is not allowed, and the associated hcAlarmStatus object cannot be equal to 'active(1)' if this object is set to this value. This object may not be modified if the associated hcAlarmStatus object is equal to active(1).
I32 hcAlarmRisingEventIndex	1.3.6.1.2.1.16.29.1.1.1.1.14	Integer32	read-create	The index of the eventEntry that is used when a rising threshold is crossed. The eventEntry identified by a particular value of this index is the same as identified by the same value of the eventIndex object. If there is no corresponding entry in the eventTable, then no association exists. In particular, if this value is zero, no associated event will be generated, as zero is not a valid event index. This object may not be modified if the associated hcAlarmStatus object is equal to active(1).
I32 hcAlarmFallingEventIndex	1.3.6.1.2.1.16.29.1.1.1.1.15	Integer32	read-create	The index of the eventEntry that is used when a falling threshold is crossed. The eventEntry identified by a particular value of this index is the same as identified by the same value of the eventIndex object. If there is no corresponding entry in the eventTable, then no association exists. In particular, if this value is zero, no associated event will be generated, as zero is not a valid event index. This object may not be modified if the associated hcAlarmStatus object is equal to active(1).
C32 hcAlarmValueFailedAttemptsEx	1.3.6.1.2.1.16.29.1.1.1.1.16	Counter32	read-only	The number of times the associated hcAlarmVariable instance was polled on behalf of this hcAlarmEntry, (while in the active state) and the value was not available. This counter may experience a discontinuity if the agent restarts, indicated by the value of sysUpTime.
STR hcAlarmOwner	1.3.6.1.2.1.16.29.1.1.1.1.17	OwnerString	read-create	The entity that configured this entry and is therefore using the resources assigned to it.
STO hcAlarmStorageType	1.3.6.1.2.1.16.29.1.1.1.1.18	StorageType	read-create	The type of non-volatile storage configured for this entry. If this object is equal to 'permanent(4)', then the associated hcAlarmRisingEventIndex and hcAlarmFallingEventIndex objects must be writable.
ROW hcAlarmStatus	1.3.6.1.2.1.16.29.1.1.1.1.19	RowStatus	read-create	The status of this row. An entry MUST NOT exist in the active state unless all objects in the entry have an appropriate value, as described in the description clause for each writable object. The hcAlarmStatus object may be modified if the associated instance of this object is equal to active(1), notInService(2), or notReady(3). All other writable objects may be modified if the associated instance of this object is equal to notInService(2) or notReady(3).
hcAlarmCapabilitiesObjects	1.3.6.1.2.1.16.29.1.2
BIT hcAlarmCapabilities	1.3.6.1.2.1.16.29.1.2.1	Bits	read-only	An indication of the high capacity alarm capabilities supported by this agent. If the 'hcAlarmCreation' BIT is set, then this agent allows NMS applications to create entries in the hcAlarmTable. If the 'hcAlarmNvStorage' BIT is set, then this agent allows entries in the hcAlarmTable which will be recreated after a system restart, as controlled by the hcAlarmStorageType object.
hcAlarmNotifications	1.3.6.1.2.1.16.29.2
hcAlarmNotifPrefix	1.3.6.1.2.1.16.29.2.0
NTF hcRisingAlarm	1.3.6.1.2.1.16.29.2.0.1			The SNMP notification that is generated when a high capacity alarm entry crosses its rising threshold and generates an event that is configured for sending SNMP traps. The hcAlarmEntry object instances identified in the OBJECTS clause are from the entry that causes this notification to be generated.
NTF hcFallingAlarm	1.3.6.1.2.1.16.29.2.0.2			The SNMP notification that is generated when a high capacity alarm entry crosses its falling threshold and generates an event that is configured for sending SNMP traps. The hcAlarmEntry object instances identified in the OBJECTS clause are from the entry that causes this notification to be generated.
hcAlarmConformance	1.3.6.1.2.1.16.29.3
hcAlarmCompliances	1.3.6.1.2.1.16.29.3.1
hcAlarmCompliance	1.3.6.1.2.1.16.29.3.1.1			Describes the requirements for conformance to the High Capacity Alarm MIB.
hcAlarmGroups	1.3.6.1.2.1.16.29.3.2
hcAlarmControlGroup	1.3.6.1.2.1.16.29.3.2.1			A collection of objects used to configure entries for high capacity alarm threshold monitoring purposes.
hcAlarmCapabilitiesGroup	1.3.6.1.2.1.16.29.3.2.2			A collection of objects used to indicate an agent's high capacity alarm threshold monitoring capabilities.
hcAlarmNotificationsGroup	1.3.6.1.2.1.16.29.3.2.3			A collection of notifications to deliver information related to a high capacity rising or falling threshold event to a management application.

RFC description

High-capacity alarm monitoring extensions for RMON supporting advanced threshold detection.

Start monitoring Vendor-neutral router/switch/probe, any manufacturer (RMON High Capacity Alarms, RFC 3434) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HC-ALARM-MIB