POLICY-MANAGEMENT-MIB

All MIBs › POLICY-MANAGEMENT-MIB

Organization: IETF SNMP Configuration Working Group

Last Updated: 2000-10-11

Category: QoS

Description: Manages IETF SNMP-based policy configuration and distribution, covering policy rule storage and enforcement state.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is POLICY-MANAGEMENT-MIB?

POLICY-MANAGEMENT-MIB is a vendor-neutral IETF draft MIB for rule-based configuration and distribution of policies to SNMP-managed infrastructure, conceptually a predecessor/companion to the later RFC 4011 policy-based management work. It exposes policy filter definitions, scheduling calendars, and associated actions, plus a match counter reflecting how often each rule actually fires. Its monitoring relevance is in confirming the policy engine is functioning correctly: pmPolicyMatches shows whether rules are triggering as expected, and the filter/action latency objects reveal whether policy evaluation is keeping pace, which together indicate the health of the management software layer rather than device hardware. It is closely related to POLICY-BASED-MANAGEMENT-MIB (RFC 4011) and to the DISMAN framework MIBs used for scripted condition/action execution. It is typically deployed in NMS platforms that automate configuration and enforcement decisions across a fleet of SNMP agents. Engineers implementing or auditing this functionality typically reference the POLICY-MANAGEMENT-MIB RFC/standard documentation for the authoritative specification.

IPNetwork Monitor allows you to monitor SNMP objects defined in POLICY-MANAGEMENT-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

vendor-neutral, standards-based MIB, not tied to a specific manufacturer
SNMP-managed network devices/policy engines

Monitoring Examples

pmPolicyTable/pmPolicyEntry rows keyed by pmPolicyIndex define a pmPolicyFilter condition, a pmPolicyCalendar schedule, and a pmPolicyAction to take, with pmPolicyPrecedence and pmPolicyGroup controlling how rules combine; pmPolicyMatches counts how many times a given rule's filter has matched. An admin watching pmPolicyMatches stay at zero when a condition should clearly be firing would suspect a misconfigured pmPolicyFilter or a stalled policy engine, while pmPolicyFilterMaxLatency/pmPolicyActionMaxLatency bound how long evaluation is allowed to take.

What Can Be Monitored

policy filter definitions
policy match counts
policy action bindings
filter/action evaluation latency
policy schedule (calendar) windows

Imported Objects

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Gauge32
Integer32
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32
experimental

From SNMPv2-TC

RowPointer
RowStatus
TEXTUAL-CONVENTION

How to Use in IPNetwork Monitor

Example using pmPolicyExecutionErrors OID:

Select a device implementing POLICY-MANAGEMENT-MIB as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type pmPolicyExecutionErrors into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The number of times execution of this policy has been terminated due to run-time errors. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases between polls, since a rising count of errors, failures, or discards often points to a real underlying problem. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
policyMgt	1.3.6.1.3.107			The MIB module for rule-based configuration of SNMP infrastructures.
pmPolicyTable	1.3.6.1.3.107.1		not-accessible	The policy table. A policy is a pairing of a policyFilter and a policyAction which is used to apply the action to a selected set of elements.
pmPolicyEntry	1.3.6.1.3.107.1.1		not-accessible	An entry in the policy table.
U32 pmPolicyIndex	1.3.6.1.3.107.1.1.1	Unsigned32	not-accessible	A unique index for this policy entry.
STR pmPolicyFilter	1.3.6.1.3.107.1.1.2	UTF8String	read-create	A policyFilter is an expression which results in a boolean value which represents whether or not an element is a member of a set of elements upon which an action is to be performed. The format of this expression is the policy expression language. Filter evaluation stops immediately when any error is detected without executing the policyAction. The policyFilter is evaluated for various elements. Any element for which the policyFilter returns any nonzero value will match the filter and will have the associated policyAction executed on that element.
NUM pmPolicyCalendar	1.3.6.1.3.107.1.1.3	RowPointer	read-create	A pointer to an entry in the schedTable of the Scheduling MIB [20]. This policy is active when specified by the associated schedule entry. If the value of this object is 0.0, this policy is always active.
STR pmPolicyAction	1.3.6.1.3.107.1.1.4	UTF8String	read-create	A pmPolicyAction is an operation performed on a set of elements. The format of this expression is the policy expression language. Action evaluation stops immediately when any error is detected.
U32 pmPolicyFilterMaxLatency	1.3.6.1.3.107.1.1.5	Unsigned32	read-create	Every element under the control of this agent is re-checked periodically to see if it is under control of this policy by re-running the filter expression for this policy. This object lets the manager control the maximum amount of time that may pass before an element is re-checked. In other words, in any given interval of this duration, all elements must be re-checked. Note that it is an implementation-dependent matter as to how the policy agent schedules the checking of various elements within this interval.
U32 pmPolicyActionMaxLatency	1.3.6.1.3.107.1.1.6	Unsigned32	read-create	Every element that matches this policy's filter and is therefore under control of this policy will have this policy's action executed periodically to ensure that the element remains in the state dictated by the policy. This object lets the manager control the maximum amount of time that may pass before an element has the action run on it. In other words, in any given interval of this duration, all elements under control of this policy must have the action run on them. Note that it is an implementation-dependent matter as to how the policy agent schedules the policy action on various elements within this interval.
U32 pmPolicyPrecedence	1.3.6.1.3.107.1.1.7	Unsigned32	read-create	The order in which policies on the local system are evaluated. A policy with a higher precedence value will be evaluated after a policy with a lower precedence. For example, a policy with a precedence value of 999 will be evaluated after a policy with a precedence value of 998. These values must be unique on the local policy system that realizes this module. The value for a particular policy should be the same across an administrative domain, though that is not mandatory. When the local policy system performs the evaluation in the pmPolicyFilter for the policy identified by this row it will also read the pmTrackingElementToPolicyStatus object for each object returned as a result of the policy evaluation. If that object is set to modified(3), then the pmPolicyAction shall not be taken on that element. The value of precedence(4), of pmTrackingElementToPolicyStatus is an indication that when an evaluation was performed by another policy, the pmTrackingElementToPolicyStatus was found to have a value of on(1) and that policy had a higher precedence value than the policy that initially set the value of the pmTrackingElementToPolicyStatus to on(1). In this event, the pmTrackingElementToPolicyPrecedence object shall have the value of the pmPolicyIndex for the policy with the higher precedence value entered. If the policy identified by this row of the pmPolicyTable has a higher precedence value than the value found in pmTrackingElementToPolicyPrecedence then the pmPolicyAction should be performed on the element and the pmTrackingElementToPolicyPrecedence object updated with the value of the pmPolicyIndex for this policy. The only exception to these rules is when the policy that has the higher precedence value in not currently running, i.e., the schedule is off.
STR pmPolicyGroup	1.3.6.1.3.107.1.1.8	UTF8String	read-create	An administratively assigned string that is used to group policies. Any combination is legal, the pmPolicyGroup object does not constrain precedence. That is precedence is evaluated independent of grouping though adminstrators might group related policies together for clarity.
STR pmPolicyDescription	1.3.6.1.3.107.1.1.9	UTF8String	read-create	A description of this rule and its significance, typically provided by a human.
G32 pmPolicyMatches	1.3.6.1.3.107.1.1.10	Gauge32	read-create	The number of elements that are currently matched by the associated pmPolicyFilter.
C32 pmPolicyExecutionErrorsEx	1.3.6.1.3.107.1.1.11	Counter32	read-only	The number of times execution of this policy has been terminated due to run-time errors.
INT pmPolicyDebugging	1.3.6.1.3.107.1.1.12	INTEGER	read-create	The status of debugging for this policy. If this is turned on(1), log entries will be created in the pmDebuggingTable for each run-time error that is experienced by this policy.
ROW pmPolicyStatus	1.3.6.1.3.107.1.1.13	RowStatus	read-create	The status of this pmPolicyEntry.
pmElementTypeRegTable	1.3.6.1.3.107.2		not-accessible	A registration table for element types managed by this system.
pmElementTypeRegEntry	1.3.6.1.3.107.2.1		not-accessible	A registration of an element type.
U32 pmElementTypeRegIndex	1.3.6.1.3.107.2.1.1	Unsigned32	not-accessible	A unique index for this entry.
OID pmElementTypeRegOIDPrefix	1.3.6.1.3.107.2.1.2	OBJECT IDENTIFIER	read-create	An OBJECT IDENTIFIER subtree under which all instances of this element type may be found. This OBJECT IDENTIFIER should be specified up to, but not including, any index objects. The agent will discover all instances in the system that are members of the specified subtree. It will then execute policy filters (and potentially policy actions) for each instance discovered. Each invocation of the policy filter will be supplied with a parameter. This is derived by taking the last N sub-identifiers from the discovered instance, where N is: X = number of sub-identifiers in pmElementTypeRegOIDPrefix Y = number of sub-identifiers in discovered instance N = Y - X
STR pmElementTypeRegName	1.3.6.1.3.107.2.1.3	UTF8String	read-create	A descriptive label for this registered type.
ROW pmElementTypeRegRowStatus	1.3.6.1.3.107.2.1.4	RowStatus	read-create	The status of this registration entry.
pmRoleESTable	1.3.6.1.3.107.3		not-accessible	The role string table with element as the major index.
pmRoleESEntry	1.3.6.1.3.107.3.1		not-accessible	A role string entry associates a role string with an individual element.
NUM pmRoleESElement	1.3.6.1.3.107.3.1.1	RowPointer	not-accessible	The element to which this role string is associated. If the agent assigns new indexes in the MIB table to represent the same underlying element (re-indexing), the agent will modify this value to contain the new index for the underlying element.
STR pmRoleESString	1.3.6.1.3.107.3.1.2	UTF8String	not-accessible	The role string that is associated with an element through this table. A role string is an administratively specified characteristic of a managed element (for example, an interface). It is a selector for policy rules, to determine the applicability of the rule to a particular managed element.
ROW pmRoleESStatus	1.3.6.1.3.107.3.1.3	RowStatus	read-create	The status of this role string.
pmRoleSETable	1.3.6.1.3.107.4		not-accessible	A read-only version of the role string table with roleString as the major index. The purpose of this table is to make it easy to retrieve all elements that share a common string.
pmRoleSEEntry	1.3.6.1.3.107.4.1		not-accessible	A role string entry associates a role string with an individual element.
STR pmRoleSEString	1.3.6.1.3.107.4.1.1	UTF8String	not-accessible	The role string that is associated with an element through this table. A role string is an administratively specified characteristic of a managed element (for example, an interface). It is a selector for policy rules, to determine the applicability of the rule to a particular managed element.
NUM pmRoleSEElement	1.3.6.1.3.107.4.1.2	RowPointer	read-only	The element to which this role string is associated. If the agent assigns new indexes in the MIB table to represent the same underlying element (re-indexing), the agent will modify this value to contain the new index for the underlying element.
pmCapabilitiesTable	1.3.6.1.3.107.5		not-accessible	The pmCapabilitiesTable contains a description of the inherent capabilities of the system.
pmCapabilitiesEntry	1.3.6.1.3.107.5.1		not-accessible	The description of a capability or limitation of a capability of the system. An entry will exist for each domain and mechanism specific ability the system has. In the case of a domain specific capability with no mechanism specific parameters, the pmCapabilitiesSubType and all other columns may be null. Entries will exist that contain values for the pmCapabilitiesRestrictOID, pmCapabilitiesRestrictType, pmCapabilitiesRestrictValue and pmCapabilitiesRestrictString objects only when an implementation is reporting a mechanism specific restriction. Multiple entries are possible when more than one restriction for a type or subtype are needed.
U32 pmCapabilitiesIndex	1.3.6.1.3.107.5.1.1	Unsigned32	not-accessible	A unique index for this entry.
OID pmCapabilitiesType	1.3.6.1.3.107.5.1.2	OBJECT IDENTIFIER	read-only	The type of the capability represented by this entry. The IANA will publish the list of identifiers that are valid values for this object.
OID pmCapabilitiesSubType	1.3.6.1.3.107.5.1.3	OBJECT IDENTIFIER	read-only	The sub type of capability is a pointer to a mechanism specific set of capabilities supporting a base technology. In the case of DIFFSERV, the OID value here would be the base OID of the Differentiated Services Policy MIB Module.
OID pmCapabilitiesModificationOID	1.3.6.1.3.107.5.1.4	OBJECT IDENTIFIER	read-only	The OID of the object that is either not supported, supported with one or more limitations, or expanded by an implementation specific module. If this columnar object is other than null then there must be at least an entry in pmCapabilitiesModificationType. Note that this need not be a leaf node or scalar object. If an entire table is not supported, this value can be the base OID for the table.
INT pmCapabilitiesModificationType	1.3.6.1.3.107.5.1.5	INTEGER	read-only	An unsupported value indicates that the OID in pmCapabilitiesModificationOID is not supported on this system. A value of 1 indicates that the OID is supported but with restricted values These constraints are described in the pmCapabilitiesModificationValue and pmCapabilitiesModificationString objects. A value of 2 indicates a vendor specific extension to a standard. The OID of the new object is pmCapabilitiesModificationOID. For some implementations, additional functions may be provided. addvalue indicates that this row of the table describes an additional value that the object can take. The specific value is in the pmCapabilitiesModificationValue. The values of 4 and 5 indicate restrictions or the removal of restrictions for the object identified.
I32 pmCapabilitiesModificationValue	1.3.6.1.3.107.5.1.6	Integer32	read-only	If the value of pmCapabilitiesModificationType is 0, this object will be null since 0 indicates no support for the object at all. A value of 1 in the pmCapabilitiesModificationType will be further modified by a single integer value in this object that corresponds to enumerated integer values that are not supported by the system for the object that is identified in this row. This value can also represent the limit values in the pmCapabilitiesModificationType object.
OCT pmCapabilitiesModificationString	1.3.6.1.3.107.5.1.7	OCTET STRING	read-only	Any additional details or description or parameters needed.
pmTrackingPolicyToElementTable	1.3.6.1.3.107.6		not-accessible	The pmTrackingPolicyToElementTable describes what elements are under control of a policy.
pmTrackingPolicyToElementEntry	1.3.6.1.3.107.6.1		not-accessible	An entry in the pmTrackingPolicyToElementTable. The pmPolicyIndex in the index specifies the policy tracked by this entry.
NUM pmTrackingPolicyToElementElement	1.3.6.1.3.107.6.1.1	RowPointer	not-accessible	The element this policy is configuring.
INT pmTrackingPolicyToElementStatus	1.3.6.1.3.107.6.1.2	INTEGER	read-only	The status of this policy-element relationship. This value will be 1 if the associated policyFilter returned 1 for this element and if the calendar for the policy is active. Entries will only exist in this table if their status is on(1). Thus, on(1) is the only value of this object that can be retrieved. This object exists so that it can serve as the 'payload' in the varbind instead of the pmTrackingPolicyToElementElement object which is much longer and is already in the index (it would otherwise be duplicated).
pmTrackingElementToPolicyTable	1.3.6.1.3.107.7		not-accessible	The pmTrackingElementToPolicyTable describes what policies are controlling an element.
pmTrackingElementToPolicyEntry	1.3.6.1.3.107.7.1		not-accessible	An entry in the pmTrackingElementToPolicyTable. The pmPolicyIndex in the index specifies the policy tracked by this entry.
NUM pmTrackingElementToPolicyElement	1.3.6.1.3.107.7.1.1	RowPointer	not-accessible	The element this policy is configuring.
INT pmTrackingElementToPolicyStatus	1.3.6.1.3.107.7.1.2	INTEGER	read-write	The status of this policy-element relationship. This value will be 1 if the associated policyFilter returned 1 for this element and if the calendar for the policy is active. Entries will not exist in this table if their status would be off(0). A policy can be forcibly disabled on a particular element by setting this value to forceOff(2). The agent should then act as if the policyFilter failed for this element. The forceOff(2) state will persist (even across reboots) until this value is set to on(1) by a management request. Even if the policyFilter later fails for this element, this value will stay in the forceOff(2) state.
pmDebuggingTable	1.3.6.1.3.107.8		not-accessible	The pmDebuggingPolicyTable logs debugging messages when policies experience runtime errors.
pmDebuggingEntry	1.3.6.1.3.107.8.1		not-accessible	An entry in the pmDebuggingTable. The pmPolicyIndex in the index specifies the policy that encountered the error that led to this log entry.
NUM pmDebuggingElement	1.3.6.1.3.107.8.1.1	RowPointer	read-only	The element the policy was executing on when it encountered the error that led to this log entry.
U32 pmDebuggingLogIndex	1.3.6.1.3.107.8.1.2	Unsigned32	read-only	A unique index for this log entry amongst other log entries for this policy/element combination.
STR pmDebuggingMessage	1.3.6.1.3.107.8.1.3	UTF8String	read-only	An error message generated by the expression runtime system.
pmConformance	1.3.6.1.3.107.20
pmCompliances	1.3.6.1.3.107.20.1
pmCompliance	1.3.6.1.3.107.20.1.1			Describes the requirements for conformance to the Policy-Based Management MIB
pmGroups	1.3.6.1.3.107.20.2
pmPolicyManagementGroup	1.3.6.1.3.107.20.2.1			Objects that allow for the creation and management of configuration policies.
pmBaseFunctionLibrary	1.3.6.1.3.107.20.2.2

RFC description

Implements rule-based SNMP configuration management for network infrastructure policies.

Start monitoring vendor-neutral, standards-based MIB (rule-based SNMP infrastructure configuration) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download POLICY-MANAGEMENT-MIB