SYSLOG-MIB

All MIBs › SYSLOG-MIB

Organization: IETF Syslog Working Group

Last Updated: 2007-03-04

Category: Fault Management, IP Services and Protocols

Description: Manages IETF syslog protocol configuration, message routing, and remote syslog server settings.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is SYSLOG-MIB?

SYSLOG-MIB is a vendor-neutral IETF standards-track MIB that manages the configuration and operational behavior of syslog applications acting as sender, receiver, or relay, covering how syslog messages are generated, routed, and forwarded to remote syslog servers. It exposes configuration data (remote server destinations, message selectors/filters, transport settings) and, to a lesser extent, operational counters about messages processed. Its main relevance to device monitoring is indirect but important: because syslog is a primary channel for reporting software errors, faults, and status events, this MIB lets an administrator verify that a device's syslog forwarding is correctly configured and actively delivering messages to the intended log collector, so that other fault/event data isn't silently lost. It is closely tied to the IETF syslog protocol specification and typically deployed alongside other fault/trap-oriented MIBs as part of a broader event-management strategy. It applies to any networked device or host running a syslog-capable management agent, from routers and switches to servers. Engineers implementing or auditing this functionality typically reference the SYSLOG-MIB RFC/standard documentation for the authoritative specification.

IPNetwork Monitor allows you to monitor SNMP objects defined in SYSLOG-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

vendor-neutral, standards-based MIB, not tied to a specific manufacturer
any syslog-capable network device or host

Monitoring Examples

An administrator would check the syslog configuration table for the configured remote-server destination and verify its transport/port settings match the intended log collector, catching a misconfiguration that would silently stop event forwarding. Message counters would be polled over time to confirm syslog messages are actively being generated and sent, a useful sanity check when a device seems unusually quiet in the central log server.

What Can Be Monitored

syslog remote server destinations
syslog message filtering/selectors
syslog transport configuration
syslog message counters

Imported Objects

From INET-ADDRESS-MIB

InetAddress
InetAddressType
InetPortNumber

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32
mib-2

From SNMPv2-TC

RowStatus
StorageType
TEXTUAL-CONVENTION
TimeStamp

From SYSLOG-TC-MIB

SyslogFacility
SyslogSeverity

How to Use in IPNetwork Monitor

Example using syslogOperationsMsgsReceived OID:

Select a syslog-capable network device or host as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type syslogOperationsMsgsReceived into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The number of messages received by the syslog receiver. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases between polls, since a rising count of errors, failures, or discards often points to a real underlying problem. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
syslogMIB	1.3.6.1.2.1.200			The MIB module for monitoring syslog applications. A syslog application sends and/or receives syslog messages. The reader is referred to [RFCPROT] for a description of the various roles of a syslog application viz. ''sender'', ''receiver'' and ''relay''. The discussion in this document in general applies to a generic syslog application. For special cases the specific role of the syslog application will be mentioned. Copyright (C) The IETF Trust (2008). This version of this MIB module is part of RFC XXXX; see the RFC itself for full legal notices.
syslogNotifications	1.3.6.1.2.1.200.0
NTF syslogStatusChanged	1.3.6.1.2.1.200.0.1			This notification is sent when a syslog application changes state. For example when the syslog application starts [syslogOperationsStatus is ''started'' ] or the syslog application stops [syslogOperationsStatus is ''suspended'' or ''stopped'']. The value of syslogOperationsStatus will be the new status of the syslog application after the change. The syslog application corresponding to the notification will be identified by the syslogOperationsIndex instance identifier of the objects in the notification.
syslogObjects	1.3.6.1.2.1.200.1
syslogControlTable	1.3.6.1.2.1.200.1.1		not-accessible	A table containing the configuration parameters pertaining to the syslog applications serviced by an SNMP agent.
syslogControlEntry	1.3.6.1.2.1.200.1.1.1		not-accessible	The configuration parameters pertaining to a syslog application.
U32 syslogControlIndex	1.3.6.1.2.1.200.1.1.1.1	Unsigned32	not-accessible	The Index that uniquely identifies the syslog application in the syslogControlTable. The value of the index for a syslog application may not be the same across system reboots. Users and applications will need to determine the index of a syslog application after system reboots.
STR syslogControlDescr	1.3.6.1.2.1.200.1.1.1.2	SnmpAdminString	read-create	A user definable description of the syslog application. This description could be used by syslog management applications e.g. in reports or in user interfaces.
SYS syslogControlRoles	1.3.6.1.2.1.200.1.1.1.3	SyslogRoles	read-create	The roles of the syslog application.
IPt syslogControlBindAddrType	1.3.6.1.2.1.200.1.1.1.4	InetAddressType	read-create	The type of Internet address which follows in syslogControlBindAddr. If this syslog application is not a syslog receiver, the value of this object will be 'unknown' (0).
IP syslogControlBindAddr	1.3.6.1.2.1.200.1.1.1.5	InetAddress	read-create	The specific address the syslog receiver will bind to. The format of the address is specified by the corresponding syslogControlBindAddrType object. If the address is specified in the DNS domain name format [syslogControlBindAddrType = 'dns'], the corresponding IPv4 or IPv6 address obtained at the time of the binding operation by the syslog application, will be used. If this syslog application is not a syslog receiver, the value of this object will be a zero-length string.
INE syslogControlBindPort	1.3.6.1.2.1.200.1.1.1.6	InetPortNumber	read-create	The port number that this syslog receiver will bind to. If this syslog application is not a syslog receiver the value of this object will be zero.
SYS syslogControlEncapsulation	1.3.6.1.2.1.200.1.1.1.7	SyslogEncapsulation	read-create	The encapsulation that will be used for syslog messages by the syslog receiver. If this syslog application is not a syslog receiver the value of this object will be ''other''.
U32 syslogControlMaxMessageSize	1.3.6.1.2.1.200.1.1.1.8	Unsigned32	read-create	The maximum size of the syslog messages in bytes for this syslog application. A syslog receiver may reject or truncate messages larger than the specified maximum syslog message size.
STR syslogControlConfFileName	1.3.6.1.2.1.200.1.1.1.9	SnmpAdminString	read-create	The fullpath name of the configuration file where the syslog application's message selection and corresponding action rules will be read from. If the syslog application does not support the specification of a configuration file, the value of this object will be a zero-length string.
STO syslogControlStorageType	1.3.6.1.2.1.200.1.1.1.11	StorageType	read-create	This object defines whether the parameters defined in this row are kept in volatile storage and lost upon reboot or are backed up by non-volatile or permanent storage. Conceptual rows having the value 'permanent' need not allow write-access to any columnar objects in the row.
ROW syslogControlRowStatus	1.3.6.1.2.1.200.1.1.1.12	RowStatus	read-create	This object is used to create, modify and delete rows in the syslogControlTable. The value of syslogControlDescr can be changed when this object is in state ''active'' or in ''notInService''. The other objects in a row can be modified only when the value of this object in the corresponding conceptual row is not ''active''. Thus to modify one or more of the objects in this conceptual row, a. change the row status to ''notInService'', b. change the values of the row c. change the row status to ''active'' The syslogControlRowStatus may be changed to ''active'' if all the managed objects in the conceptual row with MAX-ACCESS read-create except syslogControlBindPort and syslogControlEncapsulation have been assigned valid values.
syslogOperationsTable	1.3.6.1.2.1.200.1.2		not-accessible	A table containing operations information about the syslog applications serviced by an SNMP agent. This table complements the (configuration) information in syslogControlTable .
syslogOperationsEntry	1.3.6.1.2.1.200.1.2.1		not-accessible	The operations information pertaining to a syslog application.
C32 syslogOperationsMsgsReceivedEx	1.3.6.1.2.1.200.1.2.1.1	Counter32	read-only	The number of messages received by the syslog receiver. This includes messages that were discarded. If this syslog application is not a syslog receiver the value of this object will be zero. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of syslogOperationsCounterDiscontinuityTime.
C32 syslogOperationsMsgsTransmitted	1.3.6.1.2.1.200.1.2.1.2	Counter32	read-only	The number of messages transmitted by the syslog sender. This does not include the messages that could not be queued for transmission by the syslog sender. If this syslog application is not a syslog sender the value of this object will be zero. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of syslogOperationsCounterDiscontinuityTime.
C32 syslogOperationsMsgsRelayed	1.3.6.1.2.1.200.1.2.1.3	Counter32	read-only	The number of messages relayed by the syslog relay to other syslog applications. If this syslog application is not a syslog relay the value of this object will be zero. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of syslogOperationsCounterDiscontinuityTime.
C32 syslogOperationsMsgsDropped	1.3.6.1.2.1.200.1.2.1.4	Counter32	read-only	The number of messages that could not be queued for transmission by the syslog sender. If this syslog application is not a syslog sender the value of this object will be zero. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of syslogOperationsCounterDiscontinuityTime.
C32 syslogOperationsMsgsMalFormed	1.3.6.1.2.1.200.1.2.1.5	Counter32	read-only	The number of messages received by the syslog receiver which had malformed header. If this syslog application is not a syslog receiver, then this object will have a zero value. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of syslogOperationsCounterDiscontinuityTime.
C32 syslogOperationsMsgsDiscarded	1.3.6.1.2.1.200.1.2.1.6	Counter32	read-only	The number of messages that were discarded by the syslog receiver. This will include messages that were discarded because the message size was greater than the system's maximum message size. If this syslog application is not a syslog receiver this object will have a zero value. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of syslogOperationsCounterDiscontinuityTime.
TIM syslogOperationsLastMsgRecdTime	1.3.6.1.2.1.200.1.2.1.7	TimeStamp	read-only	The value of sysUpTime when the last message was received by the syslog receiver. If this syslog application is not a syslog receiver or, if no messages have been received by this syslog application, since the last re-initialization of the local SNMP management subsystem, then this object will have a zero value.
TIM syslogOperationsLastMsgTransmittedTime	1.3.6.1.2.1.200.1.2.1.8	TimeStamp	read-only	The value of sysUpTime when the last message was transmitted by the syslog sender. If this syslog application is not a syslog sender or, if no messages have been transmitted by this syslog application, since the last re-initialization of the local management subsystem, then this object will have a zero value.
TIM syslogOperationsStartTime	1.3.6.1.2.1.200.1.2.1.9	TimeStamp	read-only	The value of sysUpTime when this syslog application was started.
STR syslogOperationsLastError	1.3.6.1.2.1.200.1.2.1.10	SnmpAdminString	read-only	A description of the last error related to sending, receiving or processing a syslog message that was encountered by this syslog application. If no error has been encountered by this syslog application then the value of this object will be a zero-length string. If no error has been encountered by this syslog application since the last re-initialization of the local management subsystem then the value of this object will be a zero-length string.
TIM syslogOperationsLastErrorTime	1.3.6.1.2.1.200.1.2.1.11	TimeStamp	read-only	The value of sysUpTime when the last error was encountered. If no error has been encountered by this syslog application since the last re-initialization of the local management subsystem, then this object will have a zero value.
I32 syslogOperationsRunIndex	1.3.6.1.2.1.200.1.2.1.12	Integer32	read-only	If the Host resource MIB is instantiated on the host then this entry will have the value of the hrSWRunIndex of the corresponding entry in the hrSWRunTable. Note that the hrSWRunIndex is not persistent across system reboots or software restarts. The value of syslogOperationsRunIndex SHOULD reference the latest value of the hrSWRunIndex of the corresponding entry in the hrSWRunTable. The special value of zero indicates that the Host resource MIB is not instantiated.
TIM syslogOperationsCounterDiscontinuityTime	1.3.6.1.2.1.200.1.2.1.13	TimeStamp	read-only	The value of sysUpTime on the most recent occasion at which any one or more of this syslog application's counters, viz., counters with OID prefix 'syslogOperationsMsgsReceived' or 'syslogOperationsMsgsTransmitted' or 'syslogOperationsMsgsRelayed' or 'syslogOperationsMsgsDropped' or 'syslogOperationsMsgsMalFormed' or 'syslogOperationsMsgsDiscarded' suffered a discontinuity. If no such discontinuities have occurred since the last re-initialization of the local management subsystem, then this object will have a zero value.
INT syslogOperationsStatus	1.3.6.1.2.1.200.1.2.1.14	INTEGER	read-only	The status of the syslog application.
syslogPriorityTable	1.3.6.1.2.1.200.1.3		not-accessible	A table containing the relay configuration parameters pertaining to the syslog applications serviced by an SNMP agent.
syslogPriorityEntry	1.3.6.1.2.1.200.1.3.1		not-accessible	The relay configuration parameters pertaining to a syslog application.
SYS syslogPriorityFacility	1.3.6.1.2.1.200.1.3.1.1	SyslogFacility	not-accessible	The facility value of this entry.
SYS syslogPrioritySeverity	1.3.6.1.2.1.200.1.3.1.2	SyslogSeverity	not-accessible	The severity value of this entry.
STR syslogPriorityDescr	1.3.6.1.2.1.200.1.3.1.3	SnmpAdminString	read-create	A textual description of this priority entry.
U32 syslogPriorityDestinationIndex	1.3.6.1.2.1.200.1.3.1.4	Unsigned32	read-create	On systems where the priority value in a syslog message indicates the destination to which a syslog message should be relayed, the value of this object will identify the row in syslogRelayTable that contains information about the relay destination to which messages which have the priority value represented by syslogPriorityFacility and syslogPrioritySeverity values of this row will be relayed. A value of 0 will indicate that there is no corresponding row in the syslogRelayTable table.
STO syslogPriorityStorageType	1.3.6.1.2.1.200.1.3.1.5	StorageType	read-create	This object defines whether the parameters defined in this row are kept in volatile storage and lost upon reboot or are backed up by non-volatile or permanent storage. Conceptual rows having the value 'permanent' need not allow write-access to any columnar objects in the row.
ROW syslogPriorityRowStatus	1.3.6.1.2.1.200.1.3.1.6	RowStatus	read-create	This object is used to create, modify and delete rows in the syslogPriorityTable. The value of syslogPriorityDescr can be changed when this object is in state ''active'' or in ''notInService''. The other objects in a row can be modified only when the value of this object in the corresponding conceptual row is not ''active''. Thus to modify one or more of the objects in this conceptual row, a. change the row status to ''notInService'', b. change the values of the row c. change the row status to ''active'' The syslogPriorityRowStatus may be changed to ''active'' if all the managed objects in the conceptual row with MAX-ACCESS read-create have been assigned valid values.
syslogRelayTable	1.3.6.1.2.1.200.1.4		not-accessible	A table containing information for the relay destinations.
syslogRelayEntry	1.3.6.1.2.1.200.1.4.1		not-accessible	The information pertaining to a syslog message relay destination.
U32 syslogRelayIndex	1.3.6.1.2.1.200.1.4.1.1	Unsigned32	not-accessible	The Index that uniquely identifies the syslog relay in the syslogRelayTable. The value of the index for a syslog relay may not be the same across system reboots. Users and applications will need to determine the index of a syslog relay after system reboots.
STR syslogRelayDescr	1.3.6.1.2.1.200.1.4.1.2	SnmpAdminString	read-create	A user definable description of the syslog relay. This description could be used by syslog management applications e.g. in reports or in user interfaces.
IPt syslogRelayAddrType	1.3.6.1.2.1.200.1.4.1.3	InetAddressType	read-create	The type of Internet address which follows in syslogRelayAddr.
IP syslogRelayAddr	1.3.6.1.2.1.200.1.4.1.4	InetAddress	read-create	The address of the syslog relay . The format of the address is specified by the corresponding syslogRelayAddrType object. If the address is specified in the DNS domain name format [syslogRelayAddrType = 'dns'], the corresponding IPv4 or IPv6 address obtained at the time of the relay operation by the syslog application, will be used.
INE syslogRelayPort	1.3.6.1.2.1.200.1.4.1.5	InetPortNumber	read-create	The port number of the syslog relay.
SYS syslogRelayEncapsulation	1.3.6.1.2.1.200.1.4.1.6	SyslogEncapsulation	read-create	The encapsulation that will be used for syslog messages sent by the syslog sender to the relay destination.
C32 syslogRelayMsgsRelayed	1.3.6.1.2.1.200.1.4.1.7	Counter32	read-only	The number of messages relayed by the syslog relay to this relay destination. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of syslogRelayCounterDiscontinuityTime.
TIM syslogRelayCounterDiscontinuityTime	1.3.6.1.2.1.200.1.4.1.8	TimeStamp	read-only	The value of sysUpTime on the most recent occasion at which counters with OID prefix 'syslogRelayMsgsRelayed' suffered a discontinuity. If no such discontinuities have occurred since the last re-initialization of the local management subsystem, then this object will have a zero value.
STO syslogRelayStorageType	1.3.6.1.2.1.200.1.4.1.9	StorageType	read-create	This object defines whether the parameters defined in this row are kept in volatile storage and lost upon reboot or are backed up by non-volatile or permanent storage. Conceptual rows having the value 'permanent' need not allow write-access to any columnar objects in the row.
ROW syslogRelayRowStatus	1.3.6.1.2.1.200.1.4.1.10	RowStatus	read-create	This object is used to create, modify and delete rows in the syslogRelayTable. The value of syslogRelayDescr can be changed when this object is in state ''active'' or in ''notInService''. The other objects in a row can be modified only when the value of this object in the corresponding conceptual row is not ''active''. Thus to modify one or more of the objects in this conceptual row, a. change the row status to ''notInService'', b. change the values of the row c. change the row status to ''active'' The syslogRelayRowStatus may be changed to ''active'' if all the managed objects in the conceptual row with MAX-ACCESS read-create have been assigned valid values.
syslogConformance	1.3.6.1.2.1.200.3
syslogGroups	1.3.6.1.2.1.200.3.1
syslogOperationsGroup	1.3.6.1.2.1.200.3.1.1			A collection of objects providing message related statistics.
syslogControlGroup	1.3.6.1.2.1.200.3.1.2			A collection of objects representing the run time parameters for the syslog applications.
syslogPriorityGroup	1.3.6.1.2.1.200.3.1.3			A collection of objects representing the priority groupings of syslog messages.
syslogRelayGroup	1.3.6.1.2.1.200.3.1.4			A collection of objects representing the relay destinations for syslog messages.
syslogNotificationGroup	1.3.6.1.2.1.200.3.1.5			A collection of notifications about the operational state of a syslog application.
syslogCompliances	1.3.6.1.2.1.200.3.2
syslogFullCompliance1	1.3.6.1.2.1.200.3.2.1			The compliance statement for SNMP entities which implement the SYSLOG-MIB with support for writable objects and notifications. Such an implementation can be both monitored and configured via SNMP. It can also send notifications about change in the operational status of the syslog application.
syslogFullCompliance2	1.3.6.1.2.1.200.3.2.2			The compliance statement for SNMP entities which implement the SYSLOG-MIB with support for writable objects. Such an implementation can be both monitored and configured via SNMP.
syslogFullCompliance3	1.3.6.1.2.1.200.3.2.3			The compliance statement for SNMP entities which implement the SYSLOG-MIB with support for writable objects but without support for the objects in syslogPriorityGroup and syslogRelayGroup. Such an implementation can be both monitored and configured via SNMP.
syslogReadOnlyCompliance1	1.3.6.1.2.1.200.3.2.4			The compliance statement for SNMP entities which implement the syslog MIB without support for read-write (i.e. in read-only mode). It can also send notifications about change in the operational status of the syslog application.
syslogReadOnlyCompliance2	1.3.6.1.2.1.200.3.2.5			The compliance statement for SNMP entities which implement the syslog MIB without support for read-write (i.e. in read-only mode).
syslogReadOnlyCompliance3	1.3.6.1.2.1.200.3.2.6			The compliance statement for SNMP entities which implement the syslog MIB without support for read-write (i.e. in read-only mode) and without support for the objects in syslogRelayGroup and syslogPriorityGroup.
syslogNotificationCompliance	1.3.6.1.2.1.200.3.2.7			The compliance statement for SNMP entities which implement the SYSLOG-MIB and support only notifications about change in the operational status of a syslog application.

RFC description

Monitors syslog applications including message handling, facility routing and severity levels.

Start monitoring syslog-capable network devices and hosts with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download SYSLOG-MIB