SYSLOG-MSG-MIB

All MIBs › SYSLOG-MSG-MIB

Organization: IETF OPSAWG Working Group

Last Updated: 2009-08-13

Category: Device Management

Description: Defines managed objects for representing syslog messages as SNMP objects, bridging between syslog and SNMP management frameworks.

IPNetwork Monitor uses several OIDs from this MIB in network discovery and polling the applicable devices. Start monitoring SYSLOG-MSG-MIB with a free 30-day trial of IPNetwork Monitor.

What Is SYSLOG-MSG-MIB?

SYSLOG-MSG-MIB is an IETF standards-track MIB that represents syslog messages as SNMP objects, bridging the syslog and SNMP management frameworks so that log events can be surfaced through SNMP polling and traps. It exposes a table of recent syslog messages including facility, severity, timestamp, hostname, application name, and process ID, plus a configurable maximum table size and an option to enable SNMP notifications for new syslog entries. Its monitoring value is squarely about software/fault status: it lets an NMS detect error or critical-severity log events (e.g., a failed service, application crash, or security event) generated by any syslog-emitting process on the device, effectively turning textual log output into structured, pollable/alertable SNMP data. As a vendor-neutral IETF MIB (RFC 5427-family), it is designed to complement, not replace, native syslog and works alongside SNMPv2 notification infrastructure for the optional trap-on-new-message behavior. It is typically deployed on network devices or servers where an NMS wants unified event correlation between syslog and SNMP without requiring a separate syslog collector. Engineers implementing or auditing this functionality typically reference the SYSLOG-MSG-MIB RFC/standard documentation for the authoritative specification.

IPNetwork Monitor allows you to monitor SNMP objects defined in SYSLOG-MSG-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

vendor-neutral, standards-based MIB, not tied to a specific manufacturer
applies generally to network devices and servers that emit syslog messages

Monitoring Examples

An administrator would poll syslogMsgTable, indexed by syslogMsgIndex, reading syslogMsgSeverity and syslogMsgFacility to filter for high-severity events, alongside syslogMsgHostName, syslogMsgAppName, and syslogMsgProcID to identify the source process, and syslogMsgTimeStamp to correlate timing with other symptoms. If syslogMsgEnableNotifications is set, the device would instead push an SNMP notification as soon as a new message arrives, letting the NMS react immediately to, for example, a repeated authentication-failure or hardware-fault syslog entry rather than waiting for the next poll of syslogMsgTableMaxSize-bounded history.

What Can Be Monitored

recent syslog message table
message severity and facility
message timestamp
originating hostname/application/process ID
new-message notification enable state

Imported Objects

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32
mib-2

From SNMPv2-TC

DisplayString
TEXTUAL-CONVENTION
TruthValue

From SYSLOG-TC-MIB

SyslogFacility
SyslogSeverity

OIDs

OID symbolic	OID numeric	Type	Access	Description
syslogMsgMib	1.3.6.1.2.1.192			This MIB module represents SYSLOG messages as SNMP objects. Copyright (c) 2009 IETF Trust and the persons identified as authors of the code. All rights reserved. Redistribution and use in source and binary forms, with or without modification, is permitted pursuant to, and subject to the license terms contained in, the Simplified BSD License set forth in Section 4.c of the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info). This version of this MIB module is part of RFC 5676; see the RFC itself for full legal notices.
syslogMsgNotifications	1.3.6.1.2.1.192.0
NTF syslogMsgNotification	1.3.6.1.2.1.192.0.1			The syslogMsgNotification is generated when a new SYSLOG message is received and the value of syslogMsgGenerateNotifications is true. Implementations may add syslogMsgSDParamValue objects as long as the resulting notification fits into the size constraints imposed by the implementation environment and the notification message size constraints imposed by maxMessageSize [RFC3412] and SNMP transport mappings.
syslogMsgObjects	1.3.6.1.2.1.192.1
syslogMsgControl	1.3.6.1.2.1.192.1.1
U32 syslogMsgTableMaxSize	1.3.6.1.2.1.192.1.1.1	Unsigned32	read-write	The maximum number of SYSLOG messages that may be held in syslogMsgTable. A particular setting does not guarantee that there is sufficient memory available for the maximum number of table entries indicated by this object. A value of 0 means no fixed limit. If an application reduces the limit while there are SYSLOG messages in the syslogMsgTable, the SYSLOG messages that are in the syslogMsgTable for the longest time MUST be discarded to bring the table down to the new limit. The value of this object should be kept in nonvolatile memory.
T/F syslogMsgEnableNotifications	1.3.6.1.2.1.192.1.1.2	TruthValue	read-write	Indicates whether syslogMsgNotification notifications are generated. The value of this object should be kept in nonvolatile memory.
syslogMsgTable	1.3.6.1.2.1.192.1.2		not-accessible	A table containing recent SYSLOG messages. The size of the table is controlled by the syslogMsgTableMaxSize object.
syslogMsgEntry	1.3.6.1.2.1.192.1.2.1		not-accessible	An entry of the syslogMsgTable.
U32 syslogMsgIndex	1.3.6.1.2.1.192.1.2.1.1	Unsigned32	not-accessible	A monotonically increasing number used to identify entries in the syslogMsgTable. When syslogMsgIndex reaches the maximum value (4294967295), the value wraps back to 1. Applications periodically polling the syslogMsgTable for new entries should take into account that a complete rollover of syslogMsgIndex will happen if more than 4294967294 messages are received during a poll interval.
SYS syslogMsgFacility	1.3.6.1.2.1.192.1.2.1.2	SyslogFacility	read-only	The facility of the SYSLOG message.
SYS syslogMsgSeverity	1.3.6.1.2.1.192.1.2.1.3	SyslogSeverity	read-only	The severity of the SYSLOG message
U32 syslogMsgVersion	1.3.6.1.2.1.192.1.2.1.4	Unsigned32	read-only	The version of the SYSLOG message. A value of 0 indicates that the version is unknown.
SYS syslogMsgTimeStamp	1.3.6.1.2.1.192.1.2.1.5	SyslogTimeStamp	read-only	The timestamp of the SYSLOG message. A zero-length string is returned if the timestamp is unknown.
STR syslogMsgHostName	1.3.6.1.2.1.192.1.2.1.6	DisplayString	read-only	The hostname and the (optional) domain name of the SYSLOG message. A zero-length string indicates an unknown hostname. The SYSLOG protocol specification constrains this string to printable US-ASCII code points.
STR syslogMsgAppName	1.3.6.1.2.1.192.1.2.1.7	DisplayString	read-only	The app-name of the SYSLOG message. A zero-length string indicates an unknown app-name. The SYSLOG protocol specification constrains this string to printable US-ASCII code points.
STR syslogMsgProcID	1.3.6.1.2.1.192.1.2.1.8	DisplayString	read-only	The procid of the SYSLOG message. A zero-length string indicates an unknown procid. The SYSLOG protocol specification constrains this string to printable US-ASCII code points.
STR syslogMsgMsgID	1.3.6.1.2.1.192.1.2.1.9	DisplayString	read-only	The msgid of the SYSLOG message. A zero-length string indicates an unknown msgid. The SYSLOG protocol specification constrains this string to printable US-ASCII code points.
U32 syslogMsgSDParams	1.3.6.1.2.1.192.1.2.1.10	Unsigned32	read-only	The total number of structured data element parameters carried in the SYSLOG message. This number effectively indicates the number of entries in the syslogMsgSDTable. It can be used, for example, by a notification receiver to determine whether a notification carried all structured data element parameters of a SYSLOG message.
OCT syslogMsgMsg	1.3.6.1.2.1.192.1.2.1.11	OCTET STRING	read-only	The message part of the SYSLOG message. The syntax does not impose a size restriction. Implementations of this MIB module may truncate the message part of the SYSLOG message such that it fits into the size constraints imposed by the implementation environment. Such truncations can also happen elsewhere in the SYSLOG forwarding chain. If the first octets contain the value 'EFBBBF'h, then the rest of the message is a UTF-8 string. Since SYSLOG messages may be truncated at arbitrary octet boundaries during forwarding, the message may contain invalid UTF-8 encodings at the end.
syslogMsgSDTable	1.3.6.1.2.1.192.1.3		not-accessible	A table containing structured data elements of SYSLOG messages.
syslogMsgSDEntry	1.3.6.1.2.1.192.1.3.1		not-accessible	An entry of the syslogMsgSDTable.
U32 syslogMsgSDParamIndex	1.3.6.1.2.1.192.1.3.1.1	Unsigned32	not-accessible	This object indexes the structured data element parameters contained in a SYSLOG message. The first structured data element parameter has the index value 1, and subsequent parameters are indexed by incrementing the index of the previous parameter. The index increases across structured data element boundaries so that the value reflects the position of a structured data element parameter in a SYSLOG message.
STR syslogMsgSDID	1.3.6.1.2.1.192.1.3.1.2	DisplayString	not-accessible	The name (SD-ID) of a structured data element. The SYSLOG protocol specification constrains this string to printable US-ASCII code points.
STR syslogMsgSDParamName	1.3.6.1.2.1.192.1.3.1.3	DisplayString	not-accessible	The name of a parameter of the structured data element. The SYSLOG protocol specification constrains this string to printable US-ASCII code points.
STR syslogMsgSDParamValue	1.3.6.1.2.1.192.1.3.1.4	SyslogParamValueString	read-only	The value of the parameter of a SYSLOG message identified by the index of this table. The value is stored in the unescaped format.
syslogMsgConformance	1.3.6.1.2.1.192.2
syslogMsgGroups	1.3.6.1.2.1.192.2.1
syslogMsgNotificationGroup	1.3.6.1.2.1.192.2.1.1			The notifications emitted by this MIB module.
syslogMsgGroup	1.3.6.1.2.1.192.2.1.2			A collection of objects representing a SYSLOG message, excluding structured data elements.
syslogMsgSDGroup	1.3.6.1.2.1.192.2.1.3			A collection of objects representing the structured data elements of a SYSLOG message.
syslogMsgControlGroup	1.3.6.1.2.1.192.2.1.4			A collection of control objects to control the size of the syslogMsgTable and to enable/disable notifications.
syslogMsgCompliances	1.3.6.1.2.1.192.2.2
syslogMsgFullCompliance	1.3.6.1.2.1.192.2.2.1			The compliance statement for implementations of the SYSLOG-MSG-MIB.
syslogMsgReadOnlyCompliance	1.3.6.1.2.1.192.2.2.2			The compliance statement for implementations of the SYSLOG-MSG-MIB that do not support read-write access.
syslogMsgNotificationCompliance	1.3.6.1.2.1.192.2.2.3			The compliance statement for implementations of the SYSLOG-MSG-MIB that do only generate notifications and do not provide a table to allow read access to SYSLOG message details.

RFC description

Represents syslog messages as SNMP objects for centralized log monitoring and management (RFC 5676).

Start monitoring vendor-neutral, standards-based MIB, network devices/servers emitting syslog messages (syslog message table/notification status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download SYSLOG-MSG-MIB

What Is SYSLOG-MSG-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description