TAILF-ALARM-MIB

All MIBs › TAILF-ALARM-MIB

Organization: Tail-f Systems AB

Last Updated: 2012-08-30

Category: Alarms and Events

Description: Manages Tail-f Systems alarm objects including active alarms, history, and operator actions.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is TAILF-ALARM-MIB?

TAILF-ALARM-MIB is a Tail-f Systems (now part of Cisco, maker of the ConfD/NCS network configuration management platform) MIB for representing and managing device alarms as stateful entries rather than one-shot events. It exposes an alarm table where each row corresponds to a specific device, an object within that device, and a unique alarm type, along with severity and clear-state fields that get updated in place as conditions change. Its central use is monitoring fault and health status of managed hardware and software: administrators track alarm severity transitions, specific-problem codes, and event types to know when a monitored device or object has entered an abnormal state, and alarms persist (even after clearing) until explicitly purged, giving visibility into recent fault history. It is closely tied to the standard SNMP notification framework, since alarm state changes are typically also signaled via TAILF-ALARM-MIB notifications sent as SNMP traps. This MIB is typically deployed within Tail-f/Cisco ConfD- or NCS-based network element management and orchestration systems that aggregate alarms from many managed devices into a unified alarm list for NOC monitoring. Engineers can download the TAILF-ALARM-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in TAILF-ALARM-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Tail-f Systems ConfD/NCS-based network element management platforms
network devices managed through Tail-f/Cisco configuration management software

Monitoring Examples

An administrator would poll tfAlarmTable / tfAlarmEntry, keyed by tfAlarmIndex, to review each active alarm's tfAlarmDevice, tfAlarmObject and tfAlarmObjectOID (identifying exactly which device and managed object is affected), tfAlarmType and tfAlarmSpecificProblem (what kind of fault occurred), and tfAlarmEventType. Watching tfAlarmLastChanged lets a monitoring system detect when an existing alarm's severity or clear-state was updated rather than treating it as a brand-new fault, and tfAlarmNumber gives a quick count of currently tracked alarms for dashboard summaries.

What Can Be Monitored

active alarm count
alarm severity per device/object
alarm clear state
specific problem/event type
last-changed time of an alarm
affected device and object identity

Imported Objects

From IANA-ITU-ALARM-TC-MIB

IANAItuEventType

From ITU-ALARM-TC-MIB

ItuPerceivedSeverity

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DateAndTime
TruthValue

From TAILF-ALARM-TC-MIB

TfAlarmIndex
TfAlarmOperatorState
TfProbableCause
TfUtf8String
TfYANGResource

From TAILF-TOP-MIB

tfModules

OBJECT-IDENTITY

OIDs

OID symbolic	OID numeric	Type	Access	Description
tfAlarmMIB	1.3.6.1.4.1.24961.2.103			Alarm MIB for Tail-f Systems. This MIB represents alarms as states, where a row in the alarm table corresponds to a device, an object within the device and an unique alarm type. If the severity of an alarm or a the clear state is changed this is an update to an existing alarm entry and not a new. When the resource reports a clear on the alarm the alarm entry still exists until administrative processes purges the alarm list. These procedures are out of the scope for this module.
tfAlarmObjects	1.3.6.1.4.1.24961.2.103.1
tfAlarms	1.3.6.1.4.1.24961.2.103.1.1
U32 tfAlarmNumber	1.3.6.1.4.1.24961.2.103.1.1.1	Unsigned32	read-only	This object shows the total number of of entries in the tfAlarmTable.
DAT tfAlarmLastChanged	1.3.6.1.4.1.24961.2.103.1.1.2	DateAndTime	read-only	A timestamp when the active alarm table was last changed. The value can be used by a manager to initiate an alarm resynchronization procedure. NOTE: All fields of the DateAndTime MUST be filled out, including the hours and minutes from UTC. As such, the value should be 11 octets long.
tfAlarmTable	1.3.6.1.4.1.24961.2.103.1.1.5		not-accessible	This table list all alarms in the system. Entries are created when a resource has a new alarm state. If the same resource has several active alarms, with different Alarm Types, this will be represented as separate rows. Rows disappear based on administrative procedures outside the scope of this module. Note that this means that cleared alarms exist in the table. Rows can be changed when an alarm changes severity, additional text or clearance state.
tfAlarmEntry	1.3.6.1.4.1.24961.2.103.1.1.5.1		not-accessible	One entry in the table holds one alarm for a given resource. Entries are created by the system when a resource has a new alarm state. Entries are deleted by alarm pruning actions. An alarm that is cleared by a resource is still kept in the alarm list until pruned by a user. Alarm severity and additional text can later be changed in a row.
TFA tfAlarmIndex	1.3.6.1.4.1.24961.2.103.1.1.5.1.1	TfAlarmIndex	not-accessible	A unique value, greater than zero, for each alarm. The value for each alarm must remain constant at least from one re-initialization of the entity to the next re-initialization.
STR tfAlarmType	1.3.6.1.4.1.24961.2.103.1.1.5.1.2	SnmpAdminString	read-only	This provides an identification of the alarm type. Together with tfAlarmSpecificProblem, this is a unique identification of the alarm. Different managed object types and instances can share alarm types, but if the same managed object reports the same alarm type, it is to be considered as the same alarm state. The alarm type is a simplification of the different X.733 and 3GPP alarm IRP alarm correlation mechanisms based on EventType, ProbableCause, SpecificProblem and NotificationId.
STR tfAlarmDevice	1.3.6.1.4.1.24961.2.103.1.1.5.1.3	SnmpAdminString	read-only	The name of the managed device. May also be the system itself for self-management alarms. Note that this object is not fine-grained enough to pinpoint the alarming resource. The alarm object within the device is the exact alarming resource.
TFY tfAlarmObject	1.3.6.1.4.1.24961.2.103.1.1.5.1.4	TfYANGResource	read-only	Name of alarm object within a device based on YANG naming. Note that the granularity must be good enough to guarantee unique alarm states and relevant resource identification to the operator.
OID tfAlarmObjectOID	1.3.6.1.4.1.24961.2.103.1.1.5.1.5	OBJECT IDENTIFIER	read-only	Name of alarm object based on SNMP naming. Note that the granularity must be good enough to guarantee unique alarm states and relevant resource identification to the operator.
STR tfAlarmObjectStr	1.3.6.1.4.1.24961.2.103.1.1.5.1.6	TfUtf8String	read-only	Name of alarm object based on any other naming. Note that the granularity must be good enough to guarantee unique alarm states and relevant resource identification to the operator.
STR tfAlarmSpecificProblem	1.3.6.1.4.1.24961.2.103.1.1.5.1.7	TfUtf8String	read-only	This object is used when the 'tfAlarmType' object cannot uniquely identify the alarm type. Normally, this is not the case, and this leaf is the empty string.
IAN tfAlarmEventType	1.3.6.1.4.1.24961.2.103.1.1.5.1.8	IANAItuEventType	read-only	The event type as defined in X.733/X.736.
TFP tfAlarmProbableCause	1.3.6.1.4.1.24961.2.103.1.1.5.1.9	TfProbableCause	read-only	The probable cause as defined in X.733/X.736.
DAT tfAlarmOrigTime	1.3.6.1.4.1.24961.2.103.1.1.5.1.10	DateAndTime	read-only	Time for alarm raise
DAT tfAlarmTime	1.3.6.1.4.1.24961.2.103.1.1.5.1.11	DateAndTime	read-only	A time stamp of the alarm state change event. Note that this variable represents the last change of the alarm state, like changed severity or additional text. If the alarm has not changed state this variable represents the alarm raise time and will be the same as tfAlarmOrigTime. NOTE: All fields of the DateAndTime MUST be filled out, including the hours and minutes from UTC. As such, the value should be 11 octets long.
ITU tfAlarmSeverity	1.3.6.1.4.1.24961.2.103.1.1.5.1.12	ItuPerceivedSeverity	read-only	The severity of the alarm as defined by X.733. Note that this may not be the original severity since the alarm may have changed severity. For cleared alarms, this is the last severity that is not equal to cleared.
T/F tfAlarmCleared	1.3.6.1.4.1.24961.2.103.1.1.5.1.13	TruthValue	read-only	Indicates if the alarm is cleared or not.
STR tfAlarmText	1.3.6.1.4.1.24961.2.103.1.1.5.1.14	TfUtf8String	read-only	A user friendly text describing the alarm. Intended for human consumption.
TFA tfAlarmOperatorState	1.3.6.1.4.1.24961.2.103.1.1.5.1.15	TfAlarmOperatorState	read-only	The operator state of the alarm.
STR tfAlarmOperatorNote	1.3.6.1.4.1.24961.2.103.1.1.5.1.16	TfUtf8String	read-only	Operator note for the alarm.
tfAlarmNotifications	1.3.6.1.4.1.24961.2.103.2
tfAlarmNotifsPrefix	1.3.6.1.4.1.24961.2.103.2.0
NTF tfAlarmIndeterminate	1.3.6.1.4.1.24961.2.103.2.0.1			Indeterminate alarms are sent when errors occur for which the severity level cannot be determined.
NTF tfAlarmWarning	1.3.6.1.4.1.24961.2.103.2.0.2			Warning alarms are sent for potential problems that haven't yet caused any significant effects.
NTF tfAlarmMinor	1.3.6.1.4.1.24961.2.103.2.0.3			Minor alarms are sent for non-service affecting problems, and indicate that corrective action should be taken to prevent a more serious fault.
NTF tfAlarmMajor	1.3.6.1.4.1.24961.2.103.2.0.4			Major alarms are sent for service affecting problems that require urgent corrective action.
NTF tfAlarmCritical	1.3.6.1.4.1.24961.2.103.2.0.5			Critical alarms are sent for service affecting problems that require immediate corrective action.
NTF tfAlarmClear	1.3.6.1.4.1.24961.2.103.2.0.6			A clear alarm indicates that a previously reported alarm is now cleared by the underlying resource.
tfAlarmConformance	1.3.6.1.4.1.24961.2.103.10
tfAlarmCompliances	1.3.6.1.4.1.24961.2.103.10.1
tfAlarmCompliance	1.3.6.1.4.1.24961.2.103.10.1.1			Compliance information for this MIB module
tfAlarmGroups	1.3.6.1.4.1.24961.2.103.10.2
tfAlarmNotifs	1.3.6.1.4.1.24961.2.103.10.2.1			The alarm notifications that can be sent from the system.
tfAlarmObjs	1.3.6.1.4.1.24961.2.103.10.2.2			The alarm objects.

RFC description

Tail-f Systems alarm MIB representing device alarms as stateful entries with severity levels, operator state, and alarm table management.

Start monitoring Tail-f Systems ConfD/NCS-based network element management platform, now Cisco (device alarm state/severity status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download TAILF-ALARM-MIB

What Is TAILF-ALARM-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description