X.500 Directory Monitoring MIB
obsoleted by
- rfc-2605 — Directory Server Monitoring MIB
Extracted elements (20)
Static DSA information (e.g., DSA name, configuration) is not replicated into the MIB; instead, references in the form of Directory Distinguished Names are used so that DSA management applications can query the Directory itself for further related information, keeping the MIB focused on dynamic operational data.
The dsaIntTable is bounded to the last N peer DSAs (locally defined N) rather than all peers ever contacted, deliberately trading completeness for bounded resource consumption in the MIB implementation.
The MIB is intentionally kept as simple as possible, divided into exactly three tables (dsaOpsTable, dsaEntriesTable, dsaIntTable) covering operations statistics, entry/cache statistics, and peer-DSA interaction respectively. Static DSA information is accessed via references to Directory Distinguished Names rather than being replicated into the MIB.
The DSA-MIB is designed for use in conjunction with the APPLICATION-MIB (RFC 1565) and uses applIndex as its primary index, binding DSA-specific statistics to the application-level network service entry. Host resource monitoring is delegated to the Host Resources MIB (RFC 1514).
SNMPv2 entities implementing entry-statistics monitoring MUST implement both dsaOpsGroup and dsaEntryGroup per the dsaEntryCompliance statement; entities implementing peer-interaction monitoring MUST implement both dsaOpsGroup and dsaIntGroup per dsaIntCompliance.
SNMPv2 entities implementing the DSA-MIB for operation monitoring MUST implement dsaOpsGroup as the sole mandatory group per the dsaOpsCompliance MODULE-COMPLIANCE statement.
dsaAnonymousBinds, dsaUnauthBinds, dsaSimpleAuthBinds, and dsaStrongAuthBinds are Counter32 objects tracking cumulative bind attempts by authentication level since application start. dsaStrongAuthBinds includes binds authenticated using external authentication procedures.
dsaBindSecurityErrors (Counter32) counts bind operations rejected due to inappropriateAuthentication or invalidCredentials, as defined in X.511 Section 12.7.2. This is distinct from dsaSecurityErrors which counts post-bind security failures.
dsaCacheEntries counts non-systematic (partially or fully) cached entries; it explicitly excludes the negative cache. dsaCopyEntries counts entries for which systematic slave copies are maintained.
dsaEntriesTable (dsaMIB 2) is indexed by applIndex and contains Gauge32 counters for dsaMasterEntries, dsaCopyEntries, and dsaCacheEntries, plus Counter32 objects dsaCacheHits and dsaSlaveHits tracking how often operations are served from cache or shadow copies.
dsaErrors (Counter32) counts operations that could not be serviced due to non-security, non-referral errors including NameErrors, UpdateErrors, AttributeErrors, and ServiceErrors. Partially serviced operations are not counted as errors.
dsaIntEntry contains dsaName (DistinguishedName of peer DSA), dsaTimeOfCreation, dsaTimeOfLastAttempt, dsaTimeOfLastSuccess (all TimeStamp), dsaFailuresSinceLastSuccess, dsaFailures, and dsaSuccesses (all Counter32) capturing both cumulative and recent-failure interaction statistics per peer DSA.
dsaIntTable (dsaMIB 3) is indexed by {applIndex, dsaIntIndex} and tracks interaction history with peer DSAs. The table keeps the last N peer DSAs (N is locally defined) with which the monitored DSA has attempted interaction.
dsaName uses the DistinguishedName textual convention imported from APPLICATION-MIB to identify peer DSAs in dsaIntTable, providing a pointer into the X.500 Directory for further static information retrieval.
dsaOpsTable (dsaMIB 1) is indexed by applIndex and holds per-DSA counters for bind operations (anonymous, unauthenticated, simple-auth, strong-auth, bind security errors), incoming operations by type, referrals, chainings, security errors, and general errors.
dsaReferrals (Counter32) counts referrals returned in response to operation requests; dsaChainings (Counter32) counts operations forwarded to other DSAs since startup. These distinguish between the two DSA response strategies defined in X.511/X.518.
dsaTimeOfCreation, dsaTimeOfLastAttempt, and dsaTimeOfLastSuccess use the TimeStamp type (value of sysUpTime at the event). All three carry a value of zero if the event occurred before the network management subsystem was initialized, or if no successful attempt has been made.
Operation counters dsaReadOps, dsaCompareOps, dsaAddEntryOps, dsaRemoveEntryOps, dsaModifyEntryOps, dsaModifyRDNOps, dsaListOps, dsaSearchOps, dsaOneLevelSearchOps, and dsaWholeTreeSearchOps are all Counter32 objects counting operations serviced since application startup, each referencing the corresponding X.511 section.
The DSA-MIB module is assigned OID mib-2 29 (i.e., { mib-2 29 }), registering the dsaMIB MODULE-IDENTITY under the standard MIB-II arc. Last-updated timestamp is 9311250000Z.
The RFC explicitly states that security issues are not discussed in this memo. However, the MIB does expose security-relevant monitoring objects: dsaBindSecurityErrors (rejected binds) and dsaSecurityErrors (operations failing security requirements), providing observability into authentication and authorization failures.