Definitions of System-Level Managed Objects for Applications
Extracted elements (26)
A three-tier MIB architecture is planned: sysAppl (generic, system-derived), a future applmib (requires some application instrumentation), and application-specific MIBs (e.g., WWW MIB). More specific MIBs are designed to reference back to the more generic sysAppl MIB, not the reverse, to avoid coupling.
Agent implementations use polling with a configurable interval (sysApplAgentPollInterval, default 60 s) because obtaining process status from the OS is computationally expensive and the detection of application start/stop events is not necessarily event-driven. The default favors low overhead for long-lived processes; managers requiring accuracy for short-lived processes should reduce the interval.
sysApplElmtRunTable deliberately includes every process on the system—not just those belonging to identified applications—because unidentified processes still consume resources and are 'interesting' for complete system load monitoring.
sysApplInstallElmtRole is read-write so an operator can assign roles to application elements, enabling the agent to determine application invocation boundaries, health state, and termination criteria without requiring special code within the application itself.
The MIB is intentionally restricted to information obtainable from the system itself without requiring modifications to the applications. This approach was taken to ensure ease and speed of implementation while allowing room for future growth through more detailed MIB modules.
A collision can occur in sysApplElmtPastRunTable when a new process under the same invocation ID is assigned the same native process ID as a previous entry. The specification states the new entry replaces the old entry; the conditions for this are unlikely but possible.
For an application to appear in sysApplInstallPkgTable, it must be discoverable by the system, typically requiring installation via a central mechanism or registry (e.g., UNIX 'pkgadd' or a PC global registry). Applications installed by other means may not be visible to the agent.
The sysApplElmtRunIndex should wherever possible use the system's native, unique process identification number, enabling correlation with OS-level tools and facilitating use of the sysApplMapTable for PID-to-application lookups.
Conformance to the System Application MIB requires that all three OBJECT-GROUPs be implemented as MANDATORY-GROUPS: sysApplInstalledGroup, sysApplRunGroup, and sysApplMapGroup.
In sysApplPastRunExitState, all combinations of element running states that do not match the 'complete' or 'failed' criteria MUST be classified as other(3).
The value of sysApplInstallPkgIndex must remain constant at least from one re-initialization of the network management entity to the next re-initialization, and a value must not be reused until the next agent entity restart if the installed application entry is deleted.
Seven scalars control past-run table behavior: sysApplPastRunMaxRows (default 500), sysApplPastRunTblTimeLimit (default 7200 s), sysApplElemPastRunMaxRows (default 500), sysApplElemPastRunTblTimeLimit (default 7200 s), sysApplAgentPollInterval (default 60 s), plus two read-only Counter32 objects tracking the number of entries forcibly removed from each past-run table.
The RunState textual convention defines five execution states for a running application or process: running(1), runnable(2) (waiting for a resource such as CPU), waiting(3) (waiting for an event), exiting(4), and other(5).
The SYSAPPL-MIB module is assigned OID { mib-2 54 } and defines managed objects for fault, configuration, and performance management of applications from a system perspective, limited to attributes obtainable from the system itself without requiring instrumentation within the applications.
The sysApplElmtPastRunTable records processes that previously executed as part of an identified application; processes that cannot be associated with any installed application are silently discarded when they terminate and are not moved here. Aged out by sysApplElemPastRunMaxRows (default 500) and sysApplElemPastRunTblTimeLimit (default 7200 seconds).
The sysApplElmtRunTable contains one entry for EVERY process currently running on the host—not just those belonging to identified applications—indexed by sysApplElmtRunInstallPkg, sysApplElmtRunInvocID, and sysApplElmtRunIndex. Resource columns include CPU (TimeTicks, centi-seconds), memory (Gauge32, Kbytes), open file count (Gauge32, excluding sockets), full path, parameters, and user name.
The sysApplInstallElmtRole BITS object (read-write, default unknown) classifies each element using six bits: executable(0), exclusive(1), primary(2), required(3), dependent(4), unknown(5). It drives the agent's determination of application invocation, current health state, and exit status.
The sysApplInstallElmtTable describes individual executable and non-executable files composing each installed application package. It is indexed by sysApplInstallPkgIndex and sysApplInstallElmtIndex and includes columns for name, type (unknown/nonexecutable/operatingSystem/deviceDriver/application), path, installed and current file sizes (high/low pairs), role, and modification date.
The sysApplInstallPkgTable lists software application packages installed on the host, with columns for manufacturer, product name, version, serial number, installation date (DateAndTime), and installation location path (LongUtf8String). Indexed by sysApplInstallPkgIndex.
The sysApplMapTable provides a backward mapping: given a known process identifier (sysApplElmtRunIndex), it returns the corresponding invoked application (sysApplRunIndex), installed element (sysApplInstallElmtIndex), and installed package (sysApplInstallPkgIndex). Management applications use GETNEXT with the PID as partial instance identifier to retrieve all mapping values at once.
The sysApplPastRunTable maintains a history of terminated application invocations with columns for start time, exit state (complete/failed/other), and time ended. Entries are aged out when table size exceeds sysApplPastRunMaxRows (default 500) or entry age exceeds sysApplPastRunTblTimeLimit (default 7200 seconds); oldest entries (by sysApplPastRunTimeEnded) are removed first.
The sysApplRunTable records each active invocation of an application, indexed by sysApplInstallPkgIndex and sysApplRunIndex, with columns for start time (DateAndTime) and current RunState. An entry is created when the primary executable is detected running and deleted when the application terminates, at which point a corresponding entry is created in sysApplPastRunTable.
Two textual conventions are defined for internationalized strings using UTF-8 (RFC 2044): Utf8String (OCTET STRING, SIZE 0..255, DISPLAY-HINT '255a') and LongUtf8String (OCTET STRING, SIZE 0..1024, DISPLAY-HINT '1024a'). For 7-bit US-ASCII content these are encoding-transparent.
The MIB exposes sensitive system-level information via SNMP including process names, startup parameters, user identities, memory consumption, CPU usage, and open file counts. Several objects are read-write (sysApplInstallElmtRole, table-size scalars, poll interval) and require appropriate SNMPv2 access controls to prevent unauthorized disclosure or modification.
Application lifecycle: when the primary executable is detected, an entry enters sysApplRunTable (RunState: running/runnable/waiting/exiting). When required elements cease running, the agent waits one additional poll cycle; if required elements remain absent, the invocation is moved to sysApplPastRunTable with exitState complete (all elements stopped), failed (required elements absent but others running), or other.
File sizes are encoded as two Unsigned32 fields: a 'High' field holding size in 2^32-byte blocks and a 'Low' field holding size modulo 2^32 bytes. For example, a 4,294,967,296-byte file yields High=1, Low=0; a 4,294,967,295-byte file yields High=0, Low=4,294,967,295.