Definitions of Managed Objects for WWW Services
Extracted elements (27)
Certain summary counter objects (wwwSummaryInRequests, wwwSummaryOutRequests, etc.) are deliberately redundant with the detailed request/response tables to provide operators a quick overview and reduce SNMP polling traffic for common monitoring tasks.
The cache hit/miss ratio for caching proxies is intentionally not stored as an explicit MIB object; instead it is derivable from the existing incoming and outgoing request/response counters. This avoids redundancy while still enabling the metric.
The MIB is self-contained and can be implemented without the APPLICATION-MIB or SYSAPPL-MIB, though it interfaces to those MIBs via the wwwServiceIndex/applSrvIndex linkage. This allows incremental adoption in environments that only need WWW monitoring.
The MIB uses an abstract Document Transfer Protocol (DTP) to remain independent of specific application protocols. This allows the same MIB object definitions to cover HTTP, FTP, and future protocols by defining per-protocol mappings in separate sections or future RFCs.
Top-N document statistics use a bucket mechanism with configurable time intervals rather than continuous aggregation, explicitly to limit agent CPU and memory consumption. Raw per-document data within a bucket is discarded after Top-N computation to conserve resources.
For FTP, WwwRequestType maps to the FTP command token and WwwResponseType maps to the three-digit FTP reply code. The primary response for a request is the reply with a 2xy, 3xy, 4xy, or 5xy code; preliminary 1xy replies are counted separately. The default wwwServiceProtocol OID is { applTCPProtoID 21 }.
For HTTP, WwwRequestType maps to the HTTP method token (e.g., 'GET', 'POST') and WwwResponseType maps to the three-digit HTTP Status-Code. The default wwwServiceProtocol OID for HTTP is { applTCPProtoID 80 }.
When a DTP sends multiple responses for a single request, all responses are counted individually in the protocol statistics tables. However, only the primary response (the one indicating request success or failure) is used for document statistics and wwwDocLastNResponseType.
When this MIB is translated to SMIv1, Counter64 objects cannot be represented and will be omitted. The translated MIB must be semantically equivalent except for this omission; the companion Counter32 low-byte objects provide partial coverage for SMIv1 environments.
A manager MUST NOT keep the wwwDocLastNTable locked via wwwDocCtrlLastNLock when it is not necessary to finish a retrieval operation. Additionally, any attempt to decrease the lock timer value MUST fail with an inconsistentValue error to allow multiple managers to cooperatively lock the table.
Minimal compliance (wwwMinimalCompliance) requires only wwwServiceGroup and wwwSummaryGroup. Full compliance (wwwFullCompliance) additionally makes wwwRequestInGroup and wwwResponseOutGroup mandatory for servers/proxies, and wwwRequestOutGroup and wwwResponseInGroup mandatory for clients/proxies.
The wwwServiceIndex value MUST be the same as the corresponding applSrvIndex from the APPLICATION-MIB if that object is available. Manual sub-agent configuration may be required to satisfy this constraint.
wwwServiceStartTime and wwwServiceLastChange SHALL be set to the value '0000000000000000'H (all-zero DateAndTime) when the respective timestamp is not known to the agent.
The Protocol Statistics Group contains five tables: wwwSummaryTable (aggregate counts), wwwRequestInTable and wwwRequestOutTable (per-request-type counts), and wwwResponseInTable and wwwResponseOutTable (per-response-type counts), all indexed by wwwServiceIndex.
The WWW-MIB module is assigned OID { mib-2 65 } and defines managed objects for monitoring World Wide Web services using an abstract Document Transfer Protocol (DTP) framework applicable to HTTP, FTP, and future protocols.
The wwwDocBucketTable, wwwDocAccessTopNTable (sorted by access count), and wwwDocBytesTopNTable (sorted by bytes transferred) are populated atomically at the end of each time interval; Top-N data is not visible while the current bucket is still filling.
The wwwDocCtrlTable controls document statistics collection per service, with configurable parameters: wwwDocCtrlLastNSize (default 25 entries), wwwDocCtrlBuckets (default 4 buckets), wwwDocCtrlBucketTimeInterval (default 90000 centiseconds = 15 minutes), and wwwDocCtrlTopNSize (default 25 entries).
The wwwDocLastNTable records the last N document access attempts as a sliding window, indexed by a monotonically increasing integer. Each entry includes document name, timestamp, request type, primary response type, human-readable status message, and bytes transferred.
The wwwServiceTable provides per-service administrative information including description, contact, protocol OID, service name (including virtual host name), service type (server/client/proxy/caching-proxy), start time, operational status, and last state change time.
WwwDocName is a textual convention (OCTET STRING, SIZE 0..255) representing the server-relative path of a document URI, stripping query strings. For 'http://www.x.org/standards/search/search.cgi?string=test' the value is '/standards/search/search.cgi'.
WwwRequestType is a textual convention defined as OCTET STRING (SIZE 1..40) representing the textual identification of DTP request types. For HTTP this maps to the method token; for FTP, to the command token.
WwwResponseType is a textual convention defined as Integer32 (0..2147483647) representing DTP response status codes. For HTTP this maps to the Status-Code; for FTP, to the three-digit reply code.
Read-write objects in this MIB (wwwDocCtrlLastNSize, wwwDocCtrlLastNLock, wwwDocCtrlBuckets, wwwDocCtrlBucketTimeInterval, wwwDocCtrlTopNSize) are sensitive in non-secure environments; unauthorized writes can disrupt agent statistics collection and management visibility.
SNMPv1 is not a secure environment; even on an IPsec-protected network there is no access control over who can read or modify MIB objects. Implementers are recommended to use SNMPv3 with the User-based Security Model (RFC 2574) and View-based Access Control Model (RFC 2575).
The document statistics group exposes the names of documents accessed, which constitutes sensitive traffic analysis data. Sites should configure SNMP MIB views so that each user can only access statistics belonging to WWW services they manage.
WwwOperStatus defines five operational states for a WWW service: down(1) — service unavailable; running(2) — operational and available; halted(3) — operational but not accepting requests; congested(4) — no additional inbound associations can be accommodated; restarting(5) — temporarily unavailable but coming back.
Byte counters (wwwSummaryInBytes, wwwSummaryOutBytes) are encoded as Counter64 for full 64-bit precision, with companion Counter32 objects (wwwSummaryInLowBytes, wwwSummaryOutLowBytes) carrying the lowest 32 bits to support SNMPv1 agents that cannot handle Counter64.