Event MIB
Extracted elements (29)
A trigger frequency of 0 is defined to indicate instantaneous (interrupt-driven) recognition; this is explicitly noted as not possible in many cases and likely only supportable for objects tightly integrated with low-level code. Systems supporting it SHOULD document which objects allow it.
The Event MIB is based on extensive experience with RMON (RFC 1757) and provides a superset of RMON alarm and event group capabilities. The key extension is allowing alarms (called 'triggers') to monitor MIB objects on remote network elements, not just the local system.
The Event MIB is the successor to SNMPv2's Manager-to-Manager MIB (RFC 1451), which was declared Historic pending this work. Event MIB events extend RMON's notification concept by adding the ability to set a MIB object as an event action.
The mteOwner field as initial table index is a deliberate design choice to enable VACM-based per-user access control: entries sharing an owner have the same OID prefix up to the encoded owner index, allowing a single vacmViewTreeFamilyTable entry to scope access per owner.
Context name wildcarding for remote systems (mteTriggerContextNameWildcard) MAY not be supported, as a local list of available contexts on a remote system is not defined by any current standard. Implementations are permitted to limit this feature to local monitoring.
The Event MIB depends on the services of the SNMPv3 Management Target MIB and Notification MIB (RFC 2573) for remote target selection and notification dispatch. Remote monitoring uses the tag service of the Management Target MIB to select remote systems.
The Event MIB is complemented by the Distributed Management Expression MIB (RFC 2982), which is the expected source of boolean objects to monitor. There is considerable overlap in wildcard and delta sample capabilities between the two MIBs, and implementations may share common code.
Error notifications SHOULD be enabled only for the diagnosis of problems indicated by error counters; if minimizing notification loss is a concern they SHOULD be transmitted as Inform PDUs as described in the SNMP Target MIB or directed to a log.
For 'boolean' and 'threshold' trigger tests, the object at mteTriggerValueID MUST evaluate to an integer (anything encoded as an integer in BER).
If a custom mteTriggerDeltaDiscontinuityID is specified that does not point to sysUpTime, discontinuity checking MUST still check sysUpTime for an overall discontinuity.
mteHotContextName in error/trigger notifications MUST be as fully-qualified as possible, including filling in wildcard information determined during processing. Similarly, mteHotOID MUST be as fully-qualified as possible.
Once an mteTriggerEntry or mteEventEntry is made active, it MAY not be modified except to delete it. This applies to both trigger and event table entries.
Unless explicitly resource limited, mteResourceSampleMinimum SHOULD be 1 (allowing 1-second trigger sampling intervals) and mteResourceSampleInstanceMaximum SHOULD be 0 (no preset limit).
When accessing local objects without using a local target tag, the system MUST (conceptually) use isAccessAllowed from the SNMP Architecture to ensure it does not violate access control. Security credentials are recorded from the creator of the trigger entry.
Wildcards indicate that the application SHOULD use a GetNext-type operation to find the zero or more instances implied by a truncated object identifier, treating each instance independently as if it were a separate table entry.
Delta sampling (mteTriggerDeltaTable) requires a discontinuity indicator object specified by mteTriggerDeltaDiscontinuityID, defaulting to sysUpTime.0. Even if a custom discontinuity ID is configured, sysUpTime MUST still be checked for an overall discontinuity.
Five notifications are defined: mteTriggerFired (boolean/existence trigger), mteTriggerRising (threshold rising), mteTriggerFalling (threshold falling), mteTriggerFailure (trigger check failure), and mteEventSetFailure (set action failure). All include mteHotTrigger, mteHotTargetName, mteHotContextName, and mteHotOID.
mteTriggerThresholdStartup controls which event may fire when a trigger entry first becomes active: 'rising', 'falling', or 'risingOrFalling' (default). This prevents missing an already-violated threshold at startup.
The Event MIB (DISMAN-EVENT-MIB) is organized into four sections: triggers, objects, events, and notifications. Triggers define conditions that lead to events; events may cause notifications or set MIB objects; the objects table lists supplemental objects to attach to notifications.
The FailureReason textual convention enumerates both local errors (negative codes: localResourceLack, badDestination, destinationUnreachable, noResponse, badType, sampleOverrun) and SNMP protocol error codes (positive values copied from SNMP response codes).
The mteEventTable defines event actions via mteEventActions (a BITS field): 'notification' sends SNMP Traps/Informs per the SNMP Notification MIB configuration; 'set' performs an SNMP Set on the object defined in mteEventSetTable. Both can be selected simultaneously.
The mteObjectsTable defines named groups of additional MIB objects to attach to notifications. Objects are added in lexical index order, with trigger-level objects first, then trigger-test-level, then event-level. Each object can be wildcarded using mteObjectsIDWildcard.
The mteTriggerTable defines what MIB objects are to be monitored and how, indexed by mteOwner and mteTriggerName. Each entry specifies the object to sample (mteTriggerValueID), sampling type, target tag, context, frequency, and test type (existence, boolean, or threshold).
Three trigger test types are supported: 'existence' fires when the monitored object appears, vanishes, or changes value; 'boolean' fires when a comparison test against a configured value is true; 'threshold' fires when sampled values cross rising or falling thresholds. These are specified as a BITS field in mteTriggerTest.
Threshold trigger behavior (mteTriggerThresholdTable) uses hysteresis: after a rising event fires, another rising event is not triggered until the value drops below the threshold and reaches the falling threshold, and vice versa. Separate rising and falling thresholds exist for both absolute values and delta values.
Two sampling modes are defined via mteTriggerSampleType: 'absoluteValue' uses a single sample (the object's current value), while 'deltaValue' uses the difference between two consecutive samples. SNMP counters should be sampled as deltaValue to be meaningful.
Security for monitoring remote objects depends on the Management Target MIB (RFC 2573). For local access, the system records the security credentials of the trigger entry creator and uses isAccessAllowed to enforce access control on all object accesses, including local ones.
Security of Event MIB entries depends on SNMPv3 access control for the entire MIB or for subsets based on entry owner names (mteOwner). For multi-user tables, the initial index serves as an 'owner index' that can be mapped to a VACM securityName or groupName.
To configure VACM for multi-user Event MIB tables, administrators should create vacmViewTreeFamilyTable entries whose subtree OID includes the owner index portion, with a mask that wildcards the column sub-identifier, granting each owner access only to their own entries.