Distributed Management Expression MIB
Extracted elements (27)
Delta sampling intervals for nested expressions cannot be accurately synchronized. The design guidance is that a lower-level delta interval should be at least twice as fast as a higher-level sampling interval to prevent the higher level from reading the same sample twice.
Expression syntax is based on ANSI C rather than an SNMP-specific language because C-style arithmetic and boolean operators are widely understood and sufficiently expressive for MIB calculations. The subset is intentionally restricted (no casting, limited constant types) to keep implementation tractable within managed systems.
Subset implementations that omit wildcarding or delta processing are explicitly supported to accommodate resource-constrained managed systems. Omitting wildcarding reduces retrieval complexity; omitting deltas eliminates ongoing state and sampling overhead. These subsets are driven by dependencies from the Event MIB and the need to support lower-end systems.
The expObjectConditional cannot trivially use a TruthValue object directly because TruthValue uses values 1 (true) and 2 (false) rather than 0/non-zero, making a non-zero false value indistinguishable from true. The conditional treats 0 or NoSuchInstance as false and any other non-zero value as true.
The Expression MIB exists because users frequently need custom MIB objects that MIB designers have not provided, and such needs vary by management philosophy. Rather than proliferating more standardized MIBs, the Expression MIB allows externally defined expressions of existing objects, making results usable anywhere a MIB object can be used.
A no-deltas subset implementation prohibits deltaValue and changedValue sample types, making counter-based expressions unusable. Compliance is indicated by restricting expObjectSampleType write syntax to absoluteValue(1) and setting expResourceDeltaMinimum to -1.
A no-wildcards subset implementation allows expressions over individual scalar MIB objects but is unsuitable for table-wide expressions or tables with dynamic instances. Compliance is indicated by restricting expObjectIDWildcard write syntax to false(2).
expResourceDeltaWildcardInstanceMaximum limits the maximum number of dynamic wildcard delta instances. An attempt to allocate beyond this limit results in expErrorCode being set to tooManyWildcardValues for that evaluation. A value of 0 means no preset limit.
Expressions must not be recursive: an expression may use results of another expression but must not contain any variable that is directly or indirectly a result of its own evaluation. The managed system must check for recursive expressions.
Final error checking for an expression must occur at evaluation time (when expValueTable is read or a delta interval expires). An implementation may not impose any ordering on the creation of expExpressionTable and expObjectTable entries; earlier checking need not be done.
For expressions with delta or changedValue objects, evaluation occurs continuously every delta interval even if no application is reading the results. Delta state must be maintained constantly, creating ongoing CPU and memory overhead.
When a delta expression fails to evaluate in a given sample period (e.g., due to missing object instances), the value from the previous successful sample period must not be carried forward to the failed period.
When creating a new row in expExpressionTable or expValueTable, the managed system must record the security credentials (inputs to isAccessAllowed per RFC 2571) of the requester. Expression evaluation must take place under those recorded credentials for all implied Gets of objects in the expression.
expErrorCode enumerates 11 error conditions: invalidSyntax, undefinedObjectIndex, unrecognizedOperator, unrecognizedFunction, invalidOperandType, unmatchedParenthesis, tooManyWildcardValues, recursion, deltaTooShort, resourceUnavailable, and divideByZero. Errors on Set return SNMP 'wrongValue'; errors during Get/GetNext return 'genErr' except tooManyWildcardValues and resourceUnavailable which return 'resourceUnavailable'.
expExpression uses a subset of ANSI C syntax (up to 1024 bytes). Variables reference objects by $n (e.g., $1, $5). Allowed operators include arithmetic, bitwise, logical, and comparison operators. Allowed functions include counter32(), counter64(), arraySection(), stringBegins/Ends/Contains(), oidBegins/Ends/Contains(), average(), maximum(), minimum(), sum(), and exists().
expExpressionPrefix is a read-only OID that identifies the OID of any wildcarded object in the expression, enabling management applications to determine the instance indexing scheme for expValueTable without scanning expObjectTable. It is zero-length for non-wildcarded (scalar) expressions.
expObjectDeltaDiscontinuityID points to a TimeTicks, TimeStamp, or DateAndTime object that signals a counter discontinuity for the associated delta object. It defaults to sysUpTimeInstance. Even if a custom discontinuity object is specified, implementations must also check sysUpTime for overall discontinuities.
expObjectSampleType supports three sampling modes: absoluteValue (present value), deltaValue (present minus previous value sampled expExpressionDeltaInterval seconds ago, intended for counters), and changedValue (boolean Unsigned32 indicating whether the value changed since the last sample). When an expression mixes delta and absolute objects, absolute values are obtained at the end of the delta period.
The expErrorTable, indexed by expExpressionOwner and expExpressionName, records the most recent evaluation error including sysUpTime of the error (expErrorTime), character offset into the expression (expErrorIndex), error code (expErrorCode), and the value instance being evaluated (expErrorInstance).
The expExpressionTable, indexed by expExpressionOwner and expExpressionName, holds the expression string (expExpression, up to 1024 bytes of ANSI C subset syntax), the result value type, optional delta sampling interval, and a RowStatus control. All related expObjectTable and expErrorTable entries are deleted when an expression entry is deleted.
The expObjectTable, indexed by expExpressionOwner, expExpressionName, and expObjectIndex, holds per-object parameters for each expression: the OID (expObjectID), wildcard flag (expObjectIDWildcard), sample type (absoluteValue/deltaValue/changedValue), discontinuity indicator OID, and conditional filter OID.
The Expression MIB is organized into three sections: Resource (manages system resource usage), Definition (defines expressions via expExpressionTable and expObjectTable), and Value (holds evaluated expression results in expValueTable). Evaluated expression results are MIB objects usable anywhere other MIB objects can be used, including as event triggers.
The expValueTable, indexed by expExpressionOwner, expExpressionName, and IMPLIED expValueInstance (an OID fragment prefixed with 0.0), holds a discriminated union of result types: Counter32, Unsigned32, TimeTicks, Integer32, IpAddress, OCTET STRING, OBJECT IDENTIFIER, and Counter64. Only one column per row is instantiated based on expExpressionValueType.
Wildcarding allows a single expression to apply to multiple instances by omitting part or all of the instance portion of an expObjectID and setting expObjectIDWildcard to true. The application performs GetNext-equivalent traversal to discover instances. All wildcarded objects in a single expression must share the same semantics for the missing instance portion.
The DISMAN-EXPRESSION-MIB module is registered at mib-2.90 (1.3.6.1.2.1.90), with three sub-trees: expResource (1), expDefine (2), and expValue (3). This is the initial version of the MIB, published in RFC 2982.
Expression results may be readable by users who do not have access to the underlying raw MIB objects, since results are evaluated under the security credentials of the expression creator (the entity that set expExpressionRowStatus to active). This can be either a deliberate delegation or a security violation depending on the security policy.
To support VACM-based per-user access control, expExpressionOwner serves as an owner index with SnmpAdminString syntax, allowing it to be mapped directly to a VACM securityName or groupName. All entries for a given owner share the same OID subidentifier prefix through the encoded owner index, enabling vacmViewTreeFamilyTable entries to scope access precisely.