Notification Log MIB
Extracted elements (28)
The log index is a monotonically increasing integer so polling applications can detect missed entries by tracking the highest index retrieved and checking sysUpTime for discontinuities that would reset the index.
The MIB models non-SNMP notification sources as the SNMP engine sending a notification to itself, allowing a uniform logging model for both SNMP informs/traps and other notification mechanisms without separate infrastructure.
Variable values are stored as a discriminated union (one column per SNMP data type) rather than a single opaque blob, allowing management applications to directly access typed values without additional decoding and enabling SNMP access control on individual variable values.
For SNMPv1 traps, nlmLogEngineID is a zero-length string (no engineID in SNMPv1 PDU format); nlmLogEngineTAddress is used to identify the trap source instead. For SNMPv1 traps, nlmLogContextName carries the community string.
IPv6 addresses cannot be stored in nlmLogVariableIpAddressVal (which uses the IpAddress type, an IPv4 format); IPv6 addresses represented as TAddress or InetAddress use OCTET STRING and are stored in nlmLogVariableOctetStringVal instead.
nlmLogContextEngineID carries the contextEngineID only when the Notification was received in a protocol that has such an element (e.g., SNMPv3); otherwise it is a zero-length string.
A managed system with fewer resources MAY disallow creation of named logs, providing only the default null-named log, which has no implicit security credentials and logs Notifications without further access control checking.
A zero-length log name MUST be used as the default log name by systems that do not support named logs.
If adding an entry would exceed nlmConfigGlobalEntryLimit or system resources, the oldest entry in any log SHOULD be removed. If adding an entry would exceed nlmConfigLogEntryLimit, the oldest entry in that specific log SHOULD be removed.
If an application changes nlmConfigGlobalEntryLimit while Notifications are in the log, the oldest Notifications MUST be discarded to bring the log down to the new limit; nlmConfigGlobalEntryLimit MUST take precedence over nlmConfigGlobalAgeOut and nlmConfigLogEntryLimit.
nlmLogEngineTAddress MUST always be instantiated, even if the log can contain Notifications from only one engine, as it is needed to identify SNMPv1 trap sources where no EngineID is available.
nlmLogTime MUST be set to zero for entries that occurred before the most recent management system initialization, since TimeStamp is based on sysUpTime which resets on initialization.
Systems that keep wall clock date and time MUST implement the notificationLogDateGroup (containing nlmLogDateAndTime); systems without a wall clock SHOULD NOT implement it.
The managed system SHOULD NOT apply access control when adding remotely-generated Notifications into either a named log or the default null-named log; security SHOULD be left to overall access control for the log itself.
When putting locally-generated Notifications into a named log, the managed system MUST use the security credentials associated with that log and MUST apply the same access control rules as described for a Notification Originator in RFC 2573.
nlmConfigGlobalEntryLimit (Unsigned32, default 0) sets the maximum total number of notification entries across all logs; 0 means no limit. nlmConfigGlobalAgeOut (Unsigned32, units minutes, default 1440) sets the age after which Notifications MAY be removed; 0 means no age out.
nlmConfigLogOperStatus is a read-only INTEGER with three values: disabled(1) when administratively disabled, operational(2) when enabled and working, noFilter(3) when enabled but nlmConfigLogFilterName is zero-length or does not name an existing snmpNotifyFilterTable entry.
nlmConfigLogTable provides a table of logging control entries indexed by nlmLogName (SnmpAdminString, SIZE 0..32). Each entry controls a named log with filter, entry limit, admin status, oper status, storage type, and row status.
nlmLogTable stores Notification log entries indexed by nlmLogName and nlmLogIndex (Unsigned32, 1..4294967295, monotonically increasing). Each entry records time, engine ID, transport address/domain, context engine ID, context name, and notification OID.
nlmLogVariableTable stores varbind values from logged Notifications, indexed by nlmLogName, nlmLogIndex, and nlmLogVariableIndex. It uses a discriminated union pattern where nlmLogVariableValueType determines which of nine typed value columns is instantiated.
Statistics are maintained at two levels: global counters nlmStatsGlobalNotificationsLogged and nlmStatsGlobalNotificationsBumped, plus per-log counters nlmStatsLogNotificationsLogged and nlmStatsLogNotificationsBumped (augmenting nlmConfigLogTable).
The Notification Log MIB (NOTIFICATION-LOG-MIB) is assigned OID { mib-2 92 } and provides common infrastructure for logging SNMP Notifications (Traps and Informs) as a hedge against lost notifications.
The MIB module NOTIFICATION-LOG-MIB is registered under { mib-2 92 }, establishing four conformance groups: notificationLogConfigGroup, notificationLogStatsGroup, notificationLogLogGroup, and the conditionally mandatory notificationLogDateGroup.
Access control for objects in a Notification can only be checked where the Notification is created, making it feasible only for locally-generated Notifications when security credentials are available. For remotely-generated Notifications, only overall log access control applies.
Contention between multiple managers setting nlmConfigGlobalEntryLimit or nlmConfigGlobalAgeOut to different values can be exploited to orchestrate a denial-of-service attack by causing Notifications to be deleted before other applications can read them. Methods for countering such attacks are noted as for further study.
nlmLogEngineTAddress may not uniquely identify the SNMP engine from which a Notification was received, for example when the engine uses DHCP or NAT, potentially allowing source address spoofing or misidentification.
nlmLogName is an SnmpAdminString of SIZE(0..32). A zero-length log name is reserved for the default system-managed log; non-zero names identify application-created named logs.
nlmLogVariableValueType is an INTEGER enumeration with 9 values: counter32(1), unsigned32(2), timeTicks(3), integer32(4), ipAddress(5), octetString(6), objectId(7), counter64(8), opaque(9). Exactly one corresponding value column MUST be instantiated per variable entry.