Management Event Management Information Base (MIB) for PacketCable- and IPCablecom-Compliant Devices
updated by
- rfc-9141 — Updating References to the IETF FTP Service
Extracted elements (30)
Event throttling (pktcEventThrottleAdminStatus) is intentionally scoped to transmitted messages only and does not affect local logging. This ensures that even under high event rates, a local audit trail is preserved regardless of network transmission constraints.
The default syslog transport is TLS (port 6514) rather than UDP, reflecting a security-conscious design choice for event transmission. The default message format is formatSyslogProtocol (RFC 5424) rather than the legacy BSD syslog format (RFC 3164), preferring the newer IETF standard.
The pktcEventLogIndex uses cyclic rotation (wraps to 1 after reaching 2^32-1, or on reset for non-persistent storage) rather than stopping. This avoids log unavailability at the cost of potentially overwriting old entries, which is acceptable for operational event logs.
Compliance with PKTC-IETF-EVENT-MIB requires implementing mandatory groups from both SNMP-TARGET-MIB (snmpTargetBasicGroup, snmpTargetResponseGroup) and SNMP-NOTIFICATION-MIB (snmpNotifyGroup, snmpNotifyFilterGroup). MTA implementations MUST consult the corresponding PacketCable or IPCablecom specifications for compliance, as this MIB uses PacketCable references by convention when requirements are equivalent.
The MIB supports both BSD syslog format (RFC 3164) and IETF syslog protocol (RFC 5424) message formats, selectable via pktcEventSyslogMessageFormat. This dual-format support enables interoperability with both legacy and modern syslog infrastructure.
Deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED. Implementers SHOULD deploy SNMPv3 with full cryptographic security (authentication and privacy) for access to this MIB module.
For PacketCable, IPCablecom, or ETSI events, the syslog facility field (pktcEventFacility) MUST be set to local0(16). This ensures consistent facility-based filtering at the syslog server.
If the MTA cannot provide additional information for a generated event, it MUST populate pktcEventLogAdditionalInfo with a zero-length OCTET-STRING rather than omitting or leaving it undefined.
If the MTA does not support the syslog transport specified in a SET operation on pktcEventSyslogTransport, it MUST return an appropriate SNMP error response such as 'inconsistentValue'.
Locally stored events MUST NOT be recorded in pktcEventLogTargetInfo; this object is reserved for external notification targets only (syslog server or SNMP manager IP addresses).
SNMPv1 traps are disallowed for event notification; only SNMPv2-Trap-PDU (snmpTrap) and SNMP INFORMs (snmpInform) are permitted. This is specified in the pktcEventNotifications sub-tree description.
The MTA MUST create exactly one event class entry with index=100 named 'generic' that contains all events not associated with any other vendor-specified event class. This guarantees a catch-all class is always present.
The MTA MUST perform reset actions specified by pktcEventReset (clear log table, reset event table to factory defaults) regardless of whether the data is stored in non-volatile memory. Setting a reset bit to '0' MUST NOT result in any action, and the object MUST always return '00' when read.
The syslog server address type (pktcEventSyslogAddressType) MUST NOT be set to dns(16) because an unresolvable DNS name would leave the device without a reachable syslog server. Default is ipv4.
When an event is associated with multiple event classes, the MTA MUST give precedence to the event class with the lowest index value. Management stations SHOULD NOT associate an event with multiple event classes.
Each management event is uniquely identified by a combination of 'Organization ID' (the IANA private enterprise number of the defining organization, e.g., 4491 for CableLabs) and an 'Event ID' that is unique within that organization's namespace. This dual-key scheme allows vendor-specific events to coexist with standard PacketCable/IPCablecom events.
pktcEventReporting is a per-event BITS object with four bits: local(0), syslog(1), snmpTrap(2), snmpInform(3). Setting a bit to '1' enables the corresponding action when the event fires. Default values are derived from the event's severity level: emerg/alert/crit/err events default to local+syslog+snmpInform; all others default to local+syslog.
pktcEventSyslogCapabilities is a read-only BITS object advertising the MTA's supported syslog message formats (formatBSDSyslog from RFC 3164, formatSyslogProtocol from RFC 5424) and transports (transportUDP, transportTLS, transportBEEP). The MTA MUST set the appropriate bits based on implementation.
pktcEventThrottleAdminStatus controls event transmission throttling with four values: unconstrained(1), maintainBelowThreshold(2), stopAtThreshold(3), and inhibited(4). Throttling applies only to transmitted messages (SNMP/syslog) and does not affect local logging. An event generating both SNMP and syslog is counted as a single event.
The PKTC-IETF-EVENT-MIB module (OID mib-2 182) is structured into six sub-trees: pktcEventControl, pktcEventThrottle, pktcEventStatus, pktcEvents, pktcEventLog, and pktcEventNotifications. It provides SNMP-based management for events generated by PacketCable- and IPCablecom-compliant MTA devices.
The pktcEventClassTable allows MTA manufacturers to group management events into named categories (event classes) with a common enable/disable status and severity mask. Any event associated with an event class MUST also appear in pktcEventTable, and entries persist across resets and reboots.
The pktcEventLogEntry records each generated event with fields including: index (chronological), time (DateAndTime), organization (IANA enterprise number), identifier, text (up to 127 octets), endpoint name (FQDN/IP format, up to 255 octets), type (actions taken), target info, correlation ID, and additional info. Log entries cannot be individually deleted.
The SyslogSeverityMask textual convention is an 8-bit mask representing syslog severity levels (emerg=0, alert=1, crit=2, err=3, warning=4, notice=5, info=6, debug=7) as defined in RFC 5424. It is used to selectively enable or disable event reporting by severity level within an event class.
RFC 5428 assigns OID { mib-2 182 } to the pktcIetfEventMib module in the SMI Numbers registry. This is the sole IANA registry action in the document.
Several read-write objects controlling event routing are security-sensitive: unauthorized modification of pktcEventSyslogAddress, pktcEventSyslogTransport, pktcEventClassStatus, pktcEventThrottleAdminStatus, and pktcEventReporting can redirect, suppress, or throttle event reporting, enabling attackers to conceal errors or denial-of-service attacks from network operators.
The pktcEventLogTable and pktcEventTransmissionStatus objects may expose sensitive operational information. Even read (GET) and notification (NOTIFY) access should be controlled, and SNMP values should be encrypted in transit. SNMPv3 with cryptographic authentication and privacy is explicitly recommended over earlier SNMP versions.
The pktcEventReset object poses a significant security risk: a rogue management station with write access can clear event logs and reset event descriptions to factory defaults, disrupting event collection for all other management stations and potentially masking misconfiguration or denial-of-service attacks. The MIB does not address multi-manager contention and recommends using pktcEventReset with caution.
pktcEventLogEndpointName encodes the event source as 'aaln/n:<FQDN>/<IP>' when identifying a specific endpoint (n being the endpoint number) or '<FQDN>/<IP>' when identifying the MTA itself. The field is an SnmpAdminString of up to 255 octets.
pktcEventLogTargetInfo encodes external notification targets as a comma-separated list in the form '<action-1/IP>,<action-2/IP>,...' where each entry uses 'syslog/<IP>', 'snmpTrap/<IP>', or 'snmpInform/<IP>'. When data exceeds capacity (e.g., multiple IPv6 addresses), the MTA MUST append '...' to indicate truncation.
The pktcEventNotification SNMP notification carries six varbinds: pktcEventLogTime (DateAndTime), pktcEventLogOrganization (Unsigned32), pktcEventLogIdentifier (Unsigned32), pktcEventLogEndpointName (SnmpAdminString up to 255 octets), pktcEventLogCorrelationId (Unsigned32), and ifPhysAddress (MTA MAC address).