Definitions of Managed Objects for Mapping SYSLOG Messages to Simple Network Management Protocol (SNMP) Notifications
Extracted elements (23)
A separate SYSLOG notification log (syslogMsgTable) is provided alongside the generic NOTIFICATION-LOG-MIB because SYSLOG messages may not always generate SNMP notifications, and SNMP notifications may not carry all SYSLOG structured data — making a SYSLOG-specific log necessary.
SyslogTimeStamp uses microsecond subsecond granularity (3-octet field) rather than the decisecond granularity of SNMPv2-TC DateAndTime, to faithfully represent the precision available in RFC 5424 SYSLOG timestamps.
syslogMsgMsg may be truncated at arbitrary octet boundaries during SYSLOG forwarding, potentially producing invalid UTF-8 encodings at the end of the value; implementations must tolerate this condition.
When SNMP notifications are tunneled through SYSLOG (using the RFC 5675 mapping) and then translated back to SNMP via this MIB, SYSLOG transport size restrictions and verbose textual encoding may cause truncation, resulting in an incomplete reconstructed SNMP notification.
Deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED; SNMPv3 with cryptographic security SHOULD be deployed instead.
If an application reduces syslogMsgTableMaxSize while entries exist in syslogMsgTable, the oldest SYSLOG messages MUST be discarded to bring the table to the new limit.
It is RECOMMENDED that deployments use SYSLOG security mechanisms to prevent attackers from injecting malicious SYSLOG data into the MIB tables, since SNMPv3 only secures the SNMP transport leg.
It is RECOMMENDED that implementers support SNMPv3 with full cryptographic mechanisms (authentication and privacy) for securing access to this MIB module.
When a syslogMsgNotification is missing structured data element parameters, a forwarding application MUST retrieve the missing parameters from the SYSLOG-MSG-MIB.
syslogMsgEnableNotifications (TruthValue, read-write, default false) controls whether syslogMsgNotification notifications are generated. Its value SHOULD be kept in nonvolatile memory.
syslogMsgIndex is a monotonically increasing Unsigned32 (1..4294967295) identifying entries in syslogMsgTable. When it reaches 4294967295, the value wraps back to 1; pollers must account for full rollovers.
syslogMsgNotification carries syslogMsgFacility, syslogMsgSeverity, syslogMsgVersion, syslogMsgTimeStamp, syslogMsgHostName, syslogMsgAppName, syslogMsgProcID, syslogMsgMsgID, syslogMsgSDParams, and syslogMsgMsg. Implementations MAY include syslogMsgSDParamValue objects if they fit within SNMP size constraints.
syslogMsgSDParams (Unsigned32, read-only) records the total number of structured data element parameters in a SYSLOG message, equaling the number of corresponding syslogMsgSDTable entries. Notification receivers can use this to detect truncated notifications.
syslogMsgSDTable stores structured data element parameters from SYSLOG messages, indexed by (syslogMsgIndex, syslogMsgSDParamIndex, syslogMsgSDID, syslogMsgSDParamName). The relationship to syslogMsgTable ranges from one-to-zero to one-to-many since structured data is optional.
syslogMsgTable is a conceptual table storing recent SYSLOG messages, indexed by syslogMsgIndex (Unsigned32, 1..4294967295). Each entry contains facility, severity, version, timestamp, hostname, app-name, procid, msgid, SD parameter count, and message body.
syslogMsgTableMaxSize (Unsigned32, read-write) controls the maximum number of SYSLOG messages held in syslogMsgTable; a value of 0 means no fixed limit. Its value SHOULD be kept in nonvolatile memory.
The SYSLOG-MSG-MIB module is assigned OID mib-2 192 and organizes objects into syslogMsgNotifications (0), syslogMsgObjects (1), and syslogMsgConformance (2) subtrees. It provides a MIB representation of SYSLOG messages for SNMP management.
Three MODULE-COMPLIANCE statements are defined: syslogMsgFullCompliance (all four groups mandatory), syslogMsgReadOnlyCompliance (same groups but write access to control objects not required), and syslogMsgNotificationCompliance (notification-only implementations, table objects accessible-for-notify only).
IANA assigned value 192 under the mib-2 subtree (OID 1.3.6.1.2.1.192) for the SYSLOG-MSG-MIB module, recorded in the SMI Numbers registry.
The content objects (facility, severity, timestamp, hostname, app-name, procid, msgid, SD params, message body) carry SYSLOG message content; an attacker with SNMP GET or NOTIFY access can exploit this information. SNMP access control rules enforcing consistent security policy are therefore desirable.
Unauthorized modification of syslogMsgTableMaxSize can increase memory consumption or eliminate the GET-based notification retrieval capability; unauthorized modification of syslogMsgEnableNotifications can suppress real-time alerts or enable DoS against a network management system via notification flooding.
SyslogParamValueString is an OCTET STRING encoding UTF-8 (RFC 3629) text for SYSLOG SD-PARAM values. Byte sequences not corresponding to valid UTF-8 code points (0x00000000–0x7FFFFFFF), overlong sequences, and out-of-range sequences are prohibited.
SyslogTimeStamp is an OCTET STRING of SIZE (0 | 10 | 13) encoding year (2 octets, network byte order), month, day, hour, minutes, seconds, microseconds (3 octets, network byte order), UTC direction, UTC hours, and UTC minutes. A zero-length string indicates a missing timestamp.