Management Information Base for Virtual Machines Controlled by a Hypervisor
Extracted elements (28)
All MIB objects are defined from the hypervisor operator's viewpoint (resource allocation), not the VM operator's viewpoint (resource utilization). For example, vmNetworkIfIndex 'in'/'out' directions mean from-VM-to-hypervisor and from-hypervisor-to-VM, and vmStorageAllocatedSize reflects what the hypervisor has allocated rather than what the guest OS actually uses.
The bulk notification mechanism was designed to reduce the number of notifications trapped by an SNMP manager. In large data centers, thousands of VMs managed across many hypervisors could produce an unmanageable notification volume if per-VM notifications are used for every state change. Bulk notifications carry only a vmAffectedVMs bitmask and prompt the manager to poll for details.
The MIB was derived from and generalizes three product-specific MIBs: a Xen guest MIB, a VMware VM MIB, and a libvirt-based MIB. The design goal was to define managed objects common to multiple hypervisor implementations rather than being tied to any one product.
Virtual switch objects are intentionally excluded from VM-MIB because virtual NICs are the lowest-level network abstraction allocated to a VM. IEEE 802.1 bridge MIBs (IEEE8021-BRIDGE-MIB, IEEE8021-Q-BRIDGE-MIB) cover virtual switch management instead.
vmHvObjectID and vmHvUpTime are new objects that complement but do not replace sysObjectID and sysUpTime from SNMPv2-MIB: sysObjectID identifies the device/firmware/OS, not the hypervisor software, and sysUpTime measures the management subsystem uptime, not the hypervisor's uptime since its last re-initialization.
Both physical and virtual network interfaces are required to be represented in IF-MIB's ifTable. The vmNetworkTable in VM-MIB points to ifTable entries via vmNetworkIfIndex, and to parent physical NICs via vmNetworkParent. Management IP addresses and other VM-specific objects not common to all hypervisors may be placed in ENTITY-MIB's entLogicalTable.
On systems implementing HOST-RESOURCES-MIB (RFC 2790), vmStorageParent points to the hrStorageIndex of the parent physical storage in hrStorageTable, and vmCpuPhysIndex matches hrDeviceIndex in hrProcessorTable. If no corresponding HOST-RESOURCES-MIB entry exists, vmStorageParent is zero.
A command generator MUST use vmUUID (the 128-bit UUID) to identify a given virtual machine of interest, because vmIndex may not persist across hypervisor re-initializations. The UUID MUST uniquely identify a VM across all virtual machines in an administrative domain.
A VirtualMachineIndex value assigned to a virtual machine MUST remain constant at least from one re-initialization of the hypervisor to the next re-initialization. The same stability requirement applies to VirtualMachineCpuIndex, VirtualMachineStorageIndex, and VirtualMachineNetworkIndex.
Changes to vmPerVMNotificationsEnabled and vmBulkNotificationsEnabled MUST NOT persist across re-initialization of the management system (e.g., SNMP agent). If per-VM notifications are not implemented, vmPerVMNotificationsEnabled MUST report false(2); similarly for vmBulkNotificationsEnabled.
If a virtual network interface is not represented in the IF-MIB ifTable, vmNetworkIfIndex MUST be zero. On systems implementing HOST-RESOURCES-MIB, vmCpuPhysIndex MUST equal the hrDeviceIndex used in hrProcessorTable.
The vmAdminState object defines the administrative intent for a VM (running, suspended, paused, shutdown), while vmOperState reflects the actual operational state. Writes to vmAdminState trigger state transitions; the resulting vmOperState changes generate notifications. Per-VM compliance requires mandatory groups: vmHypervisorGroup, vmVirtualMachineGroup, vmCpuGroup, vmCpuAffinityGroup, vmStorageGroup, and vmNetworkGroup.
vmHvSoftware SHOULD NOT include the hypervisor version, as that SHOULD be reported separately in vmHvVersion. This separates software identity from version to enable independent queries.
vmStorageAllocatedSize MUST NOT be different from vmStorageDefinedSize when vmStorageSourceType is 'block' or 'raw', because block devices and raw files have no thin-provisioning gap. Both values MUST be set to -1 if the information is unavailable.
vmStorageDefinedSize MUST be -1 if the defined storage size information is not available from the hypervisor. vmStorageAllocatedSize MUST also be -1 if that information is unavailable.
The IANA-STORAGE-MEDIA-TYPE-MIB defines the IANAStorageMediaType textual convention with values: unknown(1), other(2), hardDisk(3), opticalDisk(4), and floppyDisk(5). This IANA-maintained MIB is imported by VM-MIB for use in vmStorageMediaType.
The vmCpuAffinityTable maps virtual CPUs to physical CPUs, indexed by vmIndex, vmCpuIndex, and vmCpuPhysIndex. The vmCpuAffinity object indicates whether a given virtual CPU is pinned (enabled) or not (disabled) to the physical CPU identified by vmCpuPhysIndex.
The vmCpuTable provides per-virtual-CPU information indexed by vmIndex and vmCpuIndex, containing vmCpuCoreTime (Counter64, in microseconds) for each virtual CPU assigned to a virtual machine.
The vmHypervisor scalar group provides basic hypervisor information: vmHvSoftware (SnmpAdminString, 0–255 octets), vmHvVersion (SnmpAdminString, 0–255 octets), vmHvObjectID (OBJECT IDENTIFIER within SMI enterprises subtree 1.3.6.1.4.1), and vmHvUpTime (TimeTicks in centiseconds since last hypervisor re-initialization).
The vmNetworkTable lists virtual network interfaces attached to virtual machines, indexed by vmIndex and vmNetworkIndex. Each entry contains vmNetworkIfIndex (pointer into IF-MIB ifTable), vmNetworkParent (pointer to physical NIC in ifTable), vmNetworkModel (emulated driver name), and vmNetworkPhysAddress (MAC address).
The vmStorageTable describes virtual storage devices attached to virtual machines, indexed by vmStorageVmIndex and vmStorageIndex. Entries include source type, access permission, media type, defined/allocated sizes (in vmStorageSizeUnit-byte units), and I/O counters (ReadIOs, WriteIOs, ReadOctets, WriteOctets, ReadLatency, WriteLatency) all as Counter64 values in microseconds or octets.
The vmTable is the core table listing all virtual machines known to the hypervisor, indexed by vmIndex. Each entry (VmEntry) contains vmIndex, vmName, vmUUID, vmOSType, vmAdminState, vmOperState, vmAutoStart, vmPersistent, vmCurCpuNumber, vmMinCpuNumber, vmMaxCpuNumber, vmMemUnit, vmCurMem, vmMinMem, vmMaxMem, vmUpTime, and vmCpuTime.
Two IANA-defined notification control objects exist: vmPerVMNotificationsEnabled (TruthValue, read-write) enables per-VM notifications (vmRunning, vmShutdown, vmPaused, vmSuspended, vmCrashed, vmDeleted, etc.), and vmBulkNotificationsEnabled enables bulk notifications (vmBulkRunning, etc.) that carry only a vmAffectedVMs bitmask rather than individual VM details.
IANA assigned OID mib-2 236 to the VM-MIB MODULE-IDENTITY (vmMIB) and OID mib-2 237 to the IANA-STORAGE-MEDIA-TYPE-MIB MODULE-IDENTITY (ianaStorageMediaTypeMIB), both published as part of RFC 7666.
Several read-only objects expose sensitive operational data about virtual machine configuration and resource utilization (vmOSType, vmStorageResourceID, vmNetworkPhysAddress, vmCpuTime, vmUpTime). Unauthorized read access to these objects could allow an attacker to enumerate VM inventory and hardware layout. SNMPv3 with view-based access control is recommended to limit exposure.
The VM-MIB contains read-write objects (vmPerVMNotificationsEnabled, vmBulkNotificationsEnabled) that could be exploited to suppress or flood notifications if unauthorized access is granted. Implementations MUST apply SNMP access-control mechanisms to restrict write access to these objects, and MUST use SNMPv3 with authentication and privacy to protect management traffic.
The vmOperState textual convention defines 12 operational states for a virtual machine: unknown(1), other(2), preparing(3), running(4), suspending(5), suspended(6), resuming(7), paused(8), migrating(9), shuttingdown(10), shutdown(11), and crashed(12). Transient states (suspending, resuming, shuttingdown, migrating, preparing) connect major stable states. Notifications are generated on each transition between major states.
The VirtualMachineList textual convention encodes a set of VM indices as an OCTET STRING bitfield. Each octet covers eight consecutive vmIndex values starting from the lowest; within each octet, the most significant bit represents the lowest-numbered vmIndex. A set bit means the VM is included. This type is used exclusively in bulk notifications via vmAffectedVMs.