Disman Working Group                                    S. Chisholm
Internet Draft                                          Nortel Networks
Document: draft-ietf-disman-alarm-mib-09.txt            D. Romascanu
Category: Standards Track                               Avaya Inc
Expiration Date: March 2003                             September 2002


                               Alarm MIB


Status of this Memo

  This document is an Internet-Draft and is in full conformance
  with all provisions of Section 10 of RFC2026.

  The IETF has been notified of potential intellectual property
  rights in regard to some or all of the specification contained
  in this document.  For more information consult the online list
  of notices.

  Internet-Drafts are working documents of the Internet Engineering
  Task Force (IETF), its areas, and its working groups.  Note that
  other groups may also distribute working documents as
  Internet-Drafts.

  Internet-Drafts are draft documents valid for a maximum of six
  months and may be updated, replaced, or obsoleted by other
  documents at any time.  It is inappropriate to use Internet-
  Drafts as reference material or to cite them other than as
  "work in progress."


  The list of current Internet-Drafts can be accessed at

  http://www.ietf.org/ietf/1id-abstracts.txt

  The list of Internet-Draft Shadow Directories can be accessed at
  http://www.ietf.org/shadow.html.

  Copyright Notice

    Copyright (C) The Internet Society (2002).  All Rights Reserved.

Abstract

  This memo defines a portion of the Management Information Base (MIB)
  for use with network management protocols in the Internet community.
  In particular, it describes management objects used for modelling
  and storing alarms.

Table of Contents

 1. The SNMP Management Framework
 2. Introduction
 3. Alarm Management Framework


Chisholm & Romascanu        Standards Track                     [Page 1]


                               Alarm MIB                  September 2002


   3.1. Terminology
   3.2. Alarm Management Architecture
   3.3. Features of this Architecture
   3.4. Security
   3.5. Relationship between Alarm and Notifications
   3.6. Notification Varbind Storage and Reference
   3.7. Relation to Notification Log MIB
   3.8. Relation to Event MIB
 4. Generic Alarm MIB
   4.1. Overview
   4.2. Definitions
 5. ITU Alarm
   5.1. Overview
   5.2. IANA Considerations
   5.3. Textual Conventions
   5.4. Definitions
 6. Examples
   6.1. Alarms Based on linkUp/linkDown Notifications
   6.2. Temperature Alarm using generic Notifications
   6.3. Temperature Alarm without Notifications
   6.4. Printer MIB Alarm Example
   6.5. Rmon Alarm Example
   6.6. The Lifetime of an Alarm
 7. Security Considerations
 8. Authors' Addresses
 9. Acknowledgements
10. References
11. Full Copyright Statement


























Chisholm & Romascanu        Standards Track                     [Page 2]


                               Alarm MIB                  September 2002



1.  The SNMP Management Framework

  The SNMP Management Framework presently consists of five major
  components:

   o   An overall architecture, described in RFC 2571 [RFC2571].

   o   Mechanisms for describing and naming objects and events for the
       purpose of management.  The first version of this Structure of
       Management Information (SMI) is called SMIv1 and described in
       STD 16, RFC 1155 [RFC1155], STD 16, RFC 1212 [RFC1212] and RFC
       1215 [RFC1215].  The second version, called SMIv2, is described
       in STD 58, RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579] and
       STD 58, RFC 2580 [RFC2580].

   o   Message protocols for transferring management information.  The
       first version of the SNMP message protocol is called SNMPv1 and
       described in STD 15, RFC 1157 [RFC1157].  A second version of
       the SNMP message protocol, which is not an Internet standards
       track protocol, is called SNMPv2c and described in RFC 1901
       [RFC1901] and RFC 1906 [RFC1906].  The third version of the
       message protocol is called SNMPv3 and described in RFC 1906
       [RFC1906], RFC 2572 [RFC2572] and RFC 2574 [RFC2574].

   o   Protocol operations for accessing management information.  The
       first set of protocol operations and associated PDU formats is
       described in STD 15, RFC 1157 [RFC1157].  A second set of
       protocol operations and associated PDU formats is described in
       RFC 1905 [RFC1905].

   o   A set of fundamental applications described in RFC 2573
       [RFC2573] and the view-based access control mechanism described
       in RFC 2575 [RFC2575].

  A more detailed introduction to the current SNMP Management Framework
  can be found in RFC 2570 [RFC2570].

  Managed objects are accessed via a virtual information store, termed
  the Management Information Base or MIB.  Objects in the MIB are
  defined using the mechanisms defined in the SMI.

  This memo specifies a MIB module that is compliant to the SMIv2.  A
  MIB conforming to the SMIv1 can be produced through the appropriate
  translations.  The resulting translated MIB must be semantically
  equivalent, except where objects or events are omitted because no
  translation is possible (use of Counter64).  Some machine readable
  information in SMIv2 will be converted into textual descriptions in
  SMIv1 during the translation process.  However, this loss of machine
  readable information is not considered to change the semantics of the
  MIB.



Chisholm & Romascanu        Standards Track                     [Page 3]


                               Alarm MIB                  September 2002



2. Introduction


   In traditional SNMP management, problems are detected on an entity
   either through polling interesting MIB variables, waiting for the
   entity to send a Notification for a problem, or some combination of
   the two. This method is somewhat successful, but experience has
   shown some problems with this approach. Managers monitoring large
   number of entities cannot afford to be polling large numbers of
   objects on each device. Managers trying to ensure high-reliability
   are unable to accurately determine problems that may have occurred
   when they were not monitoring an entity. Finally, it can be time
   consuming for managers to try to understand the relationships
   between the various objects they poll, the Notifications they
   receive and the problems occurring on the entity and even after
   detailed analysis they may still be left with an incomplete picture
   of what problems are occurring. But, it is important for an operator
   to be able to determine current problems on a system, so they can be
   fixed.

   This memo describes a method of using alarm management in SNMP to
   address these problems. It also provides the necessary MIB objects
   to support these methods.


   Alarms and other terms related to alarms management are defined in
   the following sections.

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in RFC 2119.

3. Alarm Management Framework

3.1 Terminology

  Error
     A deviation of a system from normal operation.

  Fault
     Lasting error or warning condition.

  Event
     Something that happens which may be of interest to a management
     station. A fault, a change in status, crossing a threshold, or an
     external input to the system, for example.

  Notification
     Unsolicited transmissions of management information.

  Alarm


Chisholm & Romascanu        Standards Track                     [Page 4]


                               Alarm MIB                  September 2002


     Persistent indication of a fault.

  Alarm State
     A condition or stage in the existence of an alarm. As a minimum,
     alarms states are raise and clear. They could also
     include severity information such as defined by perceived severity
     in the ITU model - cleared, indeterminate, critical, major, minor
     and warning.

  Alarm Raise
     The initial detection of the fault indicated by an alarm or any
     number of alarm states later entered, except clear. A Notification
     SHOULD be sent on alarm raise.

  Alarm Clear
     The detection that the fault indicated by an alarm no longer
     exists.  A Notification SHOULD be sent on alarm clear.

  Active Alarm
     An alarm which has an alarm state that has been raised, but not
     cleared.

  Alarm Detection Point
      The entity that detected the alarm.

  Perceived Severity
     The severity of the alarm as determined by the alarm detection
     point using the information it has available.




3.2 Alarm Management Architecture





















Chisholm & Romascanu        Standards Track                     [Page 5]


                               Alarm MIB                  September 2002


            +------------------------------------------------+
            |                                                |
            |  +------------------------------------+        |
            |  | Notification Management            |        |
            |  +--------------+---------------------+        |
            |          |                                     |
            +------------------+-----------------------------+
                       |
                       V
                       |
                       |<----------------------------------------------+
                       |                                               |
    +------------------V-------------+                                 |
    |  +---------------V-----------+ |                                 |
    |  |         RFC 2573          | |                                 |
    |  | SNMP-NOTIFICATION-MIB     | |                                 |
    |  +--------+--------------+-+-+ |                                 |
    |           |              | |   |                                 |
    |           |              | +------------------+                  |
    |           |              |     |              |                  |
    |           |              |     |   +----------V--------------+   |
    |           |              |     |   | +--------V---------+    |   |
    | +---------V------------+ |     |   | | Alarm Modelling  |    |   |
    | |       RFC 3014       | |     |   | | (descriptions)   |    |   |
    | | NOTIFICATION-LOG-MIB | |     |   | +--------+---------+    |   |
    | +----------------------+ |     |   |          |              |   |
    |                          |     |   | +--------V------------+ |   |
    | +------------------------V-+   |   | | Generic: Model-     | |   |
    | |         RFC 2573         |   |   | | Active : Specific   | |   |
    | | SNMP-TARGET-MIB          |   |   | | Alarms : Extensions | |   |
    | +----------+---------------+   |   | +--------+------------+ |   |
    |            |                   |   |          |              |   |
    +------------|-------------------+   +----------|--------------+   |
                 |                                  |                  |
                 |                                  +------------------+
                 V
          Informs & Traps


3.3 Features of this Architecture

3.3.1 Modular Alarm Architecture

   The subject of alarm management can potentially cover a large number
   of topics including real-time alarms, historical alarms, alarm
   correlation, and alarm suppression, to name a few. Within each of
   these topics, there are a number of established models that could be
   supported. This memo focuses on a subset of this problem space, but
   describes a modular SNMP alarm management framework.

   The framework defines a generic Alarm MIB that can be supported on
   its own, or with additional alarm modelling information such as the


Chisholm & Romascanu        Standards Track                     [Page 6]


                               Alarm MIB                  September 2002


   provided ITU Alarm MIB. In addition, the active alarm tables could
   also be extended to support additional information about active
   alarm instances. This framework can also be expanded in the future
   to support such features as alarm correlation and alarm suppression.
   This modular architecture means that the cost of supporting alarm
   management features is proportional to the number of features an
   implementation supports.

3.3.2 Flexible Alarm Modeling

   Alarm models document an understanding between a manager and an
   agent as to what problems will be reported on a system, how these
   problems will be reported, and what might possibly happen over the
   lifetime of this problem.

   The alarm modelling method provided in this memo provides
   flexibility to support implementations with different modelling
   requirements. All alarms are modelled as a series of states that are
   related together using an alarm ID.  Alarm states can be modelled
   using traditional Notifications, generic alarm Notifications, or
   without the use of Notifications.

   Alarm states modelled using traditional Notifications would identify
   a Notification OID, and optionally an offset, value pair of one of
   the Notification varbinds to define the state.  This alarm state
   would be entered when the entity generated a Notification that
   matched this information and the alarm would be added to the active
   alarm table. This Notification would also get sent on the wire to
   any destinations, as indicated in the SNMP-TARGET-MIB [RFC2573].

   Alarm states modelled using generic Notifications, use the
   alarmActiveState or alarmClearState Notifications defined in this
   memo. These alarm states would be entered by some internal stimuli,
   the alarm would be added to the active alarm table and these generic
   Notifications would then be sent on the wire to any destinations, as
   indicated in the SNMP-TARGET-MIB [RFC2573].

   Alarm states modelled without any Notifications would be triggered
   by some internal stimuli, the alarm would be added to the active
   alarm table, but no Notifications would be sent to interested
   managers.

3.3.3 Problem Indication

   The Alarm MIB provides a means to tell what Notifications are just
   informational events or not of interest to the manager for other
   reasons by not including them in any alarm models. In addition,
   information in the alarm model, such as the Notification ID and the
   description tell exactly what error or warning condition this alarm
   is indicating. If the ITU-ALARM-MIB is also supported, additional
   information is provided via the probable cause.



Chisholm & Romascanu        Standards Track                     [Page 7]


                               Alarm MIB                  September 2002


3.3.5 Identifying Resource under Alarm

   An important goal of alarm management is to ensure that any detected
   problems get fixed, so it is necessary to know exactly where this
   problem is occurring. In addition, it is necessary to be able to
   tell when alarm instances are raised against the same component, as
   well as to be able to tell what instance of an alarm is cleared by
   an instance of an alarm clear.

   This MIB provides a generic method for identifying the resource by
   extracting and building a resource ID from the Notification
   varbinds. Solutions interested in being able to differentiate the
   source of the alarm by means other than the source IP address and
   resource ID should create separate alarm lists such that each
   context/source IP address pair is its own list.

3.3.6 Means of obtaining ITU alarm information

   Alarm Information, as defined in ITU alarm models [M.3100], is
   optionally available to implementations through the optional support
   of the ITU-ALARM-MIB.

3.3.7 Configuration of Alarm Models

   An alarm model can be added, updated or removed during runtime,
   assuming it is not being referenced by any active alarm instance.

3.3.8 Active Alarm Management

   A list of currently active alarms on a system and supporting
   statistics on the SNMP entity can be obtained.

   This allows the network management station to find out about any
   problems that may have occurred before it started managing a
   particular network element, or while it was out of contact with it.

3.3.9 Distributed Alarm Management

   All aspects of the Alarm MIB can be supported both on the device
   experiencing the alarms and on any middle managers that might be
   monitoring such devices.

3.3.10 Historical Alarm Management

   Some systems may have a requirement that information on alarms that
   are no longer active is available. This memo provides a clear table
   to support this requirement.

   This can also be achieved through the support of the Notification
   log MIB [RFC3014] to store alarm state transitions.




Chisholm & Romascanu        Standards Track                     [Page 8]


                               Alarm MIB                  September 2002


3.4 Security

   Security for alarms is awkward since access control for the objects
   in the underlying Notifications can be checked only where the
   Notification is created.  Thus such checking is possible only for
   locally generated Notifications, and even then only when security
   credentials are available.

   For the purpose of this discussion, "security credentials" means the
   input values for the abstract service interface function
   isAccessAllowed [RFC2571] and using those credentials means
   conceptually using that function to see that those credentials allow
   access to the MIB objects in question, operating as for a
   Notification Originator in [RFC2573].

   The Alarm MIB has the notion of a named alarm list.  By using alarm
   list names and view-based access control [RFC2575] a network
   administrator can provide different access for different users. When
   an application creates an alarm model (indexed in part by the alarm
   list name) the security credentials of the creator remain associated
   with that alarm model and constrain what information is allowed to
   be placed in the active alarm table, the active alarm variable
   table, the cleared alarm table, and the ITU alarm table.

   When processing locally-generated Notifications, the managed system
   MUST use the security credentials associated with each alarm model
   respectively, and MUST apply the same access control rules as
   described for a Notification Originator in [RFC2573].

   The managed system SHOULD NOT apply access control when processing
   remotely-generated Notifications using the alarm models.  In those
   cases the security of the information in the alarm tables SHOULD be
   left to the normal, overall access control for those tables.

3.5 Relationship between Alarm and Notifications

   It is important to understand the relationship between alarms and
   Notifications, as both are traditional fault management methods.
   This relationship is modelled using the alarmModelTable to define
   the alarmModelNotificationId for each alarm state.

   Not all Notifications signal an alarm state transition. Some
   Notifications are simply informational in nature, such as those that
   indicate that a configuration operation has been performed on an
   entity.  These sorts of Notifications would not be represented in
   the Alarm MIB.

   The Alarm MIB allows the use of the Notification space as defined in
   [RFC2578] in order to identify the Notifications that are related
   with the specific alarm state transitions. However there is no
   assumption that the respective Notifications MUST be sent for all or
   any of the alarm state transitions. It is also possible to model


Chisholm & Romascanu        Standards Track                     [Page 9]


                               Alarm MIB                  September 2002


   alarms using no Notifications at all. This architecture allows for
   both the efficient exploitation of the body of defined Notification
   and for the use of non-Notification based systems.

3.6 Notification Varbind Storage and Reference

   In SNMPv1, the varbinds in the Trap-PDU sent over the wire map one
   to one into those varbinds listed in the SMI of the trap in the MIB
   in which it was defined. In the case of linkDown trap, the first
   varbind can unambiguously be identified as ifIndex. With the
   introduction of the InformRequest-PDU and SNMPv2-Trap-PDU types,
   which send sysUptime and snmpTrapOID as the first two varbinds,
   while the SMI in the MIB where the Notification is defined only
   lists additional varbinds, the meaning of "first varbind" becomes
   less clear. In the case of the linkDown Notification, referring to
   the first varbind could potentially be interpreted as either the
   sysUptime or ifIndex.

   The varbind storage approach taken in the Alarm MIB is that
   sysUptime and snmpTrapOID shall always be stored in the active alarm
   variable table as entry 1 and 2 respectively, regardless of whether
   the transport was the Trap-PDU, the InformRequest-PDU or the
   SNMPv2-Trap-PDU. If the incoming Notification is an SNMPv1 Trap-PDU
   then an appropriate value for sysUpTime.0 or snmpTrapOID.0 shall be
   determined by using the rules in section 3.1 of [RFC2576].

   The varbind reference approach taken in the Alarm MIB is that, for
   variables such as the alarmModelVarbindIndex, the first two
   obligatory varbinds of the InformRequest-PDU and SNMPv2-Trap-PDU are
   ignored, and the index aligns with the Trap-PDU and the SMI. In the
   case of linkDown, the first varbind would always be ifIndex.

3.7 Relation to Notification Log MIB

   The Alarm MIB is intended to complement the Notification Log
   MIB[RFC3014], but can be used independently.  The alarmActiveTable
   is defined in manner similar to that of the nlmLogTable.  This
   format allows for the storage of any Trap or Notification that can
   be defined using SMIv1 or SMIv2.  Using the same format as the
   Notification log MIB also simplifies operations for systems choosing
   to implement both MIBs.

   The object alarmActiveLogPointer points, for each entry in the
   alarmActiveLogTable, to the log index in the Notification log MIB,
   if used.

   If the Notification log MIB is supported, it can be monitored by a
   management system as a hedge against lost alarms. The Notification
   log can also be used to support historical alarm management.





Chisholm & Romascanu        Standards Track                    [Page 10]


                               Alarm MIB                  September 2002


3.8 Relationship with the Event MIB

   During the work and discussions in the Working Group, the issue of
   the relationship between the MIB modules and the Event MIB [RFC2981]
   was raised. There is no direct relation or dependency between the
   Alarm MIB and the Event MIB. Some common terms (like 'event') are
   being used in both MIB modules, and the user is directed to the
   sections that define terminology in the two documents for
   clarification.

4. Generic Alarm MIB

4.1 Overview

   The ALARM-MIB consists of alarm models and lists of active and
   cleared alarms.

   The alarmModelTable contains information that is applicable to all
   instances of an alarm.  It can be populated at start-up with all
   alarms that could happen on a system or later configured by a
   management application.  It contains all the alarms for a given
   system.  If a Notification is not represented in the
   alarmModelTable, it is not an alarm state transition. The
   alarmModelTable provides a means of defining the raise/clear and
   other state transition relationship between alarm states.
   alarmModelIndex acts as a unique identifier for an alarm. An alarm
   model consists of defining the possible states an alarm can assume
   as well as the OID of the Notification that is sent out when an
   alarm changes state. The object alarmModelState defines the states
   of an alarm.

   The alarmActiveTable contains a list of alarms that are currently
   occurring on a system. It is intended that this table be queried
   upon device discovery and rediscovery to determine which alarms are
   currently active on the device.

   The alarmActiveVariableTable contains the Notification variable
   bindings associated with the alarms in the alarmActiveTable.

   The alarmActiveStatsTable contains current and total raised alarm
   counts as well as the time of the last alarm raise and alarm clears
   per named alarm list.

   The alarmClearTable contains recently cleared alarms. It contains up
   to alarmClearMaximum cleared alarms.

   The MIB also defines generic alarm Notifications that can be used
   when there is not an existing applicable Notification to signal the
   alarm state transition - alarmActiveState and alarmClearState.





Chisholm & Romascanu        Standards Track                    [Page 11]


                               Alarm MIB                  September 2002


4.1.1 Extensibility

   The relationship between the Alarm MIB and the other alarm model MIB
   modules is expressed by the following: The alarmModelTable has a
   corresponding table in the specific MIB. For each row in the
   specific MIB alarm model table there is one row in the
   alarmModelTable. The alarmActiveTable has a corresponding table in
   the specific MIBs. For each row in the specific MIB active alarm
   table, there is one row in the alarmActiveTable. The
   alarmModelSpecificPointer object in the alarmModelTable points to
   the specific model entry in an extended alarm model table
   corresponding to this particular alarm.  The
   alarmActiveSpecificPointer object in the alarmActiveTable points to
   the specific active alarm entry in an extended active alarm table
   corresponding to this particular alarm instance.

4.1.2 Problem Indication

   The problem that each alarm indicates is identified through the OID
   of the NotificationId of the state transition, and, optionally, the
   ITU parameters. alarmModelDescription provides a description of the
   alarm state suitable for displaying to an operator.

4.1.3 Alarm State Transition Notification

   Managers interested in receiving a Notification when an alarm
   changes state can associate a Notification with an alarm state
   change. Alarm state transitions can use existing Notifications or
   can use the generic Notifications and alarmActiveState and
   alarmClearState. If the implementation chooses not to alert the
   management station, then a value of 0.0 can be used for
   alarmModelNotificationId. Alternatively, a Notification can be
   defined in alarmModelNotificationId and no hosts specified in the
   SNMP-TARGET-MIB [RFC2573].

   Alarms are modelled by defining all possible states in the
   alarmModelTable, as well as defining alarmModelNotificationId,
   alarmModelVarbindIndex, and alarmModelVarbindValue for each of the
   possible alarm states.  Optionally, ituAlarmPerceivedSeverity models
   the states in terms of ITU perceived severity.

4.1.4 Active Alarm Resource Identifier

   Resources under alarm can be identified using the
   alarmActiveResourceId. This OBJECT IDENTIFIER  points to an
   appropriate object to identify the given resource, depending on the
   type of the resource.

   The consumer of the alarmActiveResourceId does not necessarily need
   to know the type of the resource in the resource ID, but if they
   want to know this, examining the content of the resource ID can
   derive it - 1.3.6.1.2.1.2.2.1.1.something is an interface for


Chisholm & Romascanu        Standards Track                    [Page 12]


                               Alarm MIB                  September 2002


   example. It is therefore good practice to use resource IDs that can
   be consistently used across technologies such as ifIndex,
   entPhysicalIndex or sysApplRunIndex to minimize the number of
   resource prefixes a manager interested in resource type needs to
   learn.

   Resource ID can be calculated using the alarmModelResourcePrefix,
   alarmModelVarbindSubtree and the Notification varbinds. This allows
   for both the managed element to be able to compute and populate the
   alarmActiveResourceId object and for the manager to be able to
   determine when two separate alarm instances are referring to the
   same resource.

   If alarmModelResourcePrefix has a value of 0.0, then
   alarmActiveResourceId is simply the variable identifier of the first
   Notification varbind that matches the prefix defined in
   alarmModelVarbindSubtree. Otherwise, alarmActiveResourceId is
   calculated by appending the instance information from the first
   Notification varbind that matches alarmModelVarbindSubtree to the
   prefix defined in alarmModelResourcePrefix. The instance information
   is the portion of the variable identifier following the part that
   matched alarmModelVarbindSubtree. If no match is found, then
   alarmModelResourceId is simply the value of alarmModelResourcePrefix.

   In addition to this, the variable bindings from the Notifications
   that signal the alarm state transitions are stored in the active
   alarm table. This allows for implementations familiar with the
   particular Notifications to implement other forms of resource
   identification.

   For Example:

   A) Consider an alarm modelled using the authenticationFailure
   Notification.

     authenticationFailure NOTIFICATION-TYPE
      STATUS  current
      DESCRIPTION
           "An authenticationFailure trap signifies that the SNMPv2
           entity, acting in an agent role, has received a protocol
           message that is not properly authenticated.  While all
           implementations of the SNMPv2 must be capable of generating
           this trap, the snmpEnableAuthenTraps object indicates
           whether this trap will be generated."
      ::= { snmpTraps 5 }

     To set the resource ID to be usmStats, 1.3.6.1.6.3.15.1.1,
     configure as follows:
          alarmModelVarbindSubtree = 0.0
          alarmModelResourcePrefix = usmStats (1.3.6.1.6.3.15.1.1)

   B) Consider an alarm modelled using linkDown


Chisholm & Romascanu        Standards Track                    [Page 13]


                               Alarm MIB                  September 2002



     linkDown NOTIFICATION-TYPE
             OBJECTS { ifIndex, ifAdminStatus, ifOperStatus }
             STATUS  current
             DESCRIPTION
                 ""
         ::= { snmpTraps 3 }

    To set the resource Id to be the ifIndex, configure as follows:
          alarmModelVarbindSubtree = ifIndex (1.3.6.1.2.1.2.2.1.1)
          alarmModelResourcePrefix = 0.0

    Alternatively, since ifIndex is the first varbind, the following
    would also work, but might be less meaningful to a human reader
    of the MIB table:
          alarmModelVarbindSubtree = 0.0
          alarmModelResourcePrefix = 0.0

   B) Consider an alarm modelled using the bgpBackwardTransition
   Notification.

     bgpBackwardTransition NOTIFICATION-TYPE
             OBJECTS { bgpPeerLastError,
                          bgpPeerState      }
             STATUS  current
             DESCRIPTION
                   "The BGPBackwardTransition Event is generated
                   when the BGP FSM moves from a higher numbered
                   state to a lower numbered state."
             ::= { bgpTraps 2 }

     To set the resource Id to be the bgpPeerRemoteAddr, the index to
     the bgpTable, where bgpPeerState resides, configure as follows:
          alarmModelVarbindSubtree = bgpPeerState
                                                (1.3.6.1.2.1.15.3.1.2)
          alarmModelResourcePrefix = bgpPeerRemoteAddr
                               (1.3.6.1.2.1.15.3.1.7)

4.1.5 Configurable Alarm Models

   The alarm model table can, and probably should, be initially
   populated by the system. The objects in alarmModelTable and
   ituAlarmTable have a MAX-ACCESS of read-write, which allows the
   manager to modify the alarm models to suit their requirements.

4.1.6 Active Alarm Management

   Lists of alarms currently active on an SNMP entity are stored in the
   alarmActiveTable and, optionally a model specific alarmTable, e.g.
   the ituAlarmActiveTable.




Chisholm & Romascanu        Standards Track                    [Page 14]


                               Alarm MIB                  September 2002


4.1.7 Distributed Alarm Management

   Distributed alarm management can be achieved by support of the Alarm
   MIB on both the alarm detection point and on the mid-level manager.
   This is facilitated by the ability to be able to store different
   named alarm lists.  A middle manager could therefore, create an
   alarmListName for each of the devices it manages and therefore store
   separate lists for each device. In additional, the context and IP
   addresses of the alarm detection point are stored in the
   alarmActiveTable.

4.2 Definitions

   ALARM-MIB DEFINITIONS ::= BEGIN

   IMPORTS
      MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE,
      Integer32, Unsigned32, Gauge32,
      TimeTicks, Counter32, Counter64,
      IpAddress, Opaque, mib-2            FROM SNMPv2-SMI
      DateAndTime,
      RowStatus, RowPointer,
      TEXTUAL-CONVENTION                  FROM SNMPv2-TC
      SnmpAdminString, SnmpEngineID       FROM SNMP-FRAMEWORK-MIB
      InetAddressType, InetAddress        FROM INET-ADDRESS-MIB
      MODULE-COMPLIANCE, OBJECT-GROUP,
      NOTIFICATION-GROUP                  FROM SNMPv2-CONF;

     alarmMIB MODULE-IDENTITY
         LAST-UPDATED "200208280000Z"
         ORGANIZATION "IETF Distributed Management Working Group"
         CONTACT-INFO
              "WG EMail:  disman@dorothy.bmc.com
              Subscribe: disman-request@dorothy.bmc.com

              Chair:     Randy Presuhn
                         BMC Software, Inc.
                         Office 1-3141
                         2141 North First Street
                         San Jose,  California 95131
                         USA
                         rpresuhn@bmc.com
                         +1 408 546-1006

              Editors:   Sharon Chisholm
                         Nortel Networks
                         PO Box 3511 Station C
                         Ottawa, Ont.  K1Y 4H7
                         Canada
                         schishol@nortelnetworks.com

                         Dan Romascanu


Chisholm & Romascanu        Standards Track                    [Page 15]


                               Alarm MIB                  September 2002


                         Avaya Inc.
                         Atidim Technology Park, Bldg. #3
                         Tel Aviv, 61131
                         Israel
                         Tel: +972-3-645-8414
                         Email: dromasca@avaya.com"
         DESCRIPTION
                 "The MIB module describes a generic solution
                 to model alarms and to store the current list
                 of active alarms."
         REVISION    "200208280000Z"
         DESCRIPTION
             "Initial version, published as RFC XXXX."

         ::= { mib-2 xx }

   alarmObjects OBJECT IDENTIFIER ::= { alarmMIB 1 }

   alarmNotifications OBJECT IDENTIFIER ::= { alarmMIB 0 }

   alarmModel OBJECT IDENTIFIER ::= { alarmObjects 1 }

   alarmActive  OBJECT IDENTIFIER ::= { alarmObjects 2 }

   alarmClear OBJECT IDENTIFIER ::= { alarmObjects 3 }

   -- Textual Conventions

   ResourceId ::= TEXTUAL-CONVENTION
       STATUS current
       DESCRIPTION
               "A unique identifier for this resource.

               The type of the resource can be determined by looking
               at the OID that describes the resource.

               Resources must be identified in a consistent manner.
               For example, if this resource is an interface, this
               object MUST point to an ifIndex."
       SYNTAX         OBJECT IDENTIFIER

   -- Alarm Model

   alarmModelLastChanged  OBJECT-TYPE
         SYNTAX      TimeTicks
         MAX-ACCESS  read-only
         STATUS      current
         DESCRIPTION
            "The value of sysUpTime at the time of the last
            creation, deletion or modification of an entry in
            the alarmModelTable.



Chisholm & Romascanu        Standards Track                    [Page 16]


                               Alarm MIB                  September 2002


            If the number and content of entries has been unchanged
            since the last re-initialization of the local network
            management subsystem, then the value of this object
            MUST be zero."
         ::= { alarmModel 1 }

   alarmModelTable OBJECT-TYPE
      SYNTAX      SEQUENCE OF AlarmModelEntry
      MAX-ACCESS  not-accessible
      STATUS      current
      DESCRIPTION
          "A table of information about possible alarms on the system,
           and how they have been modelled."
      ::= { alarmModel 2 }

   alarmModelEntry OBJECT-TYPE
      SYNTAX      AlarmModelEntry
      MAX-ACCESS  not-accessible
      STATUS      current
      DESCRIPTION
          "Entries appear in this table for each possible alarm state."
      INDEX       { alarmListName, alarmModelIndex, alarmModelState }
      ::= { alarmModelTable 1 }

   AlarmModelEntry ::= SEQUENCE {
      alarmModelIndex                 Unsigned32,
      alarmModelState                 Unsigned32,
      alarmModelNotificationId        OBJECT IDENTIFIER,
      alarmModelVarbindIndex          Integer32,
      alarmModelVarbindValue          Integer32,
      alarmModelDescription           SnmpAdminString,
      alarmModelSpecificPointer       RowPointer,
      alarmModelVarbindSubtree        OBJECT IDENTIFIER,
      alarmModelResourcePrefix        OBJECT IDENTIFIER,
      alarmModelRowStatus             RowStatus
      }


   alarmModelIndex OBJECT-TYPE
      SYNTAX     Unsigned32 (1..4294967295)
      MAX-ACCESS not-accessible
      STATUS     current
      DESCRIPTION
          "An integer that acts as an alarm Id
          to uniquely identify each alarm
          within the named alarm list. "
      ::= { alarmModelEntry 1 }

   alarmModelState OBJECT-TYPE
      SYNTAX  Unsigned32 (1..4294967295)
      MAX-ACCESS        not-accessible
      STATUS       current


Chisholm & Romascanu        Standards Track                    [Page 17]


                               Alarm MIB                  September 2002


      DESCRIPTION
           "A value of 1 MUST indicate a clear alarm state.
           The value of this object MUST be less than the
           alarmModelState of more severe alarm states for
           this alarm.  The value of this object MUST be more
           than the alarmModelState of less severe alarm states
           for this alarm."
       ::= { alarmModelEntry 2 }

   alarmModelNotificationId OBJECT-TYPE
      SYNTAX      OBJECT IDENTIFIER
      MAX-ACCESS  read-create
      STATUS      current
      DESCRIPTION
          "The NOTIFICATION-TYPE object identifier of this alarm
          state transition. If there is no notification associated
          with this alarm state, the value of this object MUST be
          '0.0'"
      ::= { alarmModelEntry 3 }

   alarmModelVarbindIndex  OBJECT-TYPE
      SYNTAX  Integer32
      MAX-ACCESS   read-create
      STATUS       current
      DESCRIPTION
        "The index into the varbind listing of the notification
        indicated by alarmModelNotificationId which helps
        signal that the given alarm has changed state.
        If there is no applicable varbind, the value of this
        object MUST be zero.

        Note that the value of alarmModelVarbindIndex ignores
        the existence of the first two obligatory varbinds in
        the InformRequest-PDU and SNMPv2-Trap-PDU (sysUpTime.0
        and snmpTrapOID.0).  That is, a value of 1 refers to
        the first varbind after snmpTrapOID.0.

        If the incoming notification is instead an SNMPv1 Trap-PDU,
        then a value of 1 refers to the first varbind."
       ::= { alarmModelEntry 4 }

   alarmModelVarbindValue  OBJECT-TYPE
      SYNTAX  Integer32
      MAX-ACCESS   read-create
      STATUS       current
      DESCRIPTION
        "The value that the varbind indicated by
        alarmModelVarbindIndex takes to indicate
        that the alarm has entered this state.
        "
       ::= { alarmModelEntry 5 }



Chisholm & Romascanu        Standards Track                    [Page 18]


                               Alarm MIB                  September 2002


   alarmModelDescription OBJECT-TYPE
       SYNTAX SnmpAdminString
       MAX-ACCESS read-create
       STATUS current
       DESCRIPTION
      "A brief description of this alarm and state suitable to
       display to operators."
      ::= { alarmModelEntry 6 }

   alarmModelSpecificPointer OBJECT-TYPE
      SYNTAX     RowPointer
      MAX-ACCESS read-create
      STATUS     current
      DESCRIPTION
      "If no additional, model-specific Alarm MIB is supported by the
      system the value of this object is `0.0'. When a model-specific
      Alarm MIB is supported, this object is the instance pointer to
      the model-specific alarm definition."
      ::= { alarmModelEntry 7 }

     alarmModelVarbindSubtree  OBJECT-TYPE
        SYNTAX  OBJECT IDENTIFIER
        MAX-ACCESS   read-create
        STATUS       current
        DESCRIPTION
          "The name portion of each VarBind in the notification,
           in order, is compared to the value of this object.
           If the name is equal to or a subtree of the value
           of this object, for purposes of computing the value
           of AlarmActiveResourceID the 'prefix' will be the
           matching portion, and the 'indexes' will be any
           remainder.  The examination of varbinds ends with
           the first match. If the value of this object is 0.0,
           then the first varbind, or in the case of v2, the
           first varbind after the timestamp and the trap
           OID, will always be matched.
          "
        ::= { alarmModelEntry 8 }

     alarmModelResourcePrefix  OBJECT-TYPE
        SYNTAX  OBJECT IDENTIFIER
        MAX-ACCESS   read-create
        STATUS       current
        DESCRIPTION
          "The value of AlarmActiveResourceID is computed
           by appending any indexes extracted in accordance
           with the description of alarmModelVarbindSubtree
           onto the value of this object.  If this object's
           value is 0.0, then the 'prefix' extracted is used
           instead.
          "
        ::= { alarmModelEntry 9 }


Chisholm & Romascanu        Standards Track                    [Page 19]


                               Alarm MIB                  September 2002




   alarmModelRowStatus OBJECT-TYPE
      SYNTAX     RowStatus
      MAX-ACCESS read-create
      STATUS     current
      DESCRIPTION
       "Control for creating and deleting entries.  Entries may be
       modified while active. Alarms whose alarmModelRowStatus is
       not active will not appear in either the alarmActiveTable
       or the alarmClearTable. Setting this object to notInService
       cannot be used as an alarm suppression mechanism. Entries
       that are notInService will disappear as described in RFC2579

       This row can not be modified or deleted while it is being
       referenced by a value of alarmActiveModelPointer. In these
       cases, an error of `inconsistentValue' will be returned to
       the manager."
      ::= { alarmModelEntry 10 }



   -- Active Alarm Table --

   alarmActiveLastChanged  OBJECT-TYPE
      SYNTAX      TimeTicks
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
         "The value of sysUpTime at the time of the last
          creation or deletion of an entry in the alarmActiveTable.
          If the number of entries has been unchanged since the
          last re-initialization of the local network management
          subsystem, then this object contains a zero value."
      ::= { alarmActive 1 }

   alarmActiveTable OBJECT-TYPE
      SYNTAX      SEQUENCE OF AlarmActiveEntry
      MAX-ACCESS  not-accessible
      STATUS      current
      DESCRIPTION
          "A table of Active Alarms entries."
      ::= { alarmActive 2 }

   alarmActiveEntry OBJECT-TYPE
      SYNTAX      AlarmActiveEntry
      MAX-ACCESS  not-accessible
      STATUS      current
      DESCRIPTION
          "Entries appear in this table when alarms are raised.  They
          are removed when the alarm is cleared."
      INDEX       { alarmListName, alarmActiveDateAndTime,


Chisholm & Romascanu        Standards Track                    [Page 20]


                               Alarm MIB                  September 2002


                    alarmActiveIndex }
      ::= { alarmActiveTable 1 }

   AlarmActiveEntry ::= SEQUENCE {
      alarmListName                    SnmpAdminString,
      alarmActiveDateAndTime           DateAndTime,

      alarmActiveIndex                 Unsigned32,
      alarmActiveEngineID              SnmpEngineID,
      alarmActiveEngineAddressType     InetAddressType,
      alarmActiveEngineAddress         InetAddress,
      alarmActiveContextName           SnmpAdminString,
      alarmActiveVariables             Unsigned32,
      alarmActiveNotificationID        OBJECT IDENTIFIER,
      alarmActiveResourceId            ResourceId,
      alarmActiveDescription           SnmpAdminString,
      alarmActiveLogPointer            RowPointer,
      alarmActiveModelPointer          RowPointer,
      alarmActiveSpecificPointer       RowPointer }

   alarmListName OBJECT-TYPE
      SYNTAX     SnmpAdminString (SIZE(0..32))
      MAX-ACCESS not-accessible
      STATUS     current
      DESCRIPTION
       "The name of the list of alarms.  This SHOULD be the same as
       nlmLogName if the Notification Log MIB [RFC3014] is supported.

       An implementation may allow multiple named alarm lists, up to
       some implementation-specific limit (which may be none).  A
       zero-length list name is reserved for creation and deletion
       by the managed system, and MUST be used as the default log
       name by systems that do not support named alarm lists."
      ::= { alarmActiveEntry 1 }

   alarmActiveDateAndTime OBJECT-TYPE
      SYNTAX      DateAndTime
      MAX-ACCESS  not-accessible
      STATUS      current
      DESCRIPTION
          "The local date and time when the error occurred.

          Implementations MUST include the offset from UTC,
          if available.  Implementation in environments in which
          the UTC offset is not available is NOT RECOMMENDED."
      ::= { alarmActiveEntry 2 }


   alarmActiveIndex OBJECT-TYPE
      SYNTAX     Unsigned32 (1..4294967295)
      MAX-ACCESS not-accessible
      STATUS     current
      DESCRIPTION


Chisholm & Romascanu        Standards Track                    [Page 21]


                               Alarm MIB                  September 2002


          "A strictly monotonically increasing integer which
          acts as the index of entries within the named alarm
          list.  It wraps back to 1 after it reaches its
          maximum value."
      ::= { alarmActiveEntry 3 }

   alarmActiveEngineID OBJECT-TYPE
      SYNTAX      SnmpEngineID
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "The identification of the SNMP engine at which the alarm
          originated.
          If the alarm list can contain alarms from only one
          engine or the alarm is from an SNMPv1 system, this object is
          a zero length string."
      ::= { alarmActiveEntry 4 }

   alarmActiveEngineAddressType OBJECT-TYPE
      SYNTAX      InetAddressType
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
       "This object indicates what type of address is stored in
       the alarmActiveEngineAddress object - IPv4, IPv6, DNS, etc."
      ::= { alarmActiveEntry 5 }

   alarmActiveEngineAddress OBJECT-TYPE
      SYNTAX      InetAddress
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
       "The IP Address of the SNMP engine on which the alarm is
       occurring. This is used to identify the source of an SNMPv1
       trap, since an alarmActiveEngineId cannot be extracted from the
       SNMPv1 trap PDU.

       This object MUST always be instantiated, even if the list
       can contain alarms from only one engine."
      ::= { alarmActiveEntry 6 }

   alarmActiveContextName OBJECT-TYPE
      SYNTAX      SnmpAdminString
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "The name of the SNMP MIB context from which the alarm came.
          For SNMPv1 alarms this is the community string from the Trap.
          If the alarm's source SNMP engine is known not to support
          multiple contexts, this object is a zero length string."
      ::= { alarmActiveEntry 7 }



Chisholm & Romascanu        Standards Track                    [Page 22]


                               Alarm MIB                  September 2002


   alarmActiveVariables OBJECT-TYPE
      SYNTAX      Unsigned32
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "The number of variables in alarmActiveVariableTable for this
          alarm. Also, the number of varbinds for the notification
          associated with this alarm state."
      ::= { alarmActiveEntry 8 }


   alarmActiveNotificationID OBJECT-TYPE
      SYNTAX      OBJECT IDENTIFIER
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "The NOTIFICATION-TYPE object identifier of the alarm
          state transition that is occurring."
      ::= { alarmActiveEntry 9 }

   alarmActiveResourceId    OBJECT-TYPE
      SYNTAX      ResourceId
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
         "This object identifies the resource under alarm.

         If there is no corresponding resource, then
         the value of this object MUST be 0.0."
      ::= { alarmActiveEntry 10 }

   alarmActiveDescription    OBJECT-TYPE
      SYNTAX      SnmpAdminString
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
         "This object provides a textual description of the
         active alarm.  This text is generated dynamically by the
         notification generator to provide useful information
         to the human operator.  This information SHOULD
         provide information allowing the operator to locate
         the resource for which this alarm is being generated.
         This information is not intended for consumption by
         automated tools."
      ::= { alarmActiveEntry 11 }


   alarmActiveLogPointer OBJECT-TYPE
      SYNTAX     RowPointer
      MAX-ACCESS read-only
      STATUS     current
      DESCRIPTION


Chisholm & Romascanu        Standards Track                    [Page 23]


                               Alarm MIB                  September 2002


          "A pointer to the corresponding row in a
          notification logging MIB where the state change
          notification for this active alarm is logged.
          If no log entry applies to this active alarm,
          then this object MUST have the value of 0.0"
      ::= { alarmActiveEntry 12 }

   alarmActiveModelPointer OBJECT-TYPE
      SYNTAX     RowPointer
      MAX-ACCESS read-only
      STATUS     current
      DESCRIPTION
          "A pointer to the corresponding row in the
          alarmModelTable for this active alarm. This
          points not only to the alarm model being
          instantiated, but also to the specific alarm
          state that is active."
      ::= { alarmActiveEntry 13 }

   alarmActiveSpecificPointer OBJECT-TYPE
      SYNTAX     RowPointer
      MAX-ACCESS read-only
      STATUS     current
      DESCRIPTION
      "If no additional, model-specific, Alarm MIB is supported by the
      system this object is `0.0'. When a model-specific Alarm MIB is
      supported, this object is the instance pointer to the specific
      model-specific active alarm list."
      ::= { alarmActiveEntry 14 }


   -- Active Alarm Variable Table --

   alarmActiveVariableTable OBJECT-TYPE
      SYNTAX      SEQUENCE OF AlarmActiveVariableEntry
      MAX-ACCESS  not-accessible
      STATUS      current
      DESCRIPTION
          "A table of variables to go with active alarm entries."
      ::= { alarmActive 3 }

   alarmActiveVariableEntry OBJECT-TYPE
      SYNTAX      AlarmActiveVariableEntry
      MAX-ACCESS  not-accessible
      STATUS      current
      DESCRIPTION
          "Entries appear in this table when there are variables in
          the varbind list of a corresponding alarm in
          alarmActiveTable.

          Entries appear in this table as though
          the trap/notification had been transported using a


Chisholm & Romascanu        Standards Track                    [Page 24]


                               Alarm MIB                  September 2002


          SNMPv2-Trap-PDU, as defined in [RFC1905] - i.e, the
          alarmActiveVariableIndex 1 will always be sysUpTime
          and alarmActiveVariableIndex 2 will always be
          snmpTrapOID.

          If the incoming notification is instead an SNMPv1 Trap-PDU and
          the value of alarmModelVarbindIndex is 1 or 2, an appropriate
          value for sysUpTime.0 or snmpTrapOID.0 shall be determined
          by using the rules in section 3.1 of [RFC2576]."
      INDEX   {  alarmListName, alarmActiveIndex,
                 alarmActiveVariableIndex }
      ::= { alarmActiveVariableTable 1 }

   AlarmActiveVariableEntry ::= SEQUENCE {
      alarmActiveVariableIndex                 Unsigned32,
      alarmActiveVariableID                    OBJECT IDENTIFIER,
      alarmActiveVariableValueType             INTEGER,
      alarmActiveVariableCounter32Val          Counter32,
      alarmActiveVariableUnsigned32Val         Unsigned32,
      alarmActiveVariableTimeTicksVal          TimeTicks,
      alarmActiveVariableInteger32Val          Integer32,
      alarmActiveVariableOctetStringVal        OCTET STRING,
      alarmActiveVariableIpAddressVal          IpAddress,
      alarmActiveVariableOidVal                OBJECT IDENTIFIER,
      alarmActiveVariableCounter64Val          Counter64,
      alarmActiveVariableOpaqueVal             Opaque }

   alarmActiveVariableIndex OBJECT-TYPE
      SYNTAX     Unsigned32 (1..4294967295)
      MAX-ACCESS not-accessible
      STATUS     current
      DESCRIPTION
          "A strictly monotonically increasing integer, starting at
          1 for a given alarmActiveIndex, for indexing variables
          within the active alarm list. "
      ::= { alarmActiveVariableEntry 1 }

   alarmActiveVariableID OBJECT-TYPE
      SYNTAX     OBJECT IDENTIFIER
      MAX-ACCESS read-only
      STATUS     current
      DESCRIPTION
          "The alarm variable's object identifier."
      ::= { alarmActiveVariableEntry 2 }

   alarmActiveVariableValueType OBJECT-TYPE
      SYNTAX      INTEGER {
            counter32(1),
            unsigned32(2),
            timeTicks(3),
            integer32(4),
            ipAddress(5),


Chisholm & Romascanu        Standards Track                    [Page 25]


                               Alarm MIB                  September 2002


            octetString(6),
            objectId(7),
            counter64(8),
            opaque(9)
            }
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "The type of the value.  One and only one of the value
          objects that follow is used, based on this type."
      ::= { alarmActiveVariableEntry 3 }

   alarmActiveVariableCounter32Val OBJECT-TYPE
      SYNTAX      Counter32
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "The value when alarmActiveVariableType is 'counter32'."
      ::= { alarmActiveVariableEntry 4 }

   alarmActiveVariableUnsigned32Val OBJECT-TYPE
      SYNTAX      Unsigned32
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "The value when alarmActiveVariableType is 'unsigned32'."
      ::= { alarmActiveVariableEntry 5 }

   alarmActiveVariableTimeTicksVal OBJECT-TYPE
      SYNTAX      TimeTicks
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "The value when alarmActiveVariableType is 'timeTicks'."
      ::= { alarmActiveVariableEntry 6 }

   alarmActiveVariableInteger32Val OBJECT-TYPE
      SYNTAX      Integer32
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "The value when alarmActiveVariableType is 'integer32'."
      ::= { alarmActiveVariableEntry 7 }

   alarmActiveVariableOctetStringVal OBJECT-TYPE
      SYNTAX      OCTET STRING
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "The value when alarmActiveVariableType is 'octetString'."
      ::= { alarmActiveVariableEntry 8 }



Chisholm & Romascanu        Standards Track                    [Page 26]


                               Alarm MIB                  September 2002


   alarmActiveVariableIpAddressVal OBJECT-TYPE
      SYNTAX      IpAddress
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "The value when alarmActiveVariableType is 'ipAddress'."
      ::= { alarmActiveVariableEntry 9 }

   alarmActiveVariableOidVal OBJECT-TYPE
      SYNTAX      OBJECT IDENTIFIER
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "The value when alarmActiveVariableType is 'objectId'."
      ::= { alarmActiveVariableEntry 10 }

   alarmActiveVariableCounter64Val OBJECT-TYPE
      SYNTAX      Counter64
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "The value when alarmActiveVariableType is 'counter64'."
      ::= { alarmActiveVariableEntry 11 }

   alarmActiveVariableOpaqueVal OBJECT-TYPE
      SYNTAX      Opaque
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "The value when alarmActiveVariableType is 'opaque'."
      ::= { alarmActiveVariableEntry 12 }

   -- Statistics --

   alarmActiveStatsTable  OBJECT-TYPE
         SYNTAX  SEQUENCE OF AlarmActiveStatsEntry
         MAX-ACCESS  not-accessible
         STATUS  current
         DESCRIPTION
            "This table represents the alarm statistics
            information."
     ::= { alarmActive 4 }


   alarmActiveStatsEntry OBJECT-TYPE
         SYNTAX  AlarmActiveStatsEntry
         MAX-ACCESS  not-accessible
         STATUS  current
         DESCRIPTION
            "Statistics on the current active alarms."
         INDEX   { alarmListName }



Chisholm & Romascanu        Standards Track                    [Page 27]


                               Alarm MIB                  September 2002


     ::= {  alarmActiveStatsTable 1 }



   AlarmActiveStatsEntry ::=
         SEQUENCE {
              alarmActiveStatsActiveCurrent  Gauge32,
              alarmActiveStatsActives        Counter32,
              alarmActiveStatsLastRaise      TimeTicks,
              alarmActiveStatsLastClear      TimeTicks
                   }


   alarmActiveStatsActiveCurrent OBJECT-TYPE
         SYNTAX Gauge32
         MAX-ACCESS read-only
         STATUS  current
         DESCRIPTION
            "The total number of currently active alarms on the system."

          ::= { alarmActiveStatsEntry 1 }

   alarmActiveStatsActives OBJECT-TYPE
         SYNTAX Counter32
         MAX-ACCESS read-only
         STATUS  current
         DESCRIPTION
            "The total number of active alarms since system restarted."

          ::= { alarmActiveStatsEntry 2 }

   alarmActiveStatsLastRaise  OBJECT-TYPE
      SYNTAX      TimeTicks
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
         "The value of sysUpTime at the time of the last
         alarm raise for this alarm list.
          If no alarm raises have occurred since the
          last re-initialization of the local network management
          subsystem, then this object contains a zero value."
    ::= { alarmActiveStatsEntry 3 }

   alarmActiveStatsLastClear  OBJECT-TYPE
      SYNTAX      TimeTicks
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
         "The value of sysUpTime at the time of the last
          alarm clear for this alarm list.
          If no alarm clears have occurred since the
          last re-initialization of the local network management


Chisholm & Romascanu        Standards Track                    [Page 28]


                               Alarm MIB                  September 2002


          subsystem, then this object contains a zero value."
    ::= { alarmActiveStatsEntry 4 }

   -- Alarm Clear

   alarmClearMaximum OBJECT-TYPE
    SYNTAX Integer32
    MAX-ACCESS read-write
    STATUS current
    DESCRIPTION
      "This object specifies the maximum number of cleared
      alarms to store in the alarmClearTable. When this
      number is reached, the cleared alarms with the
      earliest clear time will be removed from the table."
    ::= { alarmClear 1 }

   alarmClearTable  OBJECT-TYPE
         SYNTAX  SEQUENCE OF AlarmClearEntry
         MAX-ACCESS  not-accessible
         STATUS  current
         DESCRIPTION
            "This table contains information on
            cleared alarms."
     ::= { alarmClear 2 }


   alarmClearEntry OBJECT-TYPE
         SYNTAX  AlarmClearEntry
         MAX-ACCESS  not-accessible
         STATUS  current
         DESCRIPTION
            "Information on a cleared alarm."
         INDEX   { alarmListName, alarmClearDateAndTime,
   alarmClearIndex }

     ::= {  alarmClearTable 1 }



   AlarmClearEntry ::=
         SEQUENCE {
      alarmClearIndex                 Unsigned32,
      alarmClearDateAndTime           DateAndTime,
      alarmClearEngineID              SnmpEngineID,
      alarmClearEngineAddressType     InetAddressType,
      alarmClearEngineAddress         InetAddress,
      alarmClearContextName           SnmpAdminString,
      alarmClearNotificationID        OBJECT IDENTIFIER,
      alarmClearResourceId            ResourceId,
      alarmClearLogIndex              Unsigned32,
      alarmClearModelPointer          RowPointer
      }


Chisholm & Romascanu        Standards Track                    [Page 29]


                               Alarm MIB                  September 2002



   alarmClearIndex OBJECT-TYPE
      SYNTAX     Unsigned32 (1..4294967295)
      MAX-ACCESS not-accessible
      STATUS     current
      DESCRIPTION
          "A strictly monotonically increasing integer which acts
          as the index of entries within the named alarm list.
          It wraps back to 1 after it reaches its maximum value.

          This object has the same value as the alarmActiveIndex that
          this alarm instance had when it was active."
      ::= { alarmClearEntry 1 }

   alarmClearDateAndTime OBJECT-TYPE
      SYNTAX      DateAndTime
      MAX-ACCESS  not-accessible
      STATUS      current
      DESCRIPTION
          "The local date and time when the alarm cleared.

          Implementations MUST include the offset from UTC,
          if available.  Implementation in environments in which
          the UTC offset is not available is NOT RECOMMENDED."
      ::= { alarmClearEntry 2 }

   alarmClearEngineID OBJECT-TYPE
      SYNTAX      SnmpEngineID
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "The identification of the SNMP engine at which the alarm
          originated.
          If the alarm list can contain Notifications from only one
          engine or the trap is from an SNMPv1 system, this object is
          a zero length string."
      ::= { alarmClearEntry 3 }

   alarmClearEngineAddressType OBJECT-TYPE
      SYNTAX      InetAddressType
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
       "This object indicates what type of address is stored in
       the alarmActiveEngineAddress object - IPv4, IPv6, DNS, etc."
      ::= { alarmClearEntry 4 }

   alarmClearEngineAddress OBJECT-TYPE
      SYNTAX      InetAddress
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION


Chisholm & Romascanu        Standards Track                    [Page 30]


                               Alarm MIB                  September 2002


       "The IP Address of the SNMP engine on which the alarm was
       occurring. This is used to identify the source of an SNMPv1
       trap, since an alarmActiveEngineId cannot be extracted from the
       SNMPv1 trap PDU.

       This object MUST always be instantiated, even if the list
       can contain alarms from only one engine."
      ::= { alarmClearEntry 5 }

   alarmClearContextName OBJECT-TYPE
      SYNTAX      SnmpAdminString
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "The name of the SNMP MIB context from which the alarm came.
          For SNMPv1 traps this is the community string from the Trap.
          If the alarm's source SNMP engine is known not to support
          multiple contexts, this object is a zero length string."
      ::= { alarmClearEntry 6 }

   alarmClearNotificationID OBJECT-TYPE
      SYNTAX      OBJECT IDENTIFIER
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "The NOTIFICATION-TYPE object identifier of the alarm
          clear."
      ::= { alarmClearEntry 7 }

   alarmClearResourceId    OBJECT-TYPE
      SYNTAX      ResourceId
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
         "This object identifies the resource that was under alarm.

         If there is no corresponding resource, then
         the value of this object MUST be 0.0."
      ::= { alarmClearEntry 8 }

   alarmClearLogIndex OBJECT-TYPE
      SYNTAX     Unsigned32 (0..4294967295)
      MAX-ACCESS read-only
      STATUS     current
      DESCRIPTION
          "This number MUST be the same as the log index of the
          applicable row in the notification log MIB, if it exists.
          If no log index applies to the trap, then this object
          MUST have the value of 0."
      ::= { alarmClearEntry 9 }

   alarmClearModelPointer OBJECT-TYPE


Chisholm & Romascanu        Standards Track                    [Page 31]


                               Alarm MIB                  September 2002


      SYNTAX     RowPointer
      MAX-ACCESS read-only
      STATUS     current
      DESCRIPTION
          "A pointer to the corresponding row in the
          alarmModelTable for this cleared alarm."
      ::= { alarmClearEntry 10 }


   -- Notifications

   alarmActiveState NOTIFICATION-TYPE
    OBJECTS     { alarmActiveModelPointer,
                  alarmActiveResourceId }
    STATUS      current
    DESCRIPTION
       "An instance of the alarm indicated by
       alarmActiveModelPointer has been raised
       against the entity indicated by
       alarmActiveResourceId."
    ::= { alarmNotifications 2 }

   alarmClearState NOTIFICATION-TYPE
      OBJECTS     { alarmActiveModelPointer,
                    alarmActiveResourceId }
      STATUS      current
      DESCRIPTION
        "An instance of the alarm indicated by
        alarmActiveModelPointer has been cleared against
        the entity indicated by alarmACtiveResourceId."
      ::= { alarmNotifications 3 }

   -- Conformance

   alarmConformance OBJECT IDENTIFIER ::= { alarmMIB 2 }

   alarmCompliances OBJECT IDENTIFIER ::= { alarmConformance 1 }

   alarmCompliance MODULE-COMPLIANCE
         STATUS  current
         DESCRIPTION
             "The compliance statement for systems supporting
             the Alarm MIB."
         MODULE -- this module
             MANDATORY-GROUPS {
              alarmActiveGroup,
              alarmModelGroup
             }
      ::= { alarmCompliances 1 }

   alarmGroups OBJECT IDENTIFIER ::= { alarmConformance 2 }



Chisholm & Romascanu        Standards Track                    [Page 32]


                               Alarm MIB                  September 2002


   alarmModelGroup OBJECT-GROUP
      OBJECTS {
          alarmModelLastChanged,
          alarmModelNotificationId,
          alarmModelVarbindIndex,
          alarmModelVarbindValue,
          alarmModelDescription,
          alarmModelSpecificPointer,
          alarmModelVarbindSubtree,
          alarmModelResourcePrefix,
          alarmModelRowStatus
         }
       STATUS   current
       DESCRIPTION
                  "Alarm model group."
       ::= { alarmGroups 1}


   alarmActiveGroup OBJECT-GROUP
           OBJECTS {
              alarmActiveLastChanged,
              alarmActiveEngineID,
              alarmActiveEngineAddressType,
              alarmActiveEngineAddress,
              alarmActiveContextName,
              alarmActiveVariables,
              alarmActiveNotificationID,
              alarmActiveResourceId,
              alarmActiveDescription,
              alarmActiveLogPointer,
              alarmActiveModelPointer,
              alarmActiveSpecificPointer,
              alarmActiveVariableID,
              alarmActiveVariableValueType,
              alarmActiveVariableCounter32Val,
              alarmActiveVariableUnsigned32Val,
              alarmActiveVariableTimeTicksVal,
              alarmActiveVariableInteger32Val,
              alarmActiveVariableOctetStringVal,
              alarmActiveVariableIpAddressVal,
              alarmActiveVariableOidVal,
              alarmActiveVariableCounter64Val,
              alarmActiveVariableOpaqueVal
             }
             STATUS   current
             DESCRIPTION
                  "Active Alarm list group."
             ::= { alarmGroups 2}

       alarmActiveStatsGroup  OBJECT-GROUP
             OBJECTS  {
                      alarmActiveStatsActives,


Chisholm & Romascanu        Standards Track                    [Page 33]


                               Alarm MIB                  September 2002


                      alarmActiveStatsActiveCurrent,
                      alarmActiveStatsLastRaise,
                      alarmActiveStatsLastClear
                       }
             STATUS   current
             DESCRIPTION
                  " Active alarm summary group."
             ::= { alarmGroups 3}


   alarmClearGroup  OBJECT-GROUP
             OBJECTS  {
      alarmClearMaximum,
      alarmClearEngineID,
      alarmClearEngineAddressType,
      alarmClearEngineAddress,
      alarmClearContextName,
      alarmClearNotificationID,
      alarmClearResourceId,
      alarmClearLogIndex,
      alarmClearModelPointer
                       }
             STATUS   current
             DESCRIPTION
                  " Cleared alarm group."
             ::= { alarmGroups 4}

   alarmNotificationsGroup NOTIFICATION-GROUP
      NOTIFICATIONS { alarmActiveState, alarmClearState }
      STATUS        current
      DESCRIPTION
              "The collection of notifications that can be used to
              model alarms for faults lacking pre-existing
              notification definitions."
      ::= { alarmGroups 6 }

   END

5.  ITU Alarm

5.1 Overview

   This MIB module defines alarm information specific to the alarm
   model defined in ITU M.3100 [M.3100], X.733[X.733] and X.736[X.736].
   This MIB module follows the modular architecture defined by the
   Alarm MIB, in which the generic Alarm MIB can be augmented by other
   alarm information defined according to more specific models that
   define additional behaviour and characteristics.

   The ituAlarmTable contains information from the ITU Alarm Model
   about possible alarms in the system.



Chisholm & Romascanu        Standards Track                    [Page 34]


                               Alarm MIB                  September 2002


   The ituAlarmActiveTable contains information from the ITU Alarm
   Model about alarms that are currently occurring on the system.

   The ituAlarmActiveStatsTable provides statistics on current and
   total alarms.

5.2 IANA Considerations


   Over time, there will be a need to add new IANAItuProbableCause
   enumerated values for new probable causes. The Internet Assigned
   Number Authority (IANA) is responsible for the assignment of all
   Internet numbers, including various SNMP-related numbers, and
   specifically, new IANAItuProbableCause and IANAItuEventType values.
   Values of IANAItuProbableCause less than 1024 are reserved for
   causes that correspond to ITU probable cause. IANAItuProbableCause
   of 0 is reserved for special purposes and therefore cannot be
   assigned.

   The following shall be used as the initial values, but the latest
   values for these textual conventions should be obtained from IANA:

   IANA-ITU-ALARM-TC DEFINITIONS ::= BEGIN

   IMPORTS
      MODULE-IDENTITY, mib-2       FROM SNMPv2-SMI
      TEXTUAL-CONVENTION           FROM SNMPv2-TC;

    ianaItuAlarmNumbers MODULE-IDENTITY
        LAST-UPDATED "200208280000Z"
        ORGANIZATION "IANA"
        CONTACT-INFO
            "Postal:    Internet Assigned Numbers Authority
                        Internet Corporation for Assigned Names

          and Numbers
                        4676 Admiralty Way, Suite 330
                        Marina del Rey, CA 90292-6601
                        USA

            Tel:    +1  310-823-9358
            E-Mail: iana@iana.org"
        DESCRIPTION
            "The MIB module defines the ITU Alarm
            textual convention for objects expected to require
            regular extension."
        ::= { mib-2 xx }


   IANAItuProbableCause ::= TEXTUAL-CONVENTION
       STATUS current
       DESCRIPTION
               "ITU probable cause values for the alarms as per M.3100,


Chisholm & Romascanu        Standards Track                    [Page 35]


                               Alarm MIB                  September 2002


               X.733 and X.736. Duplicate values defined in X.733
               are appended with _X733 to ensure uniqueness. Probable
   cause
               value 0 is reserved for special purposes."
       SYNTAX         INTEGER
               {
               -- The following probable causes were defined in M.3100
                aIS  (1),
                callSetUpFailure  (2),
                degradedSignal  (3),
                farEndReceiverFailure  (4),
                framingError  (5),
                lossOfFrame (6),
                lossOfPointer  (7),
                lossOfSignal  (8),
                payloadTypeMismatch (9),
                transmissionError (10),
                remoteAlarmInterface (11),
                excessiveBER  (12),
                pathTraceMismatch  (13),
                unavailable  (14),
                signalLabelMismatch (15),
                lossOfMultiFrame (16),
                receiveFailure (17),
                transmitFailure (18),
                modulationFailure (19),
                demodulationFailure (20),
                broadcastChannelFailure (21),
                connectionEstablishmentError (22),
                invalidMessageReceived (23),
                localNodeTransmissionError (24),
                remoteNodeTransmissionError (25),
                routingFailure (26),

    --Values 27-50 are reserved for communications alarm related
    --probable causes
    -- The following are used with equipment alarm.

                backplaneFailure (51),
                dataSetProblem  (52),
                equipmentIdentifierDuplication  (53),
                externalIFDeviceProblem  (54),
                lineCardProblem (55),
                multiplexerProblem  (56),
                nEIdentifierDuplication  (57),
                powerProblem  (58),
                processorProblem  (59),
                protectionPathFailure  (60),
                receiverFailure  (61),
                replaceableUnitMissing  (62),
                replaceableUnitTypeMismatch (63),
                synchronizationSourceMismatch  (64),


Chisholm & Romascanu        Standards Track                    [Page 36]


                               Alarm MIB                  September 2002


                terminalProblem   (65),
                timingProblem   (66),
                transmitterFailure  (67),
                trunkCardProblem  (68),
                replaceableUnitProblem  (69),
                realTimeClockFailure (70),
    --An equipment alarm to be issued if the system detects that the
    --real time clock has failed
                antennaFailure (71),
                batteryChargingFailure (72),
                diskFailure (73),
                frequencyHoppingFailure (74),
                iODeviceError (75),
                lossOfSynchronisation (76),
                lossOfRedundancy (77),
                powerSupplyFailure (78),
                signalQualityEvaluationFailure (79),
                tranceiverFailure (80),
                protectionMechanismFailure (81),
                protectingResourceFailure (82),
    -- Values 83-100 are reserved for equipment alarm related probable
    -- causes
    -- The following are used with environmental alarm.
                airCompressorFailure  (101),
                airConditioningFailure  (102),
                airDryerFailure   (103),
                batteryDischarging  (104),
                batteryFailure   (105),
                commercialPowerFailure  (106),
                coolingFanFailure  (107),
                engineFailure  (108),
                fireDetectorFailure  (109),
                fuseFailure  (110),
                generatorFailure  (111),
                lowBatteryThreshold (112),
                pumpFailure  (113),
                rectifierFailure  (114),
                rectifierHighVoltage  (115),
                rectifierLowFVoltage  (116),
                ventilationsSystemFailure  (117),
                enclosureDoorOpen  (118),
                explosiveGas  (119),
                fire (120),
                flood   (121),
                highHumidity  (122),
                highTemperature  (123),
                highWind  (124),
                iceBuildUp  (125),
                intrusionDetection  (126),
                lowFuel  (127),
                lowHumidity  (128),
                lowCablePressure  (129),


Chisholm & Romascanu        Standards Track                    [Page 37]


                               Alarm MIB                  September 2002


                lowTemperatue  (130),
                lowWater  (131),
                smoke  (132),
                toxicGas  (133),
                coolingSystemFailure (134),
                externalEquipmentFailure (135),
                externalPointFailure (136),
    -- Values 137-150 are reserved for environmental alarm related
    -- probable causes
    -- The following are used with Processing error alarm.
                storageCapacityProblem (151),
                memoryMismatch  (152),
                corruptData  (153),
                outOfCPUCycles   (154),
                sfwrEnvironmentProblem  (155),
                sfwrDownloadFailure  (156),
                lossOfRealTimel (157),
    --A processing error alarm to be issued after the system has
    --reinitialised. This will indicate
    --to the management systems that the view they have of the managed
    --system may no longer
    --be valid. Usage example: The managed
    --system issues this alarm after a reinitialization with severity
    --warning to inform the
    --management system about the event. No clearing notification will
    --be sent.
                applicationSubsystemFailure (158),
                configurationOrCustomisationError (159),
                databaseInconsistency (160),
                fileError (161),
                outOfMemory (162),
                softwareError (163),
                timeoutExpired (164),
                underlayingResourceUnavailable (165),
                versionMismatch (166),
    --Values 168-200 are reserved for processing error alarm related
    -- probable causes.
                bandwidthReduced (201),
                congestion (202),
                excessiveErrorRate (203),
                excessiveResponseTime (204),
                excessiveRetransmissionRate (205),
                reducedLoggingCapability (206),
                systemResourcesOverload (207 ),
                -- The following were defined X.733

                adapterError (500),
                applicationSubsystemFailture (501),
                bandwidthReduced_X733 (502),
                callEstablishmentError (503),
                communicationsProtocolError (504),
                communicationsSubsystemFailure (505),


Chisholm & Romascanu        Standards Track                    [Page 38]


                               Alarm MIB                  September 2002


                configurationOrCustomizationError (506),
                congestion_X733 (507),
                coruptData (508),
                cpuCyclesLimitExceeded (509),
                dataSetOrModemError (510),
                degradedSignal_X733 (511),
                dteDceInterfaceError (512),
                enclosureDoorOpen_X733 (513),
                equipmentMalfunction (514),
                excessiveVibration (515),
                fileError_X733 (516),
                fireDetected (517),
                framingError_X733 (518),
                heatingVentCoolingSystemProblem (519),
                humidityUnacceptable (520),
                inputOutputDeviceError (521),
                inputDeviceError (522),
                lanError (523),
                leakDetected (524),
                localNodeTransmissionError_X733 (525),
                lossOfFrame_X733 (526),
                lossOfSignal_X733 (527),
                materialSupplyExhausted (528),
                multiplexerProblem_X733 (529),
                outOfMemory_X733 (530),
                ouputDeviceError (531),
                performanceDegraded (532),
                powerProblems (533),
                pressureUnacceptable (534),
                processorProblems (535),
                pumpFailure_X733 (536),
                queueSizeExceeded (537),
                receiveFailure_X733 (538),
                receiverFailure_X733 (539),
                remoteNodeTransmissionError_X733 (540),
                resourceAtOrNearingCapacity (541),
                responseTimeExecessive (542),
                retransmissionRateExcessive (543),
                softwareError_X733 (544),
                softwareProgramAbnormallyTerminated (545),
                softwareProgramError (546),
                storageCapacityProblem_X733 (547),
                temperatureUnacceptable (548),
                thresholdCrossed (549),
                timingProblem_X733 (550),
                toxicLeakDetected (551),
                transmitFailure_X733 (552),
                transmiterFailure (553),
                underlyingResourceUnavailable (554),
                versionMismatch_X733 (555),
                -- The following are defined in X.736
                authenticationFailure (600),


Chisholm & Romascanu        Standards Track                    [Page 39]


                               Alarm MIB                  September 2002


                breachOfConfidentiality (601),
                cableTamper (602),
                delayedInformation (603),
                denialOfService (604),
                duplicateInformation (605),
                informationMissing (606),
                informationModificationDetected (607),
                informationOutOfSequence (608),
                keyExpired (609),
                nonRepudiationFailure (610),
                outOfHoursActivity (611),
                outOfService (612),
                proceduralError (613),
                unauthorizedAccessAttempt (614),
                unexpectedInformation (615),

                other (1024)
                }

   IANAItuEventType ::= TEXTUAL-CONVENTION
       STATUS current
       DESCRIPTION
               "The ITU event Type values as per M.3100"
       SYNTAX         INTEGER
              {
              other (1),
              communicationsAlarm (2),
              qualityOfServiceAlarm (3),
              processingErrorAlarm (4),
              equipmentAlarm (5),
              environmentalAlarm (6),
              integrityViolation (7),
              operationalViolation (8),
              physicalViolation (9),
              securityServiceOrMechanismViolation (10),
              timeDomainViolation (11)
              }

   END

5.3 Textual Conventions

   ITU-ALARM-TC DEFINITIONS ::= BEGIN

   IMPORTS
      MODULE-IDENTITY, mib-2      FROM SNMPv2-SMI
      TEXTUAL-CONVENTION          FROM SNMPv2-TC;
     alarmItuTc MODULE-IDENTITY
         LAST-UPDATED "200202040000Z"
         ORGANIZATION "IETF Distributed Management Working Group"
         CONTACT-INFO
            " WG EMail:  disman@dorothy.bmc.com


Chisholm & Romascanu        Standards Track                    [Page 40]


                               Alarm MIB                  September 2002


              Subscribe: disman-request@dorothy.bmc.com

              Chair:     Randy Presuhn
                         BMC Software, Inc.
                         Office 1-3141
                         2141 North First Street
                         San Jose,  California 95131
                         USA
                         rpresuhn@bmc.com
                         +1 408 546-1006


              Editors:   Sharon Chisholm
                         Nortel Networks
                         PO Box 3511 Station C
                         Ottawa, Ont.  K1Y 4H7
                         Canada
                         schishol@nortelnetworks.com

                         Dan Romascanu
                         Avaya Inc.
                         Atidim Technology Park, Bldg. #3
                         Tel Aviv, 61131
                         Israel
                         Tel: +972-3-645-8414
                         Email: dromasca@avaya.com"
         DESCRIPTION
            "The MIB module defines the ITU Alarm
            textual convention for objects not expected to require
            regular extension."
         REVISION    "200202040000Z"
         DESCRIPTION
             "Initial version, published as RFC XXXX."
        ::= { mib-2 xx }


   ItuPerceivedSeverity ::= TEXTUAL-CONVENTION
       STATUS current
       DESCRIPTION
               "ITU perceived severity values as per M.3100
               and X.733"
       SYNTAX         INTEGER                   {
              cleared (1),
              indeterminate (2),
              critical (3),
              major (4),
              minor (5),
              warning (6)
              }

   ItuTrendIndication ::= TEXTUAL-CONVENTION
       STATUS current


Chisholm & Romascanu        Standards Track                    [Page 41]


                               Alarm MIB                  September 2002


       DESCRIPTION
               "ITU trend indication values for alarms
               as per [M.3100] and [X.733]."
       SYNTAX         INTEGER
         {
         moreSevere (1),
         noChange (2),
         lessSevere (3)
         }


   END

5.4 Definitions

   ITU-ALARM-MIB DEFINITIONS ::= BEGIN

   IMPORTS
      MODULE-IDENTITY, OBJECT-TYPE,
      Counter32, Gauge32, mib-2           FROM SNMPv2-SMI
      AutonomousType, RowPointer    FROM SNMPv2-TC
      SnmpAdminString               FROM SNMP-FRAMEWORK-MIB
      alarmListName, alarmModelIndex,
      alarmActiveDateAndTime, alarmActiveIndex
                                          FROM ALARM-MIB
      ItuPerceivedSeverity,
      ItuTrendIndication                  FROM ITU-ALARM-TC
      IANAItuProbableCause,
      IANAItuEventType                    FROM IANA-ITU-ALARM-TC
      MODULE-COMPLIANCE, OBJECT-GROUP     FROM SNMPv2-CONF;

     ituAlarmMIB MODULE-IDENTITY
         LAST-UPDATED "200209280000Z"
         ORGANIZATION "IETF Distributed Management Working Group"
         CONTACT-INFO
              "WG EMail:  disman@dorothy.bmc.com
              Subscribe: disman-request@dorothy.bmc.com

              Chair:     Randy Presuhn
                         BMC Software, Inc.
                         Office 1-3141
                         2141 North First Street
                         San Jose,  California 95131
                         USA
                         rpresuhn@bmc.com
                         +1 408 546-1006

              Editors:   Sharon Chisholm
                         Nortel Networks
                         PO Box 3511 Station C
                         Ottawa, Ont.  K1Y 4H7


Chisholm & Romascanu        Standards Track                    [Page 42]


                               Alarm MIB                  September 2002


                         Canada
                         schishol@nortelnetworks.com

                         Dan Romascanu
                         Avaya Inc.
                         Atidim Technology Park, Bldg. #3
                         Tel Aviv, 61131
                         Israel
                         Tel: +972-3-645-8414
                         Email: dromasca@avaya.com"
         DESCRIPTION
                 "The MIB module describes ITU Alarm information
                 as defined in ITU Recommendation M.3100 [M.3100],
                 X.733 [X.733] and X.736 [X.736]."

         REVISION    "200209280000Z"
         DESCRIPTION
             "Initial version, published as RFC XXXX."
         ::= { mib-2 xx }


   ituAlarmObjects OBJECT IDENTIFIER ::= { ituAlarmMIB 1 }

   ituAlarmModel OBJECT IDENTIFIER ::= { ituAlarmObjects 1 }

   ituAlarmActive  OBJECT IDENTIFIER ::= { ituAlarmObjects 2 }

   ituAlarmTable OBJECT-TYPE
      SYNTAX      SEQUENCE OF ItuAlarmEntry
      MAX-ACCESS  not-accessible
      STATUS      current
      DESCRIPTION
          "A table of ITU Alarm information for possible alarms
          on the system."
      ::= { ituAlarmModel 1 }

   ituAlarmEntry OBJECT-TYPE
      SYNTAX      ItuAlarmEntry
      MAX-ACCESS  not-accessible
      STATUS      current
      DESCRIPTION
          "Entries appear in this table for each possible alarm
           severity."
      INDEX       { alarmListName, alarmModelIndex,
                   ituAlarmPerceivedSeverity }
      ::= { ituAlarmTable 1 }

   ItuAlarmEntry ::= SEQUENCE {
      ituAlarmPerceivedSeverity     ItuPerceivedSeverity,
      ituAlarmEventType             IANAItuEventType,
      ituAlarmProbableCause         IANAItuProbableCause,
      ituAlarmAdditionalText        SnmpAdminString,


Chisholm & Romascanu        Standards Track                    [Page 43]


                               Alarm MIB                  September 2002


      ituAlarmGenericModel          RowPointer }

   ituAlarmPerceivedSeverity OBJECT-TYPE
      SYNTAX  ItuPerceivedSeverity
      MAX-ACCESS        not-accessible
      STATUS       current
      DESCRIPTION
               " ITU perceived severity values as per [M.3100] and
               [X.733]."
       ::= { ituAlarmEntry 1 }

   ituAlarmEventType OBJECT-TYPE
      SYNTAX       IANAItuEventType
      MAX-ACCESS   read-write
      STATUS       current
      DESCRIPTION
               " Represents the event type values for the alarms as per
                 [M.3100], [X.733] and [X.736]"
       ::= { ituAlarmEntry 2 }

   ituAlarmProbableCause OBJECT-TYPE
      SYNTAX      IANAItuProbableCause
      MAX-ACCESS        read-write
      STATUS       current

       DESCRIPTION
               " ITU probable cause values as per [M.3100],
               [X.733] and [X.736]."
       ::= { ituAlarmEntry 3 }


   ituAlarmAdditionalText OBJECT-TYPE
        SYNTAX  SnmpAdminString
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
               " Represents the additional text field for the alarm
               as per [M.3100] and [X.733]."
         ::= { ituAlarmEntry 4}

   ituAlarmGenericModel OBJECT-TYPE
      SYNTAX     RowPointer
      MAX-ACCESS read-write
      STATUS     current
      DESCRIPTION
      "This object points to the corresponding
      row in the alarmModelTable for this alarm severity."
      ::= { ituAlarmEntry 5 }

   -- ITU Active Alarm Table --

   ituAlarmActiveTable OBJECT-TYPE


Chisholm & Romascanu        Standards Track                    [Page 44]


                               Alarm MIB                  September 2002


      SYNTAX      SEQUENCE OF ItuAlarmActiveEntry
      MAX-ACCESS  not-accessible
      STATUS      current
      DESCRIPTION
          "A table of ITU information for active alarms entries."
      ::= { ituAlarmActive 1 }

   ituAlarmActiveEntry OBJECT-TYPE
      SYNTAX      ItuAlarmActiveEntry
      MAX-ACCESS  not-accessible
      STATUS      current
      DESCRIPTION
          "Entries appear in this table when alarms are active.  They
          are removed when the alarm is no longer occurring."
      INDEX       { alarmListName, alarmActiveDateAndTime,
                   alarmActiveIndex }
      ::= { ituAlarmActiveTable 1 }

   ItuAlarmActiveEntry ::= SEQUENCE {
       ituAlarmActiveTrendIndication       ItuTrendIndication,
       ituAlarmActiveDetector              AutonomousType,
       ituAlarmActiveServiceProvider       AutonomousType,
       ituAlarmActiveServiceUser           AutonomousType
       }

   ituAlarmActiveTrendIndication OBJECT-TYPE
      SYNTAX            ItuTrendIndication
      MAX-ACCESS        read-only
      STATUS       current
      DESCRIPTION
               " Represents the trend indication values for the alarms
               as per [M.3100] and [X.733]."
       ::= { ituAlarmActiveEntry 1 }

   ituAlarmActiveDetector OBJECT-TYPE
      SYNTAX AutonomousType
      MAX-ACCESS read-only
      STATUS current
      DESCRIPTION
        "Represents the SecurityAlarmDetector object from [X.736]."
      ::= { ituAlarmActiveEntry 2 }

   ituAlarmActiveServiceProvider OBJECT-TYPE
      SYNTAX AutonomousType
      MAX-ACCESS read-only
      STATUS current
      DESCRIPTION
        "Represents the ServiceProvider object from [X.736]."
      ::= { ituAlarmActiveEntry 3 }

   ituAlarmActiveServiceUser OBJECT-TYPE
      SYNTAX AutonomousType


Chisholm & Romascanu        Standards Track                    [Page 45]


                               Alarm MIB                  September 2002


      MAX-ACCESS read-only
      STATUS current
      DESCRIPTION
        "Represents the SericeUser object from [X.736]."
      ::= { ituAlarmActiveEntry 4 }


   -- Statistics and Counters

   ituAlarmActiveStatsTable  OBJECT-TYPE
         SYNTAX  SEQUENCE OF ItuAlarmActiveStatsEntry
         MAX-ACCESS  not-accessible
         STATUS  current
         DESCRIPTION
            "This table represents the ITU alarm statistics
            information."
     ::= { ituAlarmActive 2 }


   ituAlarmActiveStatsEntry OBJECT-TYPE
         SYNTAX  ItuAlarmActiveStatsEntry
         MAX-ACCESS  not-accessible
         STATUS  current
         DESCRIPTION
            "Statistics on the current active ITU alarms."
         INDEX   { alarmListName }

     ::= {  ituAlarmActiveStatsTable 1 }



   ItuAlarmActiveStatsEntry ::=
    SEQUENCE {
      ituAlarmActiveStatsIndeterminateCurrent Gauge32,
      ituAlarmActiveStatsCriticalCurrent      Gauge32,
      ituAlarmActiveStatsMajorCurrent         Gauge32,
      ituAlarmActiveStatsMinorCurrent         Gauge32,
      ituAlarmActiveStatsWarningCurrent       Gauge32,
      ituAlarmActiveStatsIndeterminates       Counter32,
      ituAlarmActiveStatsCriticals            Counter32,
      ituAlarmActiveStatsMajors               Counter32,
      ituAlarmActiveStatsMinors               Counter32,
      ituAlarmActiveStatsWarnings             Counter32
    }

   ituAlarmActiveStatsIndeterminateCurrent OBJECT-TYPE
      SYNTAX      Gauge32
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "A count of the current number of active alarms with a
           ituAlarmPerceivedSeverity of indeterminate."


Chisholm & Romascanu        Standards Track                    [Page 46]


                               Alarm MIB                  September 2002


      ::= { ituAlarmActiveStatsEntry 1 }

   ituAlarmActiveStatsCriticalCurrent OBJECT-TYPE
      SYNTAX      Gauge32
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "A count of the current number of active alarms with a
           ituAlarmPerceivedSeverity of critical."
      ::= { ituAlarmActiveStatsEntry 2 }

   ituAlarmActiveStatsMajorCurrent OBJECT-TYPE
      SYNTAX      Gauge32
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "A count of the current number of active alarms with a
           ituAlarmPerceivedSeverity of major."
      ::= { ituAlarmActiveStatsEntry 3 }

   ituAlarmActiveStatsMinorCurrent OBJECT-TYPE
      SYNTAX      Gauge32
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "A count of the current number of active alarms with a
           ituAlarmPerceivedSeverity of minor."
      ::= { ituAlarmActiveStatsEntry 4 }

   ituAlarmActiveStatsWarningCurrent OBJECT-TYPE
      SYNTAX      Gauge32
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "A count of the current number of active alarms with a
           ituAlarmPerceivedSeverity of warning."
      ::= { ituAlarmActiveStatsEntry 5 }

   ituAlarmActiveStatsIndeterminates OBJECT-TYPE
      SYNTAX      Counter32
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "A count of the total number of active alarms with a
           ituAlarmPerceivedSeverity of indeterminate since system
           restart."
      ::= { ituAlarmActiveStatsEntry 6 }

   ituAlarmActiveStatsCriticals OBJECT-TYPE
      SYNTAX      Counter32
      MAX-ACCESS  read-only
      STATUS      current


Chisholm & Romascanu        Standards Track                    [Page 47]


                               Alarm MIB                  September 2002


      DESCRIPTION
          "A count of the total number of active alarms with a
           ituAlarmPerceivedSeverity of critical since system restart."
      ::= { ituAlarmActiveStatsEntry 7 }

   ituAlarmActiveStatsMajors OBJECT-TYPE
      SYNTAX      Counter32
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "A count of the total number of active alarms with a
           ituAlarmPerceivedSeverity of major since system restart."
      ::= { ituAlarmActiveStatsEntry 8 }

   ituAlarmActiveStatsMinors OBJECT-TYPE
      SYNTAX      Counter32
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "A count of the total number of active alarms with a
           ituAlarmPerceivedSeverity of minor since system restart."
      ::= { ituAlarmActiveStatsEntry 9 }

   ituAlarmActiveStatsWarnings OBJECT-TYPE
      SYNTAX      Counter32
      MAX-ACCESS  read-only
      STATUS      current
      DESCRIPTION
          "A count of the total number of active alarms with a
           ituAlarmPerceivedSeverity of warning since system restart."
      ::= { ituAlarmActiveStatsEntry 10 }

   -- Conformance

   ituAlarmConformance OBJECT IDENTIFIER ::= { ituAlarmMIB 2 }
   ituAlarmCompliances  OBJECT IDENTIFIER ::= { ituAlarmConformance 1 }

   ituAlarmCompliance MODULE-COMPLIANCE
      STATUS  current
      DESCRIPTION
             "The compliance statement for systems supporting
             the ITU Alarm MIB."
      MODULE -- this module
          MANDATORY-GROUPS {
              ituAlarmGroup
              }
     ::= { ituAlarmCompliances 1 }

   ituAlarmGroups OBJECT IDENTIFIER ::= { ituAlarmConformance 2 }

   ituAlarmGroup OBJECT-GROUP
    OBJECTS {


Chisholm & Romascanu        Standards Track                    [Page 48]


                               Alarm MIB                  September 2002


                ituAlarmEventType,
                ituAlarmProbableCause,
                ituAlarmGenericModel
          }
    STATUS   current
    DESCRIPTION
                  "ITU alarm details list group."
    ::= { ituAlarmGroups 1}

   ituAlarmServiceUserGroup OBJECT-GROUP
    OBJECTS {
              ituAlarmAdditionalText,
              ituAlarmActiveTrendIndication
            }
    STATUS current
    DESCRIPTION
            "The use of these parameters is a service-user option."
    ::= { ituAlarmGroups 2 }

   ituAlarmSecurityGroup OBJECT-GROUP
     OBJECTS {
             ituAlarmActiveDetector,
             ituAlarmActiveServiceProvider,
             ituAlarmActiveServiceUser
            }
     STATUS current
     DESCRIPTION
            "Security Alarm Reporting Function as defined in [X.736]"
     ::= { ituAlarmGroups 3 }

   ituAlarmStatisticsGroup OBJECT-GROUP
     OBJECTS {
            ituAlarmActiveStatsIndeterminateCurrent,
            ituAlarmActiveStatsCriticalCurrent,
            ituAlarmActiveStatsMajorCurrent,
            ituAlarmActiveStatsMinorCurrent,
            ituAlarmActiveStatsWarningCurrent,
            ituAlarmActiveStatsIndeterminates,
            ituAlarmActiveStatsCriticals,
            ituAlarmActiveStatsMajors,
            ituAlarmActiveStatsMinors,
            ituAlarmActiveStatsWarnings
             }
     STATUS current
     DESCRIPTION
        "ITU Active Alarm Statistics."
     ::= { ituAlarmGroups 4 }

   END





Chisholm & Romascanu        Standards Track                    [Page 49]


                               Alarm MIB                  September 2002


6. Examples

6.1 Alarms Based on linkUp/linkDown Notifications


   This example demonstrates an interface-based alarm that goes into a
   state of "warning" when a linkDown Notification occurs but the
   ifAdminStatus indicates the interface was taken down
   administratively.  If IfAdminStatus is "up" when the linkDown
   Notification occurs, then there is a problem, so the state of the
   alarm is critical.  A linkUp alarm clears the alarm.

  linkDown NOTIFICATION-TYPE
          OBJECTS { ifIndex, ifAdminStatus, ifOperStatus }
          STATUS  current
          DESCRIPTION
              ""
      ::= { snmpTraps 3 }

  linkUp NOTIFICATION-TYPE
          OBJECTS { ifIndex, ifAdminStatus, ifOperStatus }
          STATUS  current
          DESCRIPTION
              ""
      ::= { snmpTraps 4 }

   alarmModelIndex                  3
   alarmModelState                  1
   alarmModelNotificationId         linkUp
   alarmModelVarbindIndex           0
   alarmModelVarbindValue           0
   alarmModelDescription            "linkUp"
   alarmModelSpecificPointer        ituAlarmEntry.3.1
   alarmModelVarbindSubtree         ifIndex (1.3.6.1.2.1.2.2.1.1)
   alarmModelResourcePrefix         0.0
   alarmModelRowStatus              active (1)
   ituAlarmEventType                communicationsAlarm (2)
   ituAlarmPerceivedSeverity        cleared (1)
   ituAlarmGenericModel             alarmModelEntry.3.1

   alarmModelIndex                  3
   alarmModelState                  2
   alarmModelNotificationId         linkDown
   alarmModelVarbindIndex           2
   alarmModelVarbindValue           down (2)
   alarmModelDescription            "linkDown administratively"
   alarmModelSpecificPointer        ituAlarmEntry.3.6
   alarmModelVarbindSubtree         ifIndex (1.3.6.1.2.1.2.2.1.1)
   alarmModelResourcePrefix         0.0
   alarmModelRowStatus              active (1)
   ituAlarmEventType                communicationsAlarm (2)
   ituAlarmPerceivedSeverity        warning (6)


Chisholm & Romascanu        Standards Track                    [Page 50]


                               Alarm MIB                  September 2002


   ituAlarmGenericModel             alarmModelEntry.3.2


   alarmModelIndex                  3
   alarmModelState                  3
   alarmModelNotificationId         linkDown
   alarmModelVarbindIndex           2
   alarmModelVarbindValue           up (1)
   alarmModelDescription            "linkDown - confirmed problem"
   alarmModelSpecificPointer        ituAlarmEntry.3.3
   alarmModelVarbindSubtree         ifIndex (1.3.6.1.2.1.2.2.1.1)
   alarmModelResourcePrefix         0.0
   alarmModelRowStatus              active (1)
   ituAlarmEventType                communicationsAlarm (2)
   ituAlarmPerceivedSeverity        critical (3)
   ituAlarmGenericModel             alarmModelEntry.3.3

   alarmActiveIndex                 1
   alarmActiveTime                  2342464573
   alarmActiveDateAndTime           DateAndTime,
   alarmActiveEngineID              SnmpEngineID,
   alarmActiveEngineAddressType     ipV4
   alarmActiveEngineAddress         10.10.10.10
   alarmActiveContextName           SnmpAdminString,
   alarmActiveVariables             3
   alarmActiveNotificationID        1.3.6.1.6.3.1.1.5.3
   alarmActiveResourceId            1.3.6.1.2.1.2.2.1.1.346
   alarmActiveLogPointer            0.0
   alarmActiveModelPointer          alarmModelEntry.3.3
   alarmActiveSpecificPointer       ituAlarmActiveEntry.1.3
   ituAlarmActiveTrendIndication    moreSevere (1)
   ituAlarmDetector                   0.0
   ituAlarmServiceProvider            0.0
   ituAlarmServiceUser                0.0

   alarmActiveVariableIndex                 1
   alarmActiveVariableID                    sysUpTime.0
   alarmActiveVariableValueType             timeTicks(3)
   alarmActiveVariableCounter32Val          0
   alarmActiveVariableUnsigned32Val         0
   alarmActiveVariableTimeTicksVal          46754
   alarmActiveVariableInteger32Val          0
   alarmActiveVariableOctetStringVal        ""
   alarmActiveVariableIpAddressVal          0
   alarmActiveVariableOidVal                0.0
   alarmActiveVariableCounter64Val          0
   alarmActiveVariableIndex                 2
   alarmActiveVariableID                    snmpTrapOID.0
   alarmActiveVariableValueType             objectId(7)
   alarmActiveVariableCounter32Val          0
   alarmActiveVariableUnsigned32Val         0
   alarmActiveVariableTimeTicksVal          0


Chisholm & Romascanu        Standards Track                    [Page 51]


                               Alarm MIB                  September 2002


   alarmActiveVariableInteger32Val          0
   alarmActiveVariableOctetStringVal        ""
   alarmActiveVariableIpAddressVal          0
   alarmActiveVariableOidVal                1.3.6.1.6.3.1.1.5.3
   alarmActiveVariableCounter64Val          0
   alarmActiveVariableIndex                 3
   alarmActiveVariableID                    ifIndex
   alarmActiveVariableValueType             integer32(4)
   alarmActiveVariableCounter32Val          0
   alarmActiveVariableUnsigned32Val         0
   alarmActiveVariableTimeTicksVal          0
   alarmActiveVariableInteger32Val          346
   alarmActiveVariableOctetStringVal        ""
   alarmActiveVariableIpAddressVal          0
   alarmActiveVariableOidVal                0.0
   alarmActiveVariableCounter64Val          0
   alarmActiveVariableIndex                 4
   alarmActiveVariableID                    ifAdminStatus
   alarmActiveVariableValueType             integer32(4)
   alarmActiveVariableCounter32Val          0
   alarmActiveVariableUnsigned32Val         0
   alarmActiveVariableTimeTicksVal          0
   alarmActiveVariableInteger32Val          up (1)
   alarmActiveVariableOctetStringVal        ""
   alarmActiveVariableIpAddressVal          0
   alarmActiveVariableOidVal                0.0
   alarmActiveVariableCounter64Val          0
   alarmActiveVariableIndex                 5
   alarmActiveVariableID                    ifOperStatus
   alarmActiveVariableValueType             integer32(4)
   alarmActiveVariableCounter32Val          0
   alarmActiveVariableUnsigned32Val         0
   alarmActiveVariableTimeTicksVal          0
   alarmActiveVariableInteger32Val          down(2)
   alarmActiveVariableOctetStringVal        ""
   alarmActiveVariableIpAddressVal          0
   alarmActiveVariableOidVal                0.0
   alarmActiveVariableCounter64Val          0
   alarmActiveVariableOpaqueVal

6.2 Temperature Alarms Using Generic Notifications

  Consider a system able to detect four different temperature
  states for a widget - normal, minor, major, critical. The
  system does not have any Notification definitions for these
  alarm states. A temperature alarm can be modelled using the
  generic alarm Notifications of alarmClearState and alarmActive.

   alarmModelIndex                  5
   alarmModelState                  1
   alarmModelNotificationId         alarmClearState
   alarmModelVarbindIndex           2


Chisholm & Romascanu        Standards Track                    [Page 52]


                               Alarm MIB                  September 2002


   alarmModelVarbindValue           cleared (1)
   alarmModelDescription            "Acme Widget Temperature Normal"
   alarmModelSpecificPointer        ituAlarmEntry.5.1
   alarmModelVarbindSubtree         alarmActiveResourceId
   alarmModelResourcePrefix         0.0
   alarmModelRowStatus              active (1)
   ituAlarmEventType                environmentalAlarm (6)
   ituPerceivedSeverity             cleared (1)
   ituAlarmGenericModel             alarmModelEntry.5.1


   alarmModelIndex                  5
   alarmModelState                  2
   alarmModelNotificationId         alarmActiveState
   alarmModelVarbindIndex           2
   alarmModelVarbindValue           minor (5)
   alarmModelDescription            "Acme Widget Temperature Minor"
   alarmModelSpecificPointer        ituAlarmEntry.5.5
   alarmModelVarbindSubtree         alarmActiveResourceId
   alarmModelResourcePrefix         0.0
   alarmModelRowStatus              active (1)
   ituAlarmEventState               environmentalAlarm (6)
   ituPerceivedSeverity             minor (5)
   ituAlarmGenericModel             alarmModelEntry.5.2


   alarmModelIndex                  5
   alarmModelState                  3
   alarmModelNotificationId         alarmActiveState
   alarmModelVarbindIndex           2
   alarmModelVarbindValue           major (4)
   alarmModelDescription            "Acme Widget Temperature Major"
   alarmModelSpecificPointer        ituAlarmEntry.5.4
   alarmModelVarbindSubtree         alarmActiveResourceId
   alarmModelResourcePrefix         0.0
   alarmModelRowStatus              active (1)
   ituAlarmEventType                environmentalAlarm (6)
   ituPerceivedSeverity             major (4)
   ituAlarmGenericModel             alarmModelEntry.5.3

   alarmModelIndex                  5
   alarmModelState                  4
   alarmModelNotificationId         alarmActiveState
   alarmModelVarbindIndex           2
   alarmModelVarbindValue           critical (3)
   alarmModelDescription            "Acme Widget Temperature Critical"
   alarmModelSpecificPointer        ituAlarmEntry.5.3
   alarmModelVarbindSubtree         alarmActiveResourceId
   alarmModelResourcePrefix         0.0
   alarmModelRowStatus              active (1)
   ituAlarmEventType                environmentalAlarm (6)
   ituPerceivedSeverity             critical (3)


Chisholm & Romascanu        Standards Track                    [Page 53]


                               Alarm MIB                  September 2002


   ituAlarmGenericModel             alarmModelEntry.5.4


6.3 Temperature Alarms Without Notifications

  Consider a system able to detect four different temperature
  states for a widget - normal, minor, major, critical. The
  system does not have any Notification definitions for these
  alarm states. A temperature alarm can be modelled without
  specifying any Notifications in the alarm model. When a
  temperature state other than normal is detected, an instance
  of this alarm would be added to the active alarm table, but
  no Notifications would be sent out.

  This could alternatively be accomplished using the models from
  example 6.2 and by not specifying any target managers in the
  SNMP-TARGET-MIB, which would allow the alarm state
  Notifications to be logged in the Notification log while
  still preventing Notifications from being transmitted
  on the wire.

   alarmModelIndex                  6
   alarmModelState                  1
   alarmModelNotificationId         0.0
   alarmModelVarbindIndex           0
   alarmModelVarbindValue           0
   alarmModelDescription            "Widget Temperature"
   alarmModelSpecificPointer        ituAlarmEntry.6.1
   alarmModelVarbindSubtree         0.0
   alarmModelResourcePrefix         0.0
   alarmModelRowStatus              active (1)
   ituAlarmEventType                environmentalAlarm (6)
   ituPerceivedSeverity             cleared (1)
   ituAlarmGenericModel             alarmModelEntry.6.1


   alarmModelIndex                  6
   alarmModelState                  2
   alarmModelNotificationId         0.0
   alarmModelVarbindIndex           0
   alarmModelVarbindValue           0
   alarmModelDescription            "Widget Temperature"
   alarmModelSpecificPointer        ituAlarmEntry.6.5
   alarmModelVarbindSubtree         0.0
   alarmModelResourcePrefix         0.0
   alarmModelRowStatus              active (1)
   ituAlarmEventState               environmentalAlarm (6)
   ituAlarmPerceivedSeverity        minor (5)
   ituAlarmGenericModel             alarmModelEntry.6.2

   alarmModelIndex                  6
   alarmModelState                  3


Chisholm & Romascanu        Standards Track                    [Page 54]


                               Alarm MIB                  September 2002


   alarmModelNotificationId         0.0
   alarmModelVarbindIndex           0
   alarmModelVarbindValue           0
   alarmModelDescription            "Widget Temperature"
   alarmModelSpecificPointer        ituAlarmEntry.6.4
   alarmModelVarbindSubtree         0.0
   alarmModelResourcePrefix         0.0
   alarmModelRowStatus              active (1)
   ituAlarmEventType                environmentalAlarm (6)
   ituPerceivedSeverity             major (4)
   ituAlarmGenericModel             alarmModelEntry.6.3


   alarmModelIndex                  6
   alarmModelState                  4
   alarmModelNotificationId         0.0
   alarmModelVarbindIndex           0
   alarmModelVarbindValue           0
   alarmModelDescription            "Widget Temperature Severe"
   alarmModelSpecificPointer        ituAlarmEntry.6.3
   alarmModelVarbindSubtree         0.0
   alarmModelResourcePrefix         0.0
   alarmModelRowStatus              active (1)
   ituAlarmEventType                environmentalAlarm (6)
   ituPerceivedSeverity             critical (3)
   ituAlarmGenericModel             alarmModelEntry.6.4



6.4 Printer MIB Alarm Example

    Consider the following Notifications defined in the
    printer MIB [RFC1759]:

    prtAlertSeverityLevel OBJECT-TYPE
     -- This value is a type 1 enumeration
     SYNTAX     INTEGER {
                  other(1),
                  critical(3),
                  warning(4)
              }
     MAX-ACCESS read-only
     STATUS     current
     DESCRIPTION
       "The level of severity of this alert table entry.  The printer
       determines the severity level assigned to each entry into the
       table."
     ::= { prtAlertEntry 2 }

    printerV2Alert NOTIFICATION-TYPE
     OBJECTS { prtAlertIndex, prtAlertSeverityLevel, prtAlertGroup,
             prtAlertGroupIndex, prtAlertLocation, prtAlertCode }


Chisholm & Romascanu        Standards Track                    [Page 55]


                               Alarm MIB                  September 2002


     STATUS  current
     DESCRIPTION
       "This trap is sent whenever a critical event is added to the
       prtAlertTable."
     ::= { printerV2AlertPrefix 1 }

   These Notifications can be used to model a printer alarm as
   follows:

   alarmModelIndex                  9
   alarmModelState                  1
   alarmModelNotificationId         alarmClearState
   alarmModelVarbindIndex           0
   alarmModelVarbindValue           0
   alarmModelDescription            "Printer Alarm"
   alarmModelSpecificPointer        0.0
   alarmModelVarbindSubtree         prtAlertGroup
   alarmModelResourcePrefix         0.0
   alarmModelRowStatus              active (1)

   alarmModelIndex                  9
   alarmModelState                  2
   alarmModelNotificationId         printerV2Alert
   alarmModelVarbindIndex           2
   alarmModelVarbindValue           warning (4)
   alarmModelDescription            "Printer Alarm"
   alarmModelSpecificPointer        0.0
   alarmModelVarbindSubtree         prtAlertGroup
   alarmModelResourcePrefix         0.0
   alarmModelRowStatus              active (1)

   alarmModelIndex                  9
   alarmModelState                  3
   alarmModelNotificationId         printerV2Alert
   alarmModelVarbindIndex           2
   alarmModelVarbindValue           other (1)
   alarmModelDescription            "Printer Alarm - unknown severity"
   alarmModelSpecificPointer        0.0
   alarmModelVarbindSubtree         prtAlertGroup
   alarmModelResourcePrefix         0.0
   alarmModelRowStatus              active (1)

   alarmModelIndex                  9
   alarmModelState                  4
   alarmModelNotificationId         printerV2Alert
   alarmModelVarbindIndex           2
   alarmModelVarbindValue           critical (3)
   alarmModelDescription            "Printer Alarm"
   alarmModelSpecificPointer        0.0
   alarmModelVarbindSubtree         prtAlertGroup
   alarmModelResourcePrefix         0.0
   alarmModelRowStatus              active (1)


Chisholm & Romascanu        Standards Track                    [Page 56]


                               Alarm MIB                  September 2002



6.5 RMON Alarm Example

  The RMON MIB [RFC2819] defines a mechanism for generating
  threshold alarms. When the thresholds are crossed,
  RisingAlarm and FallingAlarm Notifications are
  generated as appropriate. These Notifications can
  be used to model an upper threshold alarm as follows:


  alarmModelIndex                  6
  alarmModelState                  1
  alarmModelNotificationId         FallingAlarm
  alarmModelVarbindIndex           0
  alarmModelVarbindValue           0
  alarmModelDescription            "RMON Rising Clear Alarm"
  alarmModelSpecificPointer        0.0
  alarmModelVarbindSubtree         alarmIndex
  alarmModelResourcePrefix         0.0
  alarmModelRowStatus              active (1)


  alarmModelIndex                  6
  alarmModelState                  2
  alarmModelNotificationId         RisingAlarm
  alarmModelVarbindIndex           0
  alarmModelVarbindValue           0
  alarmModelDescription            "RMON Rising Alarm"
  alarmModelSpecificPointer        0.0
  alarmModelRowStatus              active (1)
  alarmModelVarbindSubtree         alarmIndex
  alarmModelResourcePrefix         0.0
  alarmModelRowStatus              active (1)


6.6 The Lifetime of an Alarm

    The following example demonstrates the relationship between
    the active alarm table, the clear alarm table and the
    Notification log MIB.

    Consider a system with alarms modelled as in example 1 and which
    also supports the informational Notification dsx3LineStatusChange.

    dsx3LineStatusChange NOTIFICATION-TYPE
        OBJECTS { dsx3LineStatus,
                  dsx3LineStatusLastChange }
        STATUS  current
        DESCRIPTION
                "A dsx3LineStatusChange trap is sent when the
                value of an instance of dsx3LineStatus changes. It
                can be utilized by an NMS to trigger polls.  When


Chisholm & Romascanu        Standards Track                    [Page 57]


                               Alarm MIB                  September 2002


                the line status change results in a lower level
                line status change (i.e. ds1), then no traps for
                the lower level are sent."
                   ::= { ds3Traps 0 1 }

       0. At system start, the active alarm table, alarm clear table and
          the Notification log are all empty.
                ___________________________     _______________________
               | alarmActiveTable          |   | nlmLogTable           |
               |---------------------------|   |-----------------------|
               | alarmActiveIndex |  alarm |   | nlmLogPointer | notif.|
               |---------------------------|   |-----------------------|
               |___________________________|   |_______________________|

                __________________________________________________
               | alarmClearTable                                  |
               |--------------------------------------------------|
               | alarmClear Index |  alarm                        |
               |--------------------------------------------------|
               |                  |                               |
               |__________________________________________________|

































Chisholm & Romascanu        Standards Track                    [Page 58]


                               Alarm MIB                  September 2002


       1. Some time later, a link goes down generating a linkDown
          Notification, which is sent out and logged in the
          Notification log. As this Notification is modelled as
          an alarm state, an entry is added to the active alarm
          table.
                __________________________________________________
               | alarmActiveTable                                 |
               |--------------------------------------------------|
               | alarmActiveIndex |  alarm                        |
               |--------------------------------------------------|
               |        1         | link down - problem confirmed |
               |__________________________________________________|

                _______________________________________________
               | nlmLogTable                                   |
               |-----------------------------------------------|
               | nlmLogPointer |  Notification                 |
               |-----------------------------------------------|
               |      1        | linkdown                      |
               |_______________________________________________|

                __________________________________________________
               | alarmClearTable                                  |
               |--------------------------------------------------|
               | alarmClear Index |  alarm                        |
               |--------------------------------------------------|
               |                  |                               |
               |__________________________________________________|


























Chisholm & Romascanu        Standards Track                    [Page 59]


                               Alarm MIB                  September 2002


       2. Some time later, the value of an instance of dsx3LineStatus
         changes. This Notification is sent out and logged. As this
         is not modelled into an alarm state, the active alarm table
         remains unchanged.
                __________________________________________________
               | alarmActiveTable                                 |
               |--------------------------------------------------|
               | alarmActiveIndex |  alarm                        |
               |--------------------------------------------------|
               |        1         | linkDown - problem confirmed  |
               |__________________________________________________|

                _____________________________________________
               | nlmLogTable                                 |
               |---------------------------------------------|
               | nlmLogPointer |  Notification               |
               |---------------------------------------------|
               |      1        | linkDown                    |
               |      2        | dsx3LineStatusChange        |
               |_____________________________________________|

                __________________________________________________
               | alarmClearTable                                  |
               |--------------------------------------------------|
               | alarmClear Index |  alarm                        |
               |--------------------------------------------------|
               |                  |                               |
               |__________________________________________________|


























Chisholm & Romascanu        Standards Track                    [Page 60]


                               Alarm MIB                  September 2002


       3. Some time later, the link goes back up. A linkUp Notification
          is sent out and logged. As this Notification models
          the clear alarm for this alarm, the alarm entry is remove
          from the active alarm table. An entry is added to the
          clear alarm table.
                __________________________________________________
               | alarmActiveTable                                 |
               |--------------------------------------------------|
               | alarmActiveIndex |  alarm                        |
               |--------------------------------------------------|
               |__________________________________________________|

                _____________________________________________
               | nlmLogTable                                 |
               |---------------------------------------------|
               | nlmLogPointer |  Notification               |
               |---------------------------------------------|
               |      1      | linkDown                      |
               |      2      | dsx3LineStatusChange          |
               |      3      | linkUp                        |
               |_____________________________________________|

                __________________________________________________
               | alarmClearTable                                  |
               |--------------------------------------------------|
               | alarmClear Index |  alarm                        |
               |--------------------------------------------------|
               |      1           | linkDown - confirmed problem  |
               |__________________________________________________|



7. Security Considerations

   There are a number of management objects defined in this MIB that
   have a MAX-ACCESS clause of read-write and/or read-create. Such
   objects may be considered sensitive or vulnerable in some network
   environments.  The support for SET operations in a non-secure
   environment without proper protection can have a negative effect on
   network operations.

   The following objects are defined with a MAX-ACCESS clause of
   read-write or read-create: alarmModelNotificationId,
   alarmModelVarbindIndex, alarmModelVarbindValue,
   alarmModelDescription, alarmModelSpecificPointer,
   alarmModelVarbindSubtree, alarmModelResourcePrefix,
   alarmModelRowStatus, ituAlarmEventType, ituAlarmProbableCause,
   ituAlarmAdditionalText, and ituAlarmGenericModel.

   SNMPv1 by itself is not a secure environment.  Even if the network
   itself is secure (for example by using IPSec), even then, there is
   no control as to who on the secure network is allowed to access and


Chisholm & Romascanu        Standards Track                    [Page 61]


                               Alarm MIB                  September 2002


   GET/SET (read/change/create/delete) the objects in this MIB.

   It is recommended that the implementers consider the security
   features as provided by the SNMPv3 framework.  Specifically, the use
   of the User-based Security Model RFC 2574 [RFC2574] and the
   View-based Access Control Model RFC 2575 [RFC2575] is recommended.

   It is then a customer/user responsibility to ensure that the SNMP
   entity giving access to an instance of this MIB, is properly
   configured to give access to the objects only to those principals
   (users) that have legitimate rights to indeed GET or SET
   (change/create/delete) them.

   For further discussion of security, see section 3.4.

8. Authors' Addresses

  Sharon Chisholm
  Nortel Networks
  PO Box 3511, Station C
  Ottawa, Ontario, K1Y 4H7
  Canada
  Email: schishol@nortelnetworks.com

  Dan Romascanu
  Avaya Inc.
  Atidim Technology Park, Bldg. #3
  Tel Aviv, 61131
  Israel
  Tel: +972-3-645-8414
  Email: dromasca@avaya.com

9. Acknowledgements

  This document is a product of the DISMAN Working Group.

10. References

10.1 Normative References

  [M.3100]    ITU Recommendation M.3100, "Generic Network Information
              Model", 1995

  [RFC1155]   Rose, M., and K. McCloghrie, "Structure and Identification
              of Management Information for TCP/IP-based Internets", STD
              16, RFC 1155, May 1990.

  [RFC1157]   Case, J., Fedor, M., Schoffstall, M., and J. Davin,
              "Simple Network Management Protocol", STD 15, RFC 1157,
              May 1990.

  [RFC1212]   Rose, M., and K. McCloghrie, "Concise MIB Definitions",


Chisholm & Romascanu        Standards Track                    [Page 62]


                               Alarm MIB                  September 2002


              STD 16, RFC 1212, March 1991.

  [RFC1215]   M. Rose, "A Convention for Defining Traps for use with the
              SNMP", RFC 1215, March 1991.

  [RFC1901]   Case, J., McCloghrie, K., Rose, M., and S. Waldbusser,
              "Introduction to Community-based SNMPv2", RFC 1901,
              January 1996.

  [RFC1905]   Case, J., McCloghrie, K., Rose, M., and S. Waldbusser,
              "Protocol Operations for Version 2 of the Simple Network
              Management Protocol (SNMPv2)", RFC 1905, January 1996.

  [RFC1906]   Case, J., McCloghrie, K., Rose, M., and S. Waldbusser,
              "Transport Mappings for Version 2 of the Simple Network
              Management Protocol (SNMPv2)", RFC 1906, January 1996.

  [RFC2119]   Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.

  [RFC2570]   Case, J., Mundy, R., Partain, D., and B. Stewart,
              "Introduction to Version 3 of the Internet-standard
              Network Management Framework", RFC 2570, April 1999.

  [RFC2571]   Harrington, D., Presuhn, R., and B. Wijnen, "An
              Architecture for Describing SNMP Management Frameworks",
              RFC 2571, April 41999.

  [RFC2572]   Case, J., Harrington D., Presuhn R., and B. Wijnen,
              "Message Processing and Dispatching for the Simple
              Network Management Protocol (SNMP)", RFC 2572, April
              1999.

  [RFC2573]   Levi, D., Meyer, P., and B. Stewart, "SNMPv3
              Applications", RFC 2573, April 1999.

  [RFC2574]   Blumenthal, U., and B. Wijnen, "User-based Security Model
              (USM) for version 3 of the Simple Network Management
              Protocol (SNMPv3)", RFC 2574, April 1999.

  [RFC2575]   Wijnen, B., Presuhn, R., and K. McCloghrie, "View-based
              Access Control Model (VACM) for the Simple Network
              Management Protocol (SNMP)", RFC 2575, April 1999.

  [RFC2578]   McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
              Rose, M., and S. Waldbusser, "Structure of Management
              Information Version 2 (SMIv2)", STD 58, RFC 2578, April
              1999.

  [RFC2579]   McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
              Rose, M., and S. Waldbusser, "Textual Conventions for
              SMIv2", STD 58, RFC 2579, April 1999.


Chisholm & Romascanu        Standards Track                    [Page 63]


                               Alarm MIB                  September 2002



  [RFC2580]   McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
              Rose, M., and S. Waldbusser, "Conformance Statements for
              SMIv2", STD 58, RFC 2580, April 1999

  [X.733]     ITU Recommendation X.733, "Information Technology - Open
              Systems Interconnection - System Management: Alarm
              Reporting Function", 1992

  [X.736]     ITU Recommendation X.736, "Information Technology - Open
              Systems Interconnection - System Management: Security
              Alarm Reporting Function", 1992

10.2 Informative References

  [RFC1759]   Smith, R., Wright, F., Hastings, T., Zilles, S.,
              Gullenskop, J., "Printer MIB", RFC 1759, March 1995

  [RFC2819]   Waldbusser, S. "Remote Network Monitoring Management
              Information Base", RFC 2819, May 2000

  [RFC2037]   McCloghrie, K., Brierman, A., "Entity MIB using SMIv2",
              RFC2037, October 1996

  [RFC2233]   McCloghrie, K., Kastenholz, F., "The Interfaces Group
              MIB using SMIv2", RFC2233, November 1997

  [RFC2788]   Freed, N., Kille, S., "Network Services Monitoring MIB",
              RFC2788, March 2000

  [RFC2981]   Kavasseri, R., Stewart, B., "Event MIB", RFC2981,
              October 2000

  [RFC3014]   Stewart, B.,  Kavasseri, R., "Notification Log MIB,
              RFC 3014, November 2000


11. Full Copyright Statement

  Copyright (C) The Internet Society (2002). All Rights Reserved.

  This document and translations of it may be copied and furnished to
  others, and derivative works that comment on or otherwise explain it
  or assist in its implementation may be prepared, copied, published
  and distributed, in whole or in part, without restriction of any kind,
  provided that the above copyright notice and this paragraph are
  included on all such copies and derivative works.  However, this
  document itself may not be modified in any way, such as by removing
  the copyright notice or references to the Internet Society or other
  Internet organizations, except as needed for the  purpose of
  developing Internet standards in which case the procedures for
  copyrights defined in the Internet Standards process must be followed,


Chisholm & Romascanu        Standards Track                    [Page 64]


                               Alarm MIB                  September 2002


  or as required to translate it into languages other than English.

  The limited permissions granted above are perpetual and will not be
  revoked by the Internet Society or its successors or assigns.

  This document and the information contained herein is provided on an
  "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
  TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT
  NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN
  WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
  MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.











































Chisholm & Romascanu        Standards Track                    [Page 65]