Internet Draft                 Event MIB                   5 August 1998


                               Event MIB

                             5 August 1998

                   draft-ietf-disman-event-mib-04.txt

                              Bob Stewart
                          Cisco Systems, Inc.
                           bstewart@cisco.com





                          Status of this Memo

This document is an Internet-Draft.  Internet-Drafts are working
documents of the Internet Engineering Task Force (IETF), its areas, and
its working groups.  Note that other groups may also distribute working
documents as Internet-Drafts.

Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time.  It is inappropriate to use Internet- Drafts as reference material
or to cite them other than as ``work in progress.''

To view the entire list of current Internet-Drafts, please check the
"1id-abstracts.txt" listing contained in the Internet-Drafts Shadow
Directories on ftp.is.co.za (Africa), ftp.nordu.net (Northern Europe),
ftp.nis.garr.it (Southern Europe), munnari.oz.au (Pacific Rim),
ftp.ietf.org (US East Coast), or ftp.isi.edu (US West Coast).

Distribution of this document is unlimited. Please send comments to the
Distributed Management Working Group, <disman@nexen.com>.


Copyright Notice

Copyright (C) The Internet Society (1998).  All Rights Reserved.











Expires 5 August 1998+6 months                                  [Page 1]


Internet Draft                 Event MIB                   5 August 1998


1.  Abstract

This memo defines an experimental portion of the Management Information
Base (MIB) for use with network management protocols in the Internet
community.  In particular, it describes managed objects used for
managing monitoring of MIB objects and taking action through events.


2.  The SNMP Management Framework

The SNMP Management Framework presently consists of five major
components:

    o   An overall architecture, described in RFC 2271 [1].

    o   Mechanisms for describing and naming objects and events for the
        purpose of management. The first version of this Structure of
        Management Information (SMI) is called SMIv1 and described in
        RFC 1155 [2], RFC 1212 [3] and RFC 1215 [4]. The second version,
        called SMIv2, is described in RFC 1902 [5], RFC 1903 [6] and RFC
        1904 [7].

    o   Message protocols for transferring management information. The
        first version of the SNMP message protocol is called SNMPv1 and
        described in RFC 1157 [8]. A second version of the SNMP message
        protocol, which is not an Internet standards track protocol, is
        called SNMPv2c and described in RFC 1901 [9] and RFC 1906 [10].
        The third version of the message protocol is called SNMPv3 and
        described in RFC 1906 [10], RFC 2272 [11] and RFC 2274 [12].

    o   Protocol operations for accessing management information. The
        first set of protocol operations and associated PDU formats is
        described in RFC 1157 [8]. A second set of protocol operations
        and associated PDU formats is described in RFC 1905 [13].

    o   A set of fundamental applications described in RFC 2273 [14] and
        the view-based access control mechanism described in RFC 2275
        [15].

Managed objects are accessed via a virtual information store, termed the
Management Information Base or MIB.  Objects in the MIB are defined
using the mechanisms defined in the SMI.

This memo specifies a MIB module that is compliant to the SMIv2. A MIB
conforming to the SMIv1 can be produced through the appropriate





Expires 5 August 1998+6 months                                  [Page 2]


Internet Draft                 Event MIB                   5 August 1998


translations. The resulting translated MIB must be semantically
equivalent, except where objects or events are omitted because no
translation is possible (use of Counter64). Some machine readable
information in SMIv2 will be converted into textual descriptions in
SMIv1 during the translation process. However, this loss of machine
readable information is not considered to change the semantics of the
MIB.











































Expires 5 August 1998+6 months                                  [Page 3]


Internet Draft                 Event MIB                   5 August 1998


3.  Overview

With network sizes well beyond the ability of people to management their
networks directly automated, distributed management is vital.  An
important aspect of such management is the ability of a system to
monitor itself or for some other system to monitor it.

The Event MIB provides the ability to monitor MIB objects on the local
system or on a remote system and take simple action when a trigger
condition is met.

All of these components must suit either a relatively powerful manager
or mid-level manager, as well as a somewhat more limited self-managing
system.


4.  Relationship to Other MIBs

The Event MIB is based on extensive experience with the RMON MIB [16]
and its alarm and event groups and is intended as a replacement for
those groups.  The Event MIB calls "triggers" what the RMON MIB called
"alarms," but the concepts are the same.  Event MIB triggers maintain
the RMON handling of thresholds and add the concept of booleans.  Event
MIB events maintain the RMON concept of sending an SNMP notification in
response to a trigger and add the concept of setting a MIB object.

The Event MIB is the successor and update to SNMPv2's Manager-to-Manager
MIB [17] which was declared Historic pending this work.

The Event MIB depends on the services of the SNMPv3 Management Target
and Notification MIBs [14].

The Event MIB is nicely complemented by the Distributed Management
Expression MIB [18], which is the expected source of boolean objects to
monitor.


5.  MIB Sections

The MIB has three sections, triggers, events, and notifications.
Triggers define the conditions that lead to events.  Events may cause
notifications.

The trigger table lists what objects are to be monitored and how and
relates each trigger to an event.  In the same section the trigger





Expires 5 August 1998+6 months                                  [Page 4]


Internet Draft                 Event MIB                   5 August 1998


object table lists trigger-related objects that can be added to
notifications either for a trigger or for an event.

The event table defines what happens when an event is triggered, sending
a notificaiton, setting a MIB object or both.

The notification section defines a set of generic notifications to go
with the events and for Event MIB error handlling, and it defines a set
of objects to put in those notifications.


6.  Operation

The Event MIB is instrumentation for a distributed management
application that monitors MIB objects.  In its simplest form this
application monitors individual, local MIB objects, just as an RMON
probe fulfills the functions implied by RMON's alarm and event
operation.  Additionally the application can monitor remote objects and
wildcarded groups of objects.

Remote monitoring uses the tag service of the Management Target MIB to
select and access remote systems as an ordinary SNMP-based management
application.  Local monitoring may be be a more intimate, local
interface which may, for example, bypass SNMP formatting but otherwise
is functionally identical to remote SNMP operation.  A self-management
only system may not implemenet remote monitoring.

Wildcards indicate that the application should use a GetNext-type
operation to find the zero or more instances implied by a truncated
object identifier, just like an ordinary SNMP-based management
application.

Error handling is by notification, which at first thought violates the
principle that notifications may be lost or become a crippling burden,
but the intent is that such error notifications be enabled only for the
diagnosis of problems indicated by error counters and if the
notifications are being lost they be directed to the log as described in
the Notification Log MIB [19].


7.  Security

Security of Event MIB entries depends on SNMPv3 access control for the
entire MIB or for subsets based on substrings of trigger and event
names.





Expires 5 August 1998+6 months                                  [Page 5]


Internet Draft                 Event MIB                   5 August 1998


Security of monitored objects for remote access depends on the
Management Target MIB.  Security for local access can depend on the
Management Target MIB or on recording appropriate security credentials
of the creator of an entry and using those to access the local objects.














































Expires 5 August 1998+6 months                                  [Page 6]


Internet Draft                 Event MIB                   5 August 1998


8.  Definitions

EVENT-MIB DEFINITIONS ::= BEGIN

IMPORTS
    MODULE-IDENTITY, OBJECT-TYPE,
    experimental, Integer32, Unsigned32
    NOTIFICATION-TYPE                   FROM SNMPv2-SMI
    TEXTUAL-CONVENTION, RowStatus,
    TimeStamp, DisplayString            FROM SNMPv2-TC
    MODULE-COMPLIANCE, OBJECT-GROUP     FROM SNMPv2-CONF
    SnmpTagValue                        FROM SNMP-TARGET-MIB
    SnmpAdminString                     FROM SNMP-FRAMEWORK-MIB;

eventMIB MODULE-IDENTITY
    LAST-UPDATED "9808051700Z"
    ORGANIZATION "IETF Distributed Management Working Group"
    CONTACT-INFO "Bob Stewart
                  Cisco Systems, Inc.
                  170 West Tasman Drive,
                  San Jose CA 95134-1706.
                  Phone: +1 408 526 4527
                  Email: bstewart@cisco.com"
    DESCRIPTION
        "The MIB module for defining event triggers and actions
        for network management purposes."
    ::= { experimental xx }

eventMIBObjects OBJECT IDENTIFIER ::= { eventMIB 1 }

mteTrigger              OBJECT IDENTIFIER ::= { eventMIBObjects 1 }
mteEvent                OBJECT IDENTIFIER ::= { eventMIBObjects 2 }

--
-- Textual Conventions
--

FailureReason ::= TEXTUAL-CONVENTION
    STATUS      current
    DESCRIPTION
        "Reasons for failures in an attempt to send a management message.

        The first group of errors, numbered less than 100, are copied
        directly from SNMP protocol operations and are intended to carry
        exactly the meanings defined for the protocol as returned in





Expires 5 August 1998+6 months                                  [Page 7]


Internet Draft                 Event MIB                   5 August 1998


        an SNMP response.  Those numbered 100 or greater are related
        to problems in sending the request."
    SYNTAX      INTEGER { tooBig(1),
                          noSuchName(2),
                          badValue(3),
                          readOnly(4),
                          genErr(5),
                          noAccess(6),
                          wrongType(7),
                          wrongLength(8),
                          wrongEncoding(9),
                          wrongValue(10),
                          noCreation(11),
                          inconsistentValue(12),
                          resourceUnavailable(13),
                          commitFailed(14),
                          undoFailed(15),
                          authorizationError(16),
                          notWritable(17),
                          inconsistentName(18),

                          localResourceLack(101),
                          badDestination(102),
                          noAck(103) }


--
-- Trigger Section
--

-- Counters

mteTriggerFailures OBJECT-TYPE
    SYNTAX      Counter32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "The number of times an attempt to check for a trigger
        condition has failed.  This counts individually for each
        attempt in a group of targets or each attempt for a
        wildcarded object."
    ::= { mteTrigger 1 }


--





Expires 5 August 1998+6 months                                  [Page 8]


Internet Draft                 Event MIB                   5 August 1998


-- Trigger Table
--

mteTriggerTable OBJECT-TYPE
    SYNTAX      SEQUENCE OF MteTriggerEntry
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "A table of management event trigger information."
    ::= { mteTrigger 2 }

mteTriggerEntry OBJECT-TYPE
    SYNTAX      MteTriggerEntry
    MAX-ACCESS  not-accessible
    STATUS      current
        "Information about a single trigger.  Applications create and
        delete entries using mteTriggerStatus."
    INDEX       { IMPLIED mteTriggerName }
    ::= { mteTriggerteble 1 }

MteTriggerEntry ::= SEQUENCE {
    mteTriggerName                      SnmpAdminString,
    mteTriggerComment                   DisplayString,
    mteTriggerTest                      INTEGER,
    mteTriggerValueID                   Integer32,
    mteTriggerValueIDWildcard           TruthValue,
    mteTriggerTargetTag                 SnmpTagValue,
    mteTriggerContextName               SnmpAdminString,
    mteTriggerContextNameWildcard       TruthValue,
    mteTriggerFrequency                 Integer32,
    mteTriggerBooleanStartup            INTEGER,
    mteTriggerThresholdStartup          INTEGER,
    mteTriggerRisingThreshold           Integer32,
    mteTriggerFallingThreshold          Integer32,
    mteTriggerEvent                     SnmpAdminString,
    mteTriggerRisingEvent               SnmpAdminString,
    mteTriggerFallingEvent              SnmpAdminString,
    mteTriggerObjects                   SnmpAdminString,
    mteTriggerStatus                    RowStatus
}

mteTriggerName OBJECT-TYPE
    SYNTAX      SnmpAdminString (SIZE (1..64))
    MAX-ACCESS  not-accessible
    STATUS      current





Expires 5 August 1998+6 months                                  [Page 9]


Internet Draft                 Event MIB                   5 August 1998


    DESCRIPTION
        "A locally-unique, administratively assigned name for the trigger."
    ::= { mteTriggerEntry 1 }

mteTriggerComment OBJECT-TYPE
    SYNTAX      DisplayString
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "A description of the trigger's function and use."
    DEFVAL { ''H }
    ::= { mteTriggerEntry 2 }

mteTriggerTest OBJECT-TYPE
    SYNTAX      INTEGER { boolean(1), threshold(2) }
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The type of trigger test to perform.  For all tests,
        mteTriggerValue must evaluate to an integer.

        For 'boolean', a value of 0 is false. A non-zero value
        is true and fires the trigger.  The trigger will not fire
        again until the value has become false and come back to
        true.

        For 'threshold' it works as described below for
        mteTriggerThresholdStartup, mteTriggerRisingThreshold, and
        mteTriggerFallingThreshold."
    DEFVAL { boolean }
    ::= { mteTriggerEntry 3 }

mteTriggerValueID OBJECT-TYPE
    SYNTAX      OBJECT IDENTIFIER
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The object identifier of the MIB object to check to see
        if the trigger should fire.

        This may be wildcarded by truncating all or part of the
        instance portion, in which case the condition is obtained
        as if with a GetNext function, checking multiple values
        if they exist.  If such wildcarding is applied,
        mteTriggerIDWildcard must be 'true' and if not it must





Expires 5 August 1998+6 months                                 [Page 10]


Internet Draft                 Event MIB                   5 August 1998


        be 'false'."
    DEFVAL { 0 0 }
    ::= { mteTriggerEntry 4 }

mteTriggerValueIDWildcard OBJECT-TYPE
    SYNTAX      TruthValue
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "Control for whether mteTriggerValueID is to be treated as
        fully-specified or wildcarded, with 'true' indicating wildcard.
    DEFVAL { false }
    ::= { mteTriggerEntry 5 }

mteTriggerTargetTag OBJECT-TYPE
    SYNTAX      SnmpTagValue
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The tag for the target(s) from which to obtain the condition
        for a trigger check.

        Systems limited to self management may not accept a non-zero
        length for the value of this object.

        A length of 0 indicates the local system.  In this case,
        access to the objects indicated by mteTriggerValueID is under
        the security credentials of the requester that set
        mteTriggerStatus to 'active'."
    DEFVAL { ''H }
    ::= { mteTriggerEntry 6 }

mteTriggerContextName OBJECT-TYPE
    SYNTAX      SnmpAdminString
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The management context from which to obtain mteTriggerValueID.

        This may be wildcarded by leaving characters off the end.  To
        indicate such wildcarding mteTriggerContextNameWildcard must
        be 'true'."
    DEFVAL { ''H }
    ::= { mteTriggerEntry 7 }






Expires 5 August 1998+6 months                                 [Page 11]


Internet Draft                 Event MIB                   5 August 1998


mteTriggerContextNameWildcard OBJECT-TYPE
    SYNTAX      TruthValue
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "Control for whether mteTriggerContextName is to be treated as
        fully-specified or wildcarded, with 'true' indicating wildcard.
    DEFVAL { false }
    ::= { mteTriggerEntry 8 }

mteTriggerFrequency OBJECT-TYPE
    SYNTAX      Integer32 (0..65535)
    UNITS       "seconds"
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The number of seconds to wait between trigger condition
        checks.  To encourage consistency in sampling, the
        interval is measured from the beginning of one check to
        the beginning of the next and the timer is restarted immediately
        when it expires, not when the check completes.

        If the next check begins before the previous one completed the
        system may either attempt to make the check or treat this as an
        error condition.

        A frequency of 0 indicates instantaneous recognition of the
        condition.  This is not possible in many cases, but such may
        be supported in cases where it makes sense and the system is
        able to do so."
    DEFVAL { 600 }
    ::= { mteTriggerEntry 9 }

mteTriggerBooleanStartup OBJECT-TYPE
    SYNTAX      TruthValue
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "Control for whether an event may be triggered when this entry
        is first set to 'active'.  If the value mteTriggerBooleanStartup
        is 'true' and the first sample after this entry becomes active is
        true then one mteTriggerEvent is triggered.

        If mteTriggerType is not 'boolean', this object is not
        instantiated."





Expires 5 August 1998+6 months                                 [Page 12]


Internet Draft                 Event MIB                   5 August 1998


    DEFVAL { true }
    ::= { mteTriggerEntry 10 }

mteTriggerThresholdStartup OBJECT-TYPE
    SYNTAX      INTEGER { rising(1), falling(2), risingOrFalling(3) }
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The event that may be triggered when this entry is first
        set to 'active'.  If the first sample after this entry
        becomes active is greater than or equal to
        mteTriggerRisingThreshold and mteTriggerThresholdStartup is
        equal to 'rising' or 'risingOrFalling', then one
        mteTriggerRisingEvent is triggered.  If the first
        sample after this entry becomes active is less than
        or equal to mteTriggerFallingThreshold and
        mteTriggerThresholdStartup is equal to 'falling' or
        'risingOrFalling', then one mteTriggerRisingEvent is triggered.

        If mteTriggerType is not 'threshold', this object is not
        instantiated."
    DEFVAL { risingOrFalling }
    ::= { mteTriggerEntry 11 }

mteTriggerRisingThreshold OBJECT-TYPE
    SYNTAX      Integer32
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "A threshold value to check against if mteTriggerType is
        'threshold'.

        When the current sampled value is greater than or equal to
        this threshold, and the value at the last sampling
        interval was less than this threshold, one mteTriggerRisingEvent
        is triggered.  That event is also triggered if the first sample
        afer this entry bcomes active is greater than or equal to this
        threshold and mteTriggerThresholdStartup is equal to 'rising'
        or 'risingOrFalling'.

        After a rising event is generated, another such event is not
        triggered until the sampled value falls below this threshold and
        reaches mteTriggerFallingThreshold.

        If mteTriggerType is not 'threshold', this object is not





Expires 5 August 1998+6 months                                 [Page 13]


Internet Draft                 Event MIB                   5 August 1998


        instantiated."
    DEFVAL { 0 }
    ::= { mteTriggerEntry 12 }

mteTriggerFallingThreshold OBJECT-TYPE
    SYNTAX      Integer32
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "A threshold value to check against if mteTriggerType is
        'threshold'.

        When the current sampled value is less than or equal to
        this threshold, and the value at the last sampling interval
        was greater than this threshold, one mteTriggerFallingEvent
        is triggered.  That event is also triggered if the first sample
        afer this entry bcomes active is less than or equal to this
        threshold and mteTriggerThresholdStartup is equal to 'falling'
        or 'risingOrFalling'.

        After a falling event is generated, another such event is not
        triggered until the sampled value rises above this threshold and
        reaches mteTriggerRisingThreshold.

        If mteTriggerType is not 'threshold', this object is not
        instantiated."
    DEFVAL { 0 }
    ::= { mteTriggerEntry 13 }

mteTriggerEvent OBJECT-TYPE
    SYNTAX      SnmpAdminString (SIZE (0..64))
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The event to invoke when mteTriggerType is 'boolean' and
        this trigger fires.  A length of 0 indicates no event.

        If mteTriggerType is not 'boolean', this object is not
        instantiated."
    DEFVAL { ''H }
    ::= { mteTriggerEntry 14 }

mteTriggerRisingEvent OBJECT-TYPE
    SYNTAX      SnmpAdminString (SIZE (0..64))
    MAX-ACCESS  read-create





Expires 5 August 1998+6 months                                 [Page 14]


Internet Draft                 Event MIB                   5 August 1998


    STATUS      current
    DESCRIPTION
        "The event to invoke when mteTriggerType is 'threshold' and
        this trigger fires based on mteTriggerRisingThreshold.  A
        value of 0 indicates no event.

        If mteTriggerType is not 'threshold', this object is not
        instantiated."
    DEFVAL { ''H }
    ::= { mteTriggerEntry 15 }

mteTriggerFallingEvent OBJECT-TYPE
    SYNTAX      SnmpAdminString (SIZE (0..64))
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The event to invoke when mteTriggerType is 'threshold' and
        this trigger fires based on mteTriggerFallingThreshold.  A
        value of 0 indicates no event.

        If mteTriggerType is not 'threshold', this object is not
        instantiated."
    DEFVAL { ''H }
    ::= { mteTriggerEntry 16 }

mteTriggerObjects OBJECT-TYPE
    SYNTAX      SnmpAdminString (SIZE (0..64))
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The mteTriggerObjectNName of a group of objects from
        mteTriggerObjectTable.  These objects are to be added to any
        Notification resulting from the firing of this trigger.

        A length of 0 indicates no additional objects."
    DEFVAL { ''H }
    ::= { mteTriggerEntry 17 }

mteTriggerStatus OBJECT-TYPE
    SYNTAX      RowStatus
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The control that allows creation and deletion of entries.
        Once made active an entry may not be modified except to





Expires 5 August 1998+6 months                                 [Page 15]


Internet Draft                 Event MIB                   5 August 1998


        delete it."
    DEFVAL { createAndWait }
    ::= { mteTriggerEntry 18 }


--
-- Trigger Object Table
--

mteTriggerObjectTable OBJECT-TYPE
    SYNTAX      SEQUENCE OF mteTriggerObjectEntry
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "A table of objects related to a trigger and to be added to
        Notifications resulting from that trigger."
    ::= { mteTrigger 3 }

mteTriggerObjectEntry OBJECT-TYPE
    SYNTAX      mteTriggerObjectEntry
    MAX-ACCESS  not-accessible
    STATUS      current
        "Objects for a single trigger.  Applications create and
        delete entries using mteTriggerObjectStatus."
    INDEX       { mteTriggerObjectName, mteTriggerObjectIndex }
    ::= { mteTriggerObjectteble 1 }

mteTriggerObjectEntry ::= SEQUENCE {
    mteTriggerObjectName                SnmpAdminString,
    mteTriggerObjectIndex               Unsigned32,
    mteTriggerObjectID                  Integer32,
    mteTriggerObjectIDWildcard          TruthValue,
    mteTriggerObjectStatus              RowStatus
    }

mteTriggerObjectName OBJECT-TYPE
    SYNTAX      SnmpAdminString (SIZE (1..64))
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "A locally-unique, administratively assigned name for a group
        of objects to associate with a trigger."
    ::= { mteTriggerObjectEntry 1 }

mteTriggerObjectIndex OBJECT-TYPE





Expires 5 August 1998+6 months                                 [Page 16]


Internet Draft                 Event MIB                   5 August 1998


    SYNTAX      Unsigned32 (1..4294967295)
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "An arbitrary small integer for the purpose of identifying
        individual objects with a mteTriggerObjectName group."
    ::= { mteTriggerObjectEntry 2 }

mteTriggerObjectID OBJECT-TYPE
    SYNTAX      OBJECT IDENTIFIER
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The object identifier of a MIB object to add to a Notification
        that results from the firing of a trigger.

        This may be wildcarded by truncating all or part of the
        instance portion, in which case the instance portion of the
        OID for obtaining this object will be the same as that used
        in obtaining the mteTriggerObjectValueID that fired.
        If such wildcarding is applied, mteTriggerObjectIDWildcard
        must be 'true' and if not it must be 'false'."
    DEFVAL { 0 0 }
    ::= { mteTriggerObjectEntry 3 }

mteTriggerObjectValueIDWildcard OBJECT-TYPE
    SYNTAX      TruthValue
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "Control for whether mteTriggerObjectValueID is to be treated as
        fully-specified or wildcarded, with 'true' indicating wildcard.
    DEFVAL { false }
    ::= { mteTriggerObjectEntry 4 }

mteTriggerObjectStatus OBJECT-TYPE
    SYNTAX      RowStatus
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The control that allows creation and deletion of entries.
        Once made active an entry may not be modified except to
        delete it."
    DEFVAL { createAndWait }
    ::= { mteTriggerObjectEntry 5 }





Expires 5 August 1998+6 months                                 [Page 17]


Internet Draft                 Event MIB                   5 August 1998


--
-- Event Section
--

-- Counters

mteEventFailures OBJECT-TYPE
    SYNTAX      Counter32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "The number of times an attempt to invoke an event
        has failed.  This counts individually for each
        attempt in a group of targets or each attempt for a
        wildcarded trigger object."
    ::= { mteEvent 1 }


--
-- Event Table
--

mteEventTable OBJECT-TYPE
    SYNTAX      SEQUENCE OF MteEventEntry
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "A table of management event action information."
    ::= { mteEvent 2 }

mteEventEntry OBJECT-TYPE
    SYNTAX      MteEventEntry
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "Information about a single event.  Applications create and
        delete entries using mteEventStatus."
    INDEX       { IMPLIED mteEventName }
    ::= { mteEventTable 1 }

MteEventEntry ::= SEQUENCE {
    mteEventName                        SnmpAdminString,
    mteEventComment                     DisplayString,
    mteEventActions                     BITS,
    mteEventNotification                OBJECT IDENTIFIER,





Expires 5 August 1998+6 months                                 [Page 18]


Internet Draft                 Event MIB                   5 August 1998


    mteEventObjects                     SnmpAdminString,
    mteEventSetObject                   OBJECT IDENTIFIER,
    mteEventSetObjectWildcard           TruthValue,
    mteEventSetValue                    Integer32,
    mteEventSetTargetTag                SnmpTagValue,
    mteEventSetContextName              SnmpAdminString,
    mteEventSetContextNameWildcard      TruthValue,
    mteEventStatus                      RowStatus
    }

mteEventName OBJECT-TYPE
    SYNTAX      SnmpAdminString (SIZE (1..64))
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "A locally-unique, administratively assigned name for the event."
    ::= { mteEventCreationEntry 1 }

mteEventComment OBJECT-TYPE
    SYNTAX      DisplayString
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "A description of the event's function and use."
    DEFVAL { ''H }
    ::= { mteEventEntry 2 }

mteEventActions OBJECT-TYPE
    SYNTAX      BITS { notification, set }
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The actions to peform when this event occurs.

        For 'notification', Traps and/or Informs are sent according
        to the configuration in the SNMP Notification MIB.

        For 'set', an SNMP Set operation is performed according to
        control values in this entry."
    DEFVAL { 0 }
    ::= { mteEventEntry 3 }

mteEventNotification OBJECT-TYPE
    SYNTAX      OBJECT IDENTIFIER
    MAX-ACCESS  read-create





Expires 5 August 1998+6 months                                 [Page 19]


Internet Draft                 Event MIB                   5 August 1998


    STATUS      current
    DESCRIPTION
        "The object identifier from the NOTIFICATION-TYPE for the
        notification to use if metEventActions has 'notification' set.

        If 'notification' is not set, this object is not instantiated."
    DEFVAL { 0 0 }
    ::= { mteEventEntry 4 }

mteEventObjects OBJECT-TYPE
    SYNTAX      SnmpAdminString (SIZE (0..64))
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The mteTriggerObjectName of a group of objects from
        mteTriggerObjectTable if mteEventActions has 'notification' set.
        These objects are to be added to any Notification generated by
        this event.

        If 'notification' is not set, this object is not instantiated.

        A length of 0 indicates no additional objects."
    DEFVAL { ''H }
    ::= { mteEventEntry 5 }

mteEventSetObject OBJECT-TYPE
    SYNTAX      OBJECT IDENTIFIER
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The object identifier from the MIB object to set if
        mteEventActions has 'set' set.

        This object identifier may be wildcarded by leaving sub-identifiers
        off the end, in which case nteEventSetObjectWildCard must be
        'true'.

        If mteEventSetObject is wildcarded the instance used to set it
        is the same as the instance for the value of mteTriggerValueID
        that triggered the event."

        If 'set' is not set, this object is not instantiated."
    DEFVAL { 0 0 }
    ::= { mteEventEntry 6 }






Expires 5 August 1998+6 months                                 [Page 20]


Internet Draft                 Event MIB                   5 August 1998


mteEventSetObjectWildcard OBJECT-TYPE
    SYNTAX      TruthValue
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "Control over whether mteEventSetObject is to be treated as
        fully-specified or wildcarded, with 'true' indicating wildcard
        if mteEventActions has 'set' set.

        If 'set' is not set, this object is not instantiated."
    DEFVAL { false }
    ::= { mteEventEntry 7 }

mteEventSetValue OBJECT-TYPE
    SYNTAX      Integer32
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The value to which to set the object at mteEventSetObject
        if mteEventActions has 'set' set.

        If 'set' is not set, this object is not instantiated."
    DEFVAL { 0 }
    ::= { mteEventEntry 8 }

mteEventSetTargetTag OBJECT-TYPE
    SYNTAX      SnmpTagValue
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The tag for the target(s) at which to set the object at
        mteEventSetObject to mteEventSetValue if mteEventActions
        has 'set' set.

        If 'set' is not set, this object is not instantiated."

        Systems limited to self management may not accept a non-zero
        length for the value of this object.

        A length of 0 indicates the local system.  In this case,
        access to the objects indicated by mteEventObjectID is under
        the security credentials of the requester that set
        mteEventStatus to 'active'."
    DEFVAL { ''H }
    ::= { mteEventEntry 9 }





Expires 5 August 1998+6 months                                 [Page 21]


Internet Draft                 Event MIB                   5 August 1998


mteEventSetContextName OBJECT-TYPE
    SYNTAX      SnmpAdminString
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The management context in which to set mteEventObjectID.
        if mteEventActions has 'set' set.

        If 'set' is not set, this object is not instantiated."

        This may be wildcarded by leaving characters off the end.  To
        indicate such wildcarding mteEventSetContextNameWildcard must
        be 'true'.

        If this context name is wildcarded the value used to complete
        the wildcarding of mteTriggerContextName will be appended."
    DEFVAL { ''H }
    ::= { mteEventEntry 10 }

mteEventSetContextNameWildcard OBJECT-TYPE
    SYNTAX      TruthValue
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "Control for whether mteEventSetContextName is to be treated as
        fully-specified or wildcarded, with 'true' indicating wildcard
        if mteEventActions has 'set' set.

        If 'set' is not set, this object is not instantiated."
    DEFVAL { false }
    ::= { mteTriggerEntry 10 }

mteEventStatus OBJECT-TYPE
    SYNTAX      RowStatus
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The control that allows creation and deletion of entries.
        Once made active an entry may not be modified except to
        delete it."
    DEFVAL { createAndWait }
    ::= { mteEventEntry 12 }


--





Expires 5 August 1998+6 months                                 [Page 22]


Internet Draft                 Event MIB                   5 August 1998


-- Notifications
--

eventMIBNotificationPrefix OBJECT IDENTIFIER ::= { eventMIB 2 }
eventMIBNotifications OBJECT IDENTIFIER ::= { eventMIBNotificationPrefix 0 }
eventMIBNotificationObjectss OBJECT IDENTIFIER
   ::= { eventMIBNotificationPrefix 1 }

--
-- Notification Objects
--

mteHotTrigger OBJECT-TYPE
    SYNTAX      SnmpAdminString
    MAX-ACCESS  accessible-for-notify
    STATUS      current
    DESCRIPTION
        "The name of the trigger causing the notification.
    ::= { mteTrigger 1 }

mteHotTargetName OBJECT-TYPE
    SYNTAX      SnmpAdminString
    MAX-ACCESS  accessible-for-notify
    STATUS      current
    DESCRIPTION
        "The SNMP Target MIB's snmpTargetAddrName related to the
        notification.
    ::= { mteTrigger 2 }

mteHotContextName OBJECT-TYPE
    SYNTAX      SnmpAdminString
    MAX-ACCESS  accessible-for-notify
    STATUS      current
    DESCRIPTION
        "The context name related to the notification.  This must be as
        fully-qualified as possible, inluding filling in wildcard
        informaation determined in processing."
    ::= { mteTrigger 3 }

mteHotOID OBJECT-TYPE
    SYNTAX      OBJECT IDENTIFIER
    MAX-ACCESS  accessible-for-notify
    STATUS      current
    DESCRIPTION
        "The object identifier of the destination object related to the





Expires 5 August 1998+6 months                                 [Page 23]


Internet Draft                 Event MIB                   5 August 1998


        notification.  This must be as fully-qualified as possible,
        inluding filling in wildcard informaation determined in processing.

        For a trigger-related notification this is from mteTriggerValueID.

        For a set failure this is from mteEventSetObject."
    ::= { mteTrigger 3 }

mterHotValue OBJECT-TYPE
    SYNTAX      Integer32
    MAX-ACCESS  accessible-for-notify
    STATUS      current
    DESCRIPTION
        "The value of the object at mteTriggerValueID when a
        trigger fired."
    ::= { mteTrigger 5 }

mteFailedReason OBJECT-TYPE
    SYNTAX      FailureReason
    MAX-ACCESS  accessible-for-notify
    STATUS      current
    DESCRIPTION
        "The reason for the failure of an attempt to check for a
        trigger condition or set an object in response to an event.
    ::= { mteTrigger 6 }

--
-- Notifications
--

mteTriggerSenseAlarm NOTIFICATION-TYPE
    OBJECTS { mteHotTrigger,
              mteHotTargetName,
              mteHotContextName,
              mteHotOID,
              mteHotValue }
    STATUS  current
    DESCRIPTION
        "Notification that the trigger indicated by the object
        instances has fired, for triggers with mteTriggerType
        'boolean'."
    ::= { eventMIBNotifications 1 }

mteTriggerRisingAlarm NOTIFICATION-TYPE
    OBJECTS { mteHotTrigger,





Expires 5 August 1998+6 months                                 [Page 24]


Internet Draft                 Event MIB                   5 August 1998


              mteHotTargetName,
              mteHotContextName,
              mteHotOID,
              mteHotValue }
    STATUS  current
    DESCRIPTION
        "Notification that the rising threshold was met for triggers
        with mteTriggerType 'threshold'."
    ::= { eventMIBNotifications 2 }

mteTriggerFallingAlarm NOTIFICATION-TYPE
    OBJECTS { mteHotTrigger,
              mteHotTargetName,
              mteHotContextName,
              mteHotOID,
              mteHotValue }
    STATUS  current
    DESCRIPTION
        "Notification that the falling threshold was met for triggers
        with mteTriggerType 'threshold'."
    ::= { eventMIBNotifications 3 }

mteTriggerFailureAlarm NOTIFICATION-TYPE
    OBJECTS { mteHotTrigger,
              mteHotTargetName,
              mteHotContextName,
              mteHotOID,
              mteFailedReason }
    STATUS  current
    DESCRIPTION
        "Notification that an attempt to check a trigger has failed.

        The network manager must enable this notification only with
        a certain fear and trembling, as it can easily crowd out more
        important information.  It should be used only to help diagnose
        a problem that has appeared in the error counters and can not
        be found otherwise."
    ::= { eventMIBNotifications 4 }

mteEventSetFailureAlarm NOTIFICATION-TYPE
    OBJECTS { mteHotTrigger,
              mteHotTargetName,
              mteHotContextName,
              mteHotOID,
              mteFailedReason }





Expires 5 August 1998+6 months                                 [Page 25]


Internet Draft                 Event MIB                   5 August 1998


    STATUS  current
    DESCRIPTION
        "Notification that an attempt to do a set in response to an
        event has failed.

        The network manager must enable this notification only with
        a certain fear and trembling, as it can easily crowd out more
        important information.  It should be used only to help diagnose
        a problem that has appeared in the error counters and can not
        be found otherwise."
    ::= { eventMIBNotifications 5 }


--
-- Conformance
--

eventMIBConformance OBJECT IDENTIFIER ::= { eventMIB 3 }
eventMIBCompliances OBJECT IDENTIFIER ::= { eventMIBConformance 1 }
eventMIBGroups      OBJECT IDENTIFIER ::= { eventMIBConformance 2 }

-- Compliance

eventMIBCompliance MODULE-COMPLIANCE
        STATUS current
        DESCRIPTION
                "The compliance statement for entities which implement
                the Event MIB."
        MODULE  -- this module
                MANDATORY-GROUPS {
                        eventTriggerGroup,
                        eventEventGroup,
                        eventNotificationObjectGroup,
                        eventNotificationGroup
                }

                OBJECT mteTriggerTargetTag
                MIN-ACCESS  read-only
                DESCRIPTION
                        "Write access is not required, thus limiting
                        monitoring to the local system or preconfigured
                        remote systems.""

                OBJECT mteEventSetTargetTag
                MIN-ACCESS  read-only





Expires 5 August 1998+6 months                                 [Page 26]


Internet Draft                 Event MIB                   5 August 1998


                DESCRIPTION
                        "Write access is not required, thus limiting
                        setting to the local system or preconfigured
                        remote systems.""

                OBJECT mteTriggerValueIDWildcard
                MIN-ACCESS  read-only
                DESCRIPTION
                        "Write access is not required, thus allowing
                        the system not to implement wildcarding."

                OBJECT mteTriggerContextNameWildcard
                MIN-ACCESS  read-only
                DESCRIPTION
                        "Write access is not required, thus allowing
                        the system not to implement wildcarding."


                OBJECT mteTriggerObjectValueIDWildcard
                MIN-ACCESS  read-only
                DESCRIPTION
                        "Write access is not required, thus allowing
                        the system not to implement wildcarding."

                OBJECT mteEventSetContextNameWildcard
                MIN-ACCESS  read-only
                DESCRIPTION
                        "Write access is not required, thus allowing
                        the system not to implement wildcarding."

        ::= { eventMIBCompliances 1 }

-- Units of Conformance

eventTriggerGroup OBJECT-GROUP
        OBJECTS {
                mteTriggerFailures,

                mteTriggerComment,
                mteTriggerTest,
                mteTriggerValueID,
                mteTriggerValueIDWildcard,
                mteTriggerTargetTag,
                mteTriggerContextName,
                mteTriggerContextNameWildcard,





Expires 5 August 1998+6 months                                 [Page 27]


Internet Draft                 Event MIB                   5 August 1998


                mteTriggerFrequency,
                mteTriggerBooleanStartup,
                mteTriggerThresholdStartup,
                mteTriggerRisingThreshold,
                mteTriggerFallingThreshold,
                mteTriggerEvent,
                mteTriggerRisingEvent,
                mteTriggerFallingEvent,
                mteTriggerObjects,
                mteTriggerStatus,

                mteTriggerObjectID,
                mteTriggerObjectIDWildcard,
                mteTriggerObjectStatus
        }
        STATUS current
        DESCRIPTION
                "Event triggers and supplemental objects."
        ::= { eventMIBGroups 1 }

eventEventGroup OBJECT-GROUP
        OBJECTS {
                mteEventComment,
                mteEventActions,
                mteEventNotification,
                mteEventObjects,
                mteEventSetObject,
                mteEventSetObjectWildcard,
                mteEventSetValue,
                mteEventSetTargetTag,
                mteEventSetContextName,
                mteEventSetContextNameWildcard,
                mteEventStatus
        }
        STATUS current
        DESCRIPTION
                "Events."
        ::= { eventMIBGroups 2 }

eventNotificationObjectGroup OBJECT-GROUP
        OBJECTS {
                mteHotTrigger,
                mteHotTargetName,
                mteHotContextName,
                mteHotOID,





Expires 5 August 1998+6 months                                 [Page 28]


Internet Draft                 Event MIB                   5 August 1998


                mterHotValue,
                mteFailedReason
        }
        STATUS current
        DESCRIPTION
                "Notification objects."
        ::= { eventMIBGroups 3 }

eventNotificationGroup OBJECT-GROUP
        OBJECTS {
                mteTriggerSenseAlarm,
                mteTriggerRisingAlarm,
                mteTriggerFallingAlarm,
                mteTriggerFailureAlarm,
                mteEventSetFailureAlarm
        }
        STATUS current
        DESCRIPTION
                "Notifications."
        ::= { eventMIBGroups 4 }

END




























Expires 5 August 1998+6 months                                 [Page 29]


Internet Draft                 Event MIB                   5 August 1998


9.  Acknowledgements

This MIB contains considerable contributions from the RMON MIB, the
Distributed Management Design Team (Andy Bierman, Maria Greene, Bob
Stewart, and Steve Waldbusser), and colleagues at Cisco.













































Expires 5 August 1998+6 months                                 [Page 30]


Internet Draft                 Event MIB                   5 August 1998


10.  References

[1]  Harrington, D., Presuhn, R., and B. Wijnen, "An Architecture for
     Describing SNMP Management Frameworks", RFC 2271, Cabletron
     Systems, Inc., BMC Software, Inc., IBM T. J. Watson Research,
     January 1998

[2]  Rose, M., and K. McCloghrie, "Structure and Identification of
     Management Information for TCP/IP-based Internets", RFC 1155,
     Performance Systems International, Hughes LAN Systems, May 1990

[3]  Rose, M., and K. McCloghrie, "Concise MIB Definitions", RFC 1212,
     Performance Systems International, Hughes LAN Systems, March 1991

[4]  M. Rose, "A Convention for Defining Traps for use with the SNMP",
     RFC 1215, Performance Systems International, March 1991

[5]  Case, J., McCloghrie, K., Rose, M., and S. Waldbusser, "Structure
     of Management Information for Version 2 of the Simple Network
     Management Protocol (SNMPv2)", RFC 1902, SNMP Research,Inc., Cisco
     Systems, Inc., Dover Beach Consulting, Inc., International Network
     Services, January 1996.

[6]  Case, J., McCloghrie, K., Rose, M., and S. Waldbusser, "Textual
     Conventions for Version 2 of the Simple Network Management Protocol
     (SNMPv2)", RFC 1903, SNMP Research, Inc., Cisco Systems, Inc.,
     Dover Beach Consulting, Inc., International Network Services,
     January 1996.

[7]  Case, J., McCloghrie, K., Rose, M., and S. Waldbusser, "Conformance
     Statements for Version 2 of the Simple Network Management Protocol
     (SNMPv2)", RFC 1904, SNMP Research, Inc., Cisco Systems, Inc.,
     Dover Beach Consulting, Inc., International Network Services,
     January 1996.

[8]  Case, J., Fedor, M., Schoffstall, M., and J. Davin, "Simple Network
     Management Protocol", RFC 1157, SNMP Research, Performance Systems
     International, Performance Systems International, MIT Laboratory
     for Computer Science, May 1990.

[9]  Case, J., McCloghrie, K., Rose, M., and S. Waldbusser,
     "Introduction to Community-based SNMPv2", RFC 1901, SNMP Research,
     Inc., Cisco Systems, Inc., Dover Beach Consulting, Inc.,
     International Network Services, January 1996.






Expires 5 August 1998+6 months                                 [Page 31]


Internet Draft                 Event MIB                   5 August 1998


[10] Case, J., McCloghrie, K., Rose, M., and S. Waldbusser, "Transport
     Mappings for Version 2 of the Simple Network Management Protocol
     (SNMPv2)", RFC 1906, SNMP Research, Inc., Cisco Systems, Inc.,
     Dover Beach Consulting, Inc., International Network Services,
     January 1996.

[11] Case, J., Harrington D., Presuhn R., and B. Wijnen, "Message
     Processing and Dispatching for the Simple Network Management
     Protocol (SNMP)", RFC 2272, SNMP Research, Inc., Cabletron Systems,
     Inc., BMC Software, Inc., IBM T. J. Watson Research, January 1998.

[12] Blumenthal, U., and B. Wijnen, "User-based Security Model (USM) for
     version 3 of the Simple Network Management Protocol (SNMPv3)", RFC
     2274, IBM T. J. Watson Research, January 1998.

[13] Case, J., McCloghrie, K., Rose, M., and S. Waldbusser, "Protocol
     Operations for Version 2 of the Simple Network Management Protocol
     (SNMPv2)", RFC 1905, SNMP Research, Inc., Cisco Systems, Inc.,
     Dover Beach Consulting, Inc., International Network Services,
     January 1996.

[14] Levi, D., Meyer, P., and B. Stewart, "SNMPv3 Applications", RFC
     2273, SNMP Research, Inc., Secure Computing Corporation, Cisco
     Systems, January 1998

[15] Wijnen, B., Presuhn, R., and K. McCloghrie, "View-based Access
     Control Model (VACM) for the Simple Network Management Protocol
     (SNMP)", RFC 2275, IBM T. J. Watson Research, BMC Software, Inc.,
     Cisco Systems, Inc., January 1998

[16] Waldbusser, S., "Remote Network Monitoring Management Information
     Base", RFC 1757, International Network Services, February 1995

[17] Case, J., McCloghrie, K., Rose, M., Waldbusser, S., "Manager-to-
     Manager Management Information Base", RFC 1451, SNMP Research,
     Inc., Cisco SYSTEMS< Inc., Dover Beach Consulting, Inc.,
     International Network Services, April 1993

[18] Stewart, B., "Expression MIB", RFC ????, Cisco Systems, Inc.,
     ?Month? 1998

[19] Stewart, B., "Notification Log MIB", RFC ????, Cisco Systems, Inc.,
     ?Month? 1998







Expires 5 August 1998+6 months                                 [Page 32]


Internet Draft                 Event MIB                   5 August 1998


11.  Security Considerations

Security issues are discussed in the Overview section and in the
DESCRIPTION clauses of relevant objects.


12.  Author's Address

     Bob Stewart
     Cisco Systems, Inc.
     170 West Tasman Drive
     San Jose, CA 95134-1706

     Phone: 408-526-4527
     Email: bstewart@cisco.com



































Expires 5 August 1998+6 months                                 [Page 33]


Internet Draft                 Event MIB                   5 August 1998


Table of Contents


1 Abstract ........................................................    2
2 The SNMP Management Framework ...................................    2
3 Overview ........................................................    4
4 Relationship to Other MIBs ......................................    4
5 MIB Sections ....................................................    4
6 Operation .......................................................    5
7 Security ........................................................    5
8 Definitions .....................................................    7
9 Acknowledgements ................................................   30
10 References .....................................................   31
11 Security Considerations ........................................   33
12 Author's Address ...............................................   33



































Expires 5 August 1998+6 months                                 [Page 34]