SNMP Notifications. SNMP Notifications. Description of the SNMP notifications sent by the UBIqube SOC 1 / 7

Size: px

Start display at page:

Download "SNMP Notifications. SNMP Notifications. Description of the SNMP notifications sent by the UBIqube SOC 1 / 7"

Douglas Townsend
5 years ago
Views:

1 SNMP Notifications Description of the SNMP notifications sent by the UBIqube SOC September 2009 Initial version 1 / 7

2 Contents SNMP Notifications Introduction PDU format MIB Sending notification / 7

3 1. Introduction This document specifies the SNMP traps messages format sent by the UBIqube SOC when an event occurs. 2. PDU format PDU Type Enterprise Agent address Trap Type Specific code Timestamp Variables Notification SOC address 6 1 Date See below 3. MIB The following SNMP notifications are extracted from the UBIqube MIB. UBIQUBE-MIB DEFINITIONS ::= BEGIN IMPORTS MODULE-IDENTITY, OBJECT-TYPE, Counter32, Gauge32, Integer32, Unsigned32, NOTIFICATION-TYPE, OBJECT-IDENTITY, Counter64, enterprises FROM SNMPv2-SMI; ubiqube MODULE-IDENTITY LAST-UPDATED " Z" ORGANIZATION "UBIqube" CONTACT-INFO " "The Structure of Management Information for the UBIqube enterprise" ::= { enterprises } secengine MODULE-IDENTITY LAST-UPDATED " Z" ORGANIZATION "UBIqube" CONTACT-INFO " "The MIB module to describe management objects for the UBIqube SOC SEC Engine." ::= { ubiqube 3 } SOC Notifications / 7

4 smsnotifications MODULE-IDENTITY LAST-UPDATED " Z" ORGANIZATION "UBIqube" CONTACT-INFO " "The notifications from SEC Engine" ::= { secengine 4 } smsalarms OBJECT-IDENTITY "The alarm messages" ::= { smsnotifications 1 } smsalarmsfields OBJECT-IDENTITY "The alarm fields" ::= { smsalarms 1 } alarmfieldlevel OBJECT-TYPE SYNTAX INTEGER { Emergency(0), Alert(1), Critical(2), Error(3), Warning(4), Notice(5), Informational(6), Debug(7) } "Alarm Level" ::= { smsalarmsfields 1 } alarmfielddate OBJECT-TYPE "Alarm time" ::= { smsalarmsfields 2 } alarmfieldmessage OBJECT-TYPE "Alarm message" ::= { smsalarmsfields 3 } alarmfielddeviceid OBJECT-TYPE 4 / 7

5 "Device ID" ::= { smsalarmsfields 4 } alarmfielddevicename OBJECT-TYPE "Device name" ::= { smsalarmsfields 5 } alarmfielddevicemodel OBJECT-TYPE "Device model" ::= { smsalarmsfields 6 } alarmfielddeviceexternalref OBJECT-TYPE "Device external reference" ::= { smsalarmsfields 7 } alarmfieldlogreference OBJECT-TYPE "Log reference" ::= { smsalarmsfields 8 } alarmfieldipssignature OBJECT-TYPE "IPS signature" ::= { smsalarmsfields 9 } smsalarmtrap NOTIFICATION-TYPE OBJECTS { alarmfieldlevel, alarmfielddate, alarmfieldmessage, alarmfielddeviceid, alarmfielddevicename, alarmfielddevicemodel, alarmfielddeviceexternalref, alarmfieldlogreference, alarmfieldipssignature } "This notification is generated whenever an Alarm is raised in the 5 / 7

6 SEC Engine." ::= { smsalarms 2 } END 4. Sending notification For each alarm the UBIqube SOC sends a notification (if a snmp server has been configured) and an . The setting of an alarm occurs on the following various types of event. Only the alarmfieldmessage field is detailed. Device connectivity An alarm occurs when the SOC gets a device connectivity lost or restoring, as well as an external ip address change. %VNOC-1-IPUP: IPUP for <type> router <id>. The address is <addr> %VNOC-1-IPUP: IPUP for router <id> with dynamic ip address. Old address <old>, new address <new> %VNOC-1-IPUP: IPUP for router <id> with static ip address. Old address <old>, new address <new> %VNOC-1-IPDOWN: IPDOWN for router <id> %VNOC-1-UNMANAG: supervision - Site <id> unmanageable <addr> : IP address <type> : static or dynamic IP address <old> : old IP address <new> : new IP address Examples : %VNOC-1-IPUP: IPUP for static router TMT The address is %VNOC-1-IPDOWN: IPDOWN for router TMT Monitoring profile threshold overtaking An alarm occurs when a threshold defined in monitoring profile is reached. %VNOC-1-SNMPTHLD: supervision - Site <id> snmp threshold <name> raised value <val> (<signe> <thresh>) <name> : threshold name defined in the monitoring profile <val> : value of the monitored variable <signe> : < or > <thresh> : threshold value Example : %VNOC-1-SNMPTHLD: supervision - Site TMT9768 snmp threshold cpu raised value 96 (> 95) 6 / 7

7 Device asset information change When the firmware of a device is changed or when a device license (antivirus, ips...) expired the SOC can generate an alarm if it has been configured for that. By default no alarm. %VNOC-1-FIRMWARE: Firmware for router <id> has changed. Old '<old>', new '<new>' <old> : old firmware <new> : new firmware %VNOC-1-IPS-EXPIRATION: IPS license expiration date for router <id> has changed. Old '<old>', new '<new>' %VNOC-1-AV-EXPIRATION: AV license expiration date for router <id> has changed. Old '<old>', new '<new>' %VNOC-1-AS-EXPIRATION: AS license expiration date for router <id> has changed. Old '<old>', new '<new>' %VNOC-1-URL-EXPIRATION: URL license expiration date for router <id> has changed. Old '<old>', new '<new>' <old> : old expiration date <new> : new expiration date Incoming syslog device An alarm occurs when the SOC receives a syslog of level 0 or 1 (emergency or alert) from a device. Specific syslog of level 2 or upper (lower severity) can be configured to generate an alarm with the web portal. The description of the syslogs device is not the purpose of this document. 7 / 7

Chapter 23. Simple Network Management Protocol (SNMP)

Chapter 23. Simple Network Management Protocol (SNMP) Chapter 23 Simple Network Management Protocol (SNMP) 1 The McGraw-Hill Companies, Inc., 2000 1 CONTENTS CONCEPT MANAGEMENT COMPONENTS SMI MIB SNMP MESSAGES UDP PORTS SECURITY 2 The McGraw-Hill Companies,