1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
|
<pre>Network Working Group G. Keeni
Request for Comments: 5427 Cyber Solutions Inc.
Category: Standards Track March 2009
<span class="h1">Textual Conventions for Syslog Management</span>
Status of This Memo
This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice
Copyright (c) 2009 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to <a href="https://www.rfc-editor.org/bcp/bcp78">BCP 78</a> and the IETF Trust's Legal
Provisions Relating to IETF Documents in effect on the date of
publication of this document (<a href="http://trustee.ietf.org/license-info">http://trustee.ietf.org/license-info</a>).
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document.
This document may contain material from IETF Documents or IETF
Contributions published or made publicly available before November
10, 2008. The person(s) controlling the copyright in some of this
material may not have granted the IETF Trust the right to allow
modifications of such material outside the IETF Standards Process.
Without obtaining an adequate license from the person(s) controlling
the copyright in such materials, this document may not be modified
outside the IETF Standards Process, and derivative works of it may
not be created outside the IETF Standards Process, except to format
it for publication as an RFC or to translate it into languages other
than English.
Abstract
This MIB module defines textual conventions to represent Facility and
Severity information commonly used in syslog messages. The intent is
that these textual conventions will be imported and used in MIB
modules that would otherwise define their own representations.
<span class="grey">Keeni Standards Track [Page 1]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-2" ></span>
<span class="grey"><a href="./rfc5427">RFC 5427</a> Syslog MIB-TC March 2009</span>
Table of Contents
<a href="#section-1">1</a>. The Internet-Standard Management Framework ......................<a href="#page-2">2</a>
<a href="#section-2">2</a>. Background ......................................................<a href="#page-2">2</a>
<a href="#section-3">3</a>. The Syslog Textual Conventions MIB ..............................<a href="#page-3">3</a>
<a href="#section-4">4</a>. Security Considerations .........................................<a href="#page-7">7</a>
<a href="#section-5">5</a>. IANA Considerations .............................................<a href="#page-7">7</a>
<a href="#section-6">6</a>. References ......................................................<a href="#page-8">8</a>
<a href="#section-6.1">6.1</a>. Normative References .......................................<a href="#page-8">8</a>
<a href="#section-6.2">6.2</a>. Informative References .....................................<a href="#page-8">8</a>
<a href="#section-7">7</a>. Acknowledgments .................................................<a href="#page-8">8</a>
<span class="h2"><a class="selflink" id="section-1" href="#section-1">1</a>. The Internet-Standard Management Framework</span>
For a detailed overview of the documents that describe the current
Internet-Standard Management Framework, please refer to <a href="./rfc3410#section-7">section 7 of
RFC 3410</a> [<a href="./rfc3410" title=""Introduction and Applicability Statements for Internet- Standard Management Framework"">RFC3410</a>].
Managed objects are accessed via a virtual information store, termed
the Management Information Base or MIB. MIB objects are generally
accessed through the Simple Network Management Protocol (SNMP).
Objects in the MIB are defined using the mechanisms defined in the
Structure of Management Information (SMI). This memo specifies a MIB
module that is compliant to the SMIv2, which is described in STD 58,
<a href="./rfc2578">RFC 2578</a> [<a href="./rfc2578" title=""Structure of Management Information Version 2 (SMIv2)"">RFC2578</a>], STD 58, <a href="./rfc2579">RFC 2579</a> [<a href="./rfc2579" title=""Textual Conventions for SMIv2"">RFC2579</a>] and STD 58, <a href="./rfc2580">RFC 2580</a>
[<a href="./rfc2580" title=""Conformance Statements for SMIv2"">RFC2580</a>].
<span class="h2"><a class="selflink" id="section-2" href="#section-2">2</a>. Background</span>
Operating systems, processes, and applications, collectively termed
"Facilities" in the following, generate messages indicating their own
status or the occurrence of events. These messages have come to be
known as syslog messages. A syslog message in general will contain
among other things a code representing the Facility that generated
the message and a code representing the Severity of the message. The
Facility and the Severity codes are commonly used to categorize and
select received syslog messages for processing and display. The
Facility codes have been useful in qualifying the originator of the
content of the messages but in some cases they are not specific
enough to explicitly identify the originator. Implementations of the
syslog protocol [<a href="./rfc5424" title=""The Syslog Protocol"">RFC5424</a>] that contain structured data elements
(SDEs) should use these SDEs to clarify the entity that originated
the content of the message.
This document defines a set of textual conventions (TCs) that can be
used to represent Facility and Severity codes commonly used in syslog
messages.
<span class="grey">Keeni Standards Track [Page 2]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-3" ></span>
<span class="grey"><a href="./rfc5427">RFC 5427</a> Syslog MIB-TC March 2009</span>
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in <a href="./rfc2119">RFC 2119</a> [<a href="./rfc2119" title=""Key words for use in RFCs to Indicate Requirement Levels"">RFC2119</a>].
<span class="h2"><a class="selflink" id="section-3" href="#section-3">3</a>. The Syslog Textual Conventions MIB</span>
SYSLOG-TC-MIB DEFINITIONS ::= BEGIN
IMPORTS
MODULE-IDENTITY, mib-2
FROM SNMPv2-SMI -- [<a href="./rfc2578" title=""Structure of Management Information Version 2 (SMIv2)"">RFC2578</a>]
TEXTUAL-CONVENTION
FROM SNMPv2-TC; -- [<a href="./rfc2579" title=""Textual Conventions for SMIv2"">RFC2579</a>]
syslogTCMIB MODULE-IDENTITY
LAST-UPDATED "200903300000Z" -- 30 March 2009
ORGANIZATION "IETF Syslog Working Group"
CONTACT-INFO
" Glenn Mansfield Keeni
Postal: Cyber Solutions Inc.
6-6-3, Minami Yoshinari
Aoba-ku, Sendai, Japan 989-3204.
Tel: +81-22-303-4012
Fax: +81-22-303-4015
EMail: glenn@cysols.com
Support Group EMail: syslog@ietf.org
"
DESCRIPTION
"The MIB module containing textual conventions for syslog
messages.
Copyright (c) 2009 IETF Trust and the persons
identified as authors of the code. All rights reserved.
Redistribution and use in source and binary forms, with or
without modification, are permitted provided that the
following conditions are met:
- Redistributions of source code must retain the above
copyright notice, this list of conditions and the
following disclaimer.
- Redistributions in binary form must reproduce the above
copyright notice, this list of conditions and the
following disclaimer in the documentation and/or other
materials provided with the distribution.
<span class="grey">Keeni Standards Track [Page 3]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-4" ></span>
<span class="grey"><a href="./rfc5427">RFC 5427</a> Syslog MIB-TC March 2009</span>
- Neither the name of Internet Society, IETF or IETF
Trust, nor the names of specific contributors, may be
used to endorse or promote products derived from this
software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
CONTRIBUTORS 'AS IS' AND ANY EXPRESS OR IMPLIED
WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
This version of this MIB module is part of <a href="./rfc5427">RFC 5427</a>;
see the RFC itself for full legal notices.
"
REVISION "200903300000Z" -- 30 March 2009
DESCRIPTION
"The initial version, published as <a href="./rfc5427">RFC 5427</a>."
::= { mib-2 173 }
-- -------------------------------------------------------------
-- Textual Conventions
-- -------------------------------------------------------------
SyslogFacility ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"This textual convention enumerates the Facilities that
originate syslog messages.
The Facilities of syslog messages are numerically coded
with decimal values. For interoperability and backwards-
compatibility reasons, this document specifies a
normative mapping between a label, which represents a
Facility, and the corresponding numeric value. This label
could be used in, for example, SNMP Manager user
interfaces.
<span class="grey">Keeni Standards Track [Page 4]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-5" ></span>
<span class="grey"><a href="./rfc5427">RFC 5427</a> Syslog MIB-TC March 2009</span>
The label itself is often semantically meaningless
because it is impractical to attempt to enumerate all
possible Facilities, and many daemons and processes do
not have an explicitly assigned Facility code or label.
For example, there is no Facility label corresponding to
an HTTP service. An HTTP service implementation might log
messages as coming from, for example, 'local7' or 'uucp'.
This is typical current practice, and originators, relays,
and collectors can be configured to properly handle this
situation. For improved accuracy, an application can also
include an APP-NAME structured data element.
Note that operating system mechanisms for configuring
syslog, such as syslog.conf, have not yet been standardized
and might use different sets of Facility labels and/or
mapping between Facility labels and Facility codes than the
MIB.
In particular, the labels corresponding to Facility codes 4,
10, 13, and 14, and the code corresponding to the Facility
label 'cron' are known to vary across different operating
systems. To distinguish between the labels corresponding
to Facility codes 9 and 15, a label of 'cron2' is assigned
to the Facility code 15. This list is not intended to be
exhaustive; other differences might exist, and new
differences might be introduced in the future.
The mapping specified here MUST be used in a MIB network
management interface, even though a particular syslog
implementation might use a different mapping in a
different network management interface.
"
REFERENCE "The Syslog Protocol (<a href="./rfc5424">RFC5424</a>): Table 1"
SYNTAX INTEGER
{
kern (0), -- kernel messages
user (1), -- user-level messages
mail (2), -- mail system messages
daemon (3), -- system daemons' messages
auth (4), -- authorization messages
syslog (5), -- messages generated internally by
-- syslogd
lpr (6), -- line printer subsystem messages
news (7), -- network news subsystem messages
uucp (8), -- UUCP subsystem messages
cron (9), -- clock daemon messages
authpriv (10),-- security/authorization messages
<span class="grey">Keeni Standards Track [Page 5]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-6" ></span>
<span class="grey"><a href="./rfc5427">RFC 5427</a> Syslog MIB-TC March 2009</span>
ftp (11),-- ftp daemon messages
ntp (12),-- NTP subsystem messages
audit (13),-- audit messages
console (14),-- console messages
cron2 (15),-- clock daemon messages
local0 (16),
local1 (17),
local2 (18),
local3 (19),
local4 (20),
local5 (21),
local6 (22),
local7 (23)
}
SyslogSeverity ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"This textual convention enumerates the Severity levels
of syslog messages.
The Severity levels of syslog messages are numerically
coded with decimal values. For interoperability and
backwards-compatibility reasons, this document specifies
a normative mapping between a label, which represents a
Severity level, and the corresponding numeric value.
This label could be used in, for example, SNMP Manager
user interfaces.
The label itself is often semantically meaningless
because it is impractical to attempt to strictly define
the criteria for each Severity level, and the criteria
that is used by syslog originators is, and has
historically been, implementation-dependent.
Note that operating system mechanisms for configuring
syslog, such as syslog.conf, have not yet been standardized
and might use different sets of Severity labels and/or
mapping between Severity labels and Severity codes than the
MIB.
For example, the foobar application might log messages as
'crit' based on some subjective criteria. Yet the operator
can configure syslog to forward these messages, even though
the criteria for 'crit' may differ from one originator to
another. This is typical current practice, and originators,
relays, and collectors can be configured to properly handle
this situation.
<span class="grey">Keeni Standards Track [Page 6]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-7" ></span>
<span class="grey"><a href="./rfc5427">RFC 5427</a> Syslog MIB-TC March 2009</span>
"
REFERENCE "The Syslog Protocol (<a href="./rfc5424">RFC5424</a>): Table 2"
SYNTAX INTEGER
{
emerg (0), -- emergency; system is unusable
alert (1), -- action must be taken immediately
crit (2), -- critical condition
err (3), -- error condition
warning (4), -- warning condition
notice (5), -- normal but significant condition
info (6), -- informational message
debug (7) -- debug-level messages
}
END
<span class="h2"><a class="selflink" id="section-4" href="#section-4">4</a>. Security Considerations</span>
This module does not define any management objects. Instead, it
defines a set of textual conventions which may be used by other MIB
modules to define management objects. Meaningful security
considerations can only be written in the MIB modules that define
management objects. This document has therefore no impact on the
security of the Internet. Since objects defined using the TCs
defined in this document may introduce security issues, the user of
these TCs should read the security considerations section of
[<a href="./rfc5424" title=""The Syslog Protocol"">RFC5424</a>].
<span class="h2"><a class="selflink" id="section-5" href="#section-5">5</a>. IANA Considerations</span>
The MIB modules in this document use the following IANA-assigned
OBJECT IDENTIFIER values recorded in the SMI Numbers registry:
Descriptor OBJECT IDENTIFIER value
---------- -----------------------
syslogTCMIB { mib-2 173 }
<span class="grey">Keeni Standards Track [Page 7]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-8" ></span>
<span class="grey"><a href="./rfc5427">RFC 5427</a> Syslog MIB-TC March 2009</span>
<span class="h2"><a class="selflink" id="section-6" href="#section-6">6</a>. References</span>
<span class="h3"><a class="selflink" id="section-6.1" href="#section-6.1">6.1</a>. Normative References</span>
[<a id="ref-RFC2119">RFC2119</a>] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", <a href="https://www.rfc-editor.org/bcp/bcp14">BCP 14</a>, <a href="./rfc2119">RFC 2119</a>, March 1997.
[<a id="ref-RFC2578">RFC2578</a>] McCloghrie, K., Perkins, D., and J. Schoenwaelder,
"Structure of Management Information Version 2 (SMIv2)",
STD 58, <a href="./rfc2578">RFC 2578</a>, April 1999.
[<a id="ref-RFC2579">RFC2579</a>] McCloghrie, K., Perkins, D., and J. Schoenwaelder,
"Textual Conventions for SMIv2", STD 58, <a href="./rfc2579">RFC 2579</a>, April
1999.
[<a id="ref-RFC2580">RFC2580</a>] McCloghrie, K., Perkins, D., and J. Schoenwaelder,
"Conformance Statements for SMIv2", STD 58, <a href="./rfc2580">RFC 2580</a>,
April 1999.
[<a id="ref-RFC5424">RFC5424</a>] Gerhards, R., "The Syslog Protocol", <a href="./rfc5424">RFC 5424</a>, March 2009.
<span class="h3"><a class="selflink" id="section-6.2" href="#section-6.2">6.2</a>. Informative References</span>
[<a id="ref-RFC3410">RFC3410</a>] Case, J., Mundy, R., Partain, D., and B. Stewart,
"Introduction and Applicability Statements for Internet-
Standard Management Framework", <a href="./rfc3410">RFC 3410</a>, December 2002.
<span class="h2"><a class="selflink" id="section-7" href="#section-7">7</a>. Acknowledgments</span>
This document is a product of the Syslog Working Group. The author
would like to thank Chris Lonvick, David Harrington, Juergen
Schoenwaelder, and Pasi Eronen for their comments and suggestions.
Author's Address
Glenn Mansfield Keeni
Cyber Solutions Inc.
6-6-3 Minami Yoshinari
Aoba-ku, Sendai 989-3204
Japan
Phone: +81-22-303-4012
EMail: glenn@cysols.com
Keeni Standards Track [Page 8]
</pre>
|
