some or all of the objects in an expression. (See the
DESCRIPTION of expObjectID for details. However, note that
if more than one object in the same expression is wildcarded
in this way, they all must be objects where that portion of
the instance is the same. In other words, all objects may be
in the same SEQUENCE or in different SEQUENCEs but with the
same semantic index value (e.g., a value of ifIndex)
for the wildcarded portion."
::= { expDefine 3 }
expObjectEntry OBJECT-TYPE
SYNTAX ExpObjectEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Information about an object. An application uses
expObjectEntryStatus to create entries in this table while
in the process of defining an expression.
Values of read-create objects in this table may be
changed at any time."
INDEX { expExpressionOwner, expExpressionName, expObjectIndex }
::= { expObjectTable 1 }
ExpObjectEntry ::= SEQUENCE {
expObjectIndex Unsigned32,
expObjectID OBJECT IDENTIFIER,
expObjectIDWildcard TruthValue,
expObjectSampleType INTEGER,
expObjectDeltaDiscontinuityID OBJECT IDENTIFIER,
expObjectDiscontinuityIDWildcard TruthValue,
expObjectDiscontinuityIDType INTEGER,
expObjectConditional OBJECT IDENTIFIER,
expObjectConditionalWildcard TruthValue,
expObjectEntryStatus RowStatus
}
expObjectIndex OBJECT-TYPE
SYNTAX Unsigned32 (1..4294967295)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Within an expression, a unique, numeric identification for an
object. Prefixed with a dollar sign ('$') this is used to
reference the object in the corresponding expExpression."
::= { expObjectEntry 1 }
expObjectID OBJECT-TYPE
SYNTAX OBJECT IDENTIFIER
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The OBJECT IDENTIFIER (OID) of this object. The OID may be
fully qualified, meaning it includes a complete instance
identifier part (e.g., ifInOctets.1 or sysUpTime.0), or it
may not be fully qualified, meaning it may lack all or part
of the instance identifier. If the expObjectID is not fully
qualified, then expObjectWildcard must be set to true(1).
The value of the expression will be multiple
values, as if done for a GetNext sweep of the object.
An object here may itself be the result of an expression but
recursion is not allowed.
NOTE: The simplest implementations of this MIB may not allow
wildcards."
::= { expObjectEntry 2 }
expObjectIDWildcard OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"A true value indicates the expObjecID of this row is a wildcard
object. False indicates that expObjectID is fully instanced.
If all expObjectWildcard values for a given expression are FALSE,
expExpressionPrefix will reflect a scalar object (i.e. will
be 0.0).
NOTE: The simplest implementations of this MIB may not allow
wildcards."
DEFVAL { false }
::= { expObjectEntry 3 }
expObjectSampleType OBJECT-TYPE
SYNTAX INTEGER { absoluteValue(1), deltaValue(2),
changedValue(3) }
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The method of sampling the selected variable.
An 'absoluteValue' is simply the present value of the object.
A 'deltaValue' is the present value minus the previous value,
which was sampled expExpressionDeltaInterval seconds ago.
This is intended primarily for use with SNMP counters, which are
meaningless as an 'absoluteValue', but may be used with any
integer-based value.
A 'changedValue' is a boolean for whether the present value is
different from the previous value. It is applicable to any data
type and results in an Unsigned32 with value 1 if the object's
value is changed and 0 if not. In all other respects it is as a
'deltaValue' and all statements and operation regarding delta
values apply to changed values.
When an expression contains both delta and absolute values
the absolute values are obtained at the end of the delta
period."
DEFVAL { absoluteValue }
::= { expObjectEntry 4 }
sysUpTimeInstance OBJECT IDENTIFIER ::= { sysUpTime 0 }
expObjectDeltaDiscontinuityID OBJECT-TYPE
SYNTAX OBJECT IDENTIFIER
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The OBJECT IDENTIFIER (OID) of a TimeTicks, TimeStamp, or
DateAndTime object that indicates a discontinuity in the value
at expObjectID.
This object is instantiated only if expObjectSampleType is
'deltaValue' or 'changedValue'.
The OID may be for a leaf object (e.g. sysUpTime.0) or may
be wildcarded to match expObjectID.
This object supports normal checking for a discontinuity in a
counter. Note that if this object does not point to sysUpTime
discontinuity checking must still check sysUpTime for an overall
discontinuity.
If the object identified is not accessible no discontinuity
check will be made."
DEFVAL { sysUpTimeInstance }
::= { expObjectEntry 5 }
expObjectDiscontinuityIDWildcard OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"A true value indicates the expObjectDeltaDiscontinuityID of
this row is a wildcard object. False indicates that
expObjectDeltaDiscontinuityID is fully instanced.
This object is instantiated only if expObjectSampleType is
'deltaValue' or 'changedValue'.
NOTE: The simplest implementations of this MIB may not allow
wildcards."
DEFVAL { false }
::= { expObjectEntry 6 }
expObjectDiscontinuityIDType OBJECT-TYPE
SYNTAX INTEGER { timeTicks(1), timeStamp(2), dateAndTime(3) }
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The value 'timeTicks' indicates the expObjectDeltaDiscontinuityID
of this row is of syntax TimeTicks. The value 'timeStamp' indicates
syntax TimeStamp. The value 'dateAndTime indicates syntax
DateAndTime.
This object is instantiated only if expObjectSampleType is
'deltaValue' or 'changedValue'."
DEFVAL { timeTicks }
::= { expObjectEntry 7 }
expObjectConditional OBJECT-TYPE
SYNTAX OBJECT IDENTIFIER
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The OBJECT IDENTIFIER (OID) of an object that overrides
whether the instance of expObjectID is to be considered
usable. If the value of the object at expObjectConditional
is 0 or not instantiated, the object at expObjectID is
treated as if it is not instantiated. In other words,
expObjectConditional is a filter that controls whether or
not to use the value at expObjectID.
The OID may be for a leaf object (e.g. sysObjectID.0) or may be
wildcarded to match expObjectID. If expObject is wildcarded and
expObjectID in the same row is not, the wild portion of
expObjectConditional must match the wildcarding of the rest of
the expression. If no object in the expression is wildcarded
but expObjectConditional is, use the lexically first instance
(if any) of expObjectConditional.
If the value of expObjectConditional is 0.0 operation is
as if the value pointed to by expObjectConditional is a
non-zero (true) value.
Note that expObjectConditional can not trivially use an object
of syntax TruthValue, since the underlying value is not 0 or 1."
DEFVAL { zeroDotZero }
::= { expObjectEntry 8 }
expObjectConditionalWildcard OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"A true value indicates the expObjectConditional of this row is
a wildcard object. False indicates that expObjectConditional is
fully instanced.
NOTE: The simplest implementations of this MIB may not allow
wildcards."
DEFVAL { false }
::= { expObjectEntry 9 }
expObjectEntryStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The control that allows creation/deletion of entries.
Objects in this table may be changed while
expObjectEntryStatus is in any state."
::= { expObjectEntry 10 }
--
-- Expression Value Table
--
expValueTable OBJECT-TYPE
SYNTAX SEQUENCE OF ExpValueEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table of values from evaluated expressions."
::= { expValue 1 }
expValueEntry OBJECT-TYPE
SYNTAX ExpValueEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A single value from an evaluated expression. For a given
instance, only one 'Val' object in the conceptual row will be
instantiated, that is, the one with the appropriate type for
the value. For values that contain no objects of
expObjectSampleType 'deltaValue' or 'changedValue', reading a
value from the table causes the evaluation of the expression
for that value. For those that contain a 'deltaValue' or
'changedValue' the value read is as of the last sampling
interval.
If in the attempt to evaluate the expression one or more
of the necessary objects is not available, the corresponding
entry in this table is effectively not instantiated.
To maintain security of MIB information, when creating a new
row in this table, the managed system must record the security
credentials of the requester. These security credentials are
the parameters necessary as inputs to isAccessAllowed from
[RFC2571]. When obtaining the objects that make up the
expression, the system must (conceptually) use isAccessAllowed to
ensure that it does not violate security.
The evaluation of that expression takes place under the
security credentials of the creator of its expExpressionEntry.
To maintain security of MIB information, expression evaluation must
take place using security credentials for the implied Gets of the
objects in the expression as inputs (conceptually) to
isAccessAllowed from the Architecture for Describing SNMP
Management Frameworks. These are the security credentials of the
creator of the corresponding expExpressionEntry."
INDEX { expExpressionOwner, expExpressionName,
IMPLIED expValueInstance }
::= { expValueTable 1 }
ExpValueEntry ::= SEQUENCE {
expValueInstance OBJECT IDENTIFIER,
expValueCounter32Val Counter32,
expValueUnsigned32Val Unsigned32,
expValueTimeTicksVal TimeTicks,
expValueInteger32Val Integer32,
expValueIpAddressVal IpAddress,
expValueOctetStringVal OCTET STRING,
expValueOidVal OBJECT IDENTIFIER,
expValueCounter64Val Counter64
}
expValueInstance OBJECT-TYPE
SYNTAX OBJECT IDENTIFIER
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The final instance portion of a value's OID according to
the wildcarding in instances of expObjectID for the
expression. The prefix of this OID fragment is 0.0,
leading to the following behavior.
If there is no wildcarding, the value is 0.0.0. In other
words, there is one value which standing alone would have
been a scalar with a 0 at the end of its OID.
If there is wildcarding, the value is 0.0 followed by
a value that the wildcard can take, thus defining one value
instance for each real, possible value of the wildcard.
So, for example, if the wildcard worked out to be an ifIndex,
there is an expValueInstance for each applicable ifIndex."
::= { expValueEntry 1 }
expValueCounter32Val OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value when expExpressionValueType is 'counter32'."
::= { expValueEntry 2 }
expValueUnsigned32Val OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value when expExpressionValueType is 'unsigned32'."
::= { expValueEntry 3 }
expValueTimeTicksVal OBJECT-TYPE
SYNTAX TimeTicks
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value when expExpressionValueType is 'timeTicks'."
::= { expValueEntry 4 }
expValueInteger32Val OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value when expExpressionValueType is 'integer32'."
::= { expValueEntry 5 }
expValueIpAddressVal OBJECT-TYPE
SYNTAX IpAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value when expExpressionValueType is 'ipAddress'."
::= { expValueEntry 6 }
expValueOctetStringVal OBJECT-TYPE
SYNTAX OCTET STRING (SIZE (0..65536))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value when expExpressionValueType is 'octetString'."
::= { expValueEntry 7 }
expValueOidVal OBJECT-TYPE
SYNTAX OBJECT IDENTIFIER
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value when expExpressionValueType is 'objectId'."
::= { expValueEntry 8 }
expValueCounter64Val OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value when expExpressionValueType is 'counter64'."
::= { expValueEntry 9 }
--
-- Conformance
--
dismanExpressionMIBConformance OBJECT IDENTIFIER ::=
{ dismanExpressionMIB 3 }
dismanExpressionMIBCompliances OBJECT IDENTIFIER ::=
{ dismanExpressionMIBConformance 1 }
dismanExpressionMIBGroups OBJECT IDENTIFIER ::=
{ dismanExpressionMIBConformance 2 }
-- Compliance
dismanExpressionMIBCompliance MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"The compliance statement for entities which implement
the Expression MIB."
MODULE -- this module
MANDATORY-GROUPS {
dismanExpressionResourceGroup,
dismanExpressionDefinitionGroup,
dismanExpressionValueGroup
}
OBJECT expResourceDeltaMinimum
SYNTAX Integer32 (-1 | 60..600)
DESCRIPTION
"Implementation need not allow deltas or it may
implement them and restrict them to higher values."
OBJECT expObjectSampleType
WRITE-SYNTAX INTEGER { absoluteValue(1) }
DESCRIPTION
"Implementation may disallow deltas calculation or
change detection."
OBJECT expObjectIDWildcard
WRITE-SYNTAX INTEGER { false(2) }
DESCRIPTION
"Implementation may allow wildcards."
OBJECT expObjectDiscontinuityIDWildcard
WRITE-SYNTAX INTEGER { false(2) }
DESCRIPTION
"Implementation need not allow wildcards."
OBJECT expObjectConditionalWildcard
WRITE-SYNTAX INTEGER { false(2) }
DESCRIPTION
"Implementation need not allow deltas wildcards."
::= { dismanExpressionMIBCompliances 1 }
-- Units of Conformance
dismanExpressionResourceGroup OBJECT-GROUP
OBJECTS {
expResourceDeltaMinimum,
expResourceDeltaWildcardInstanceMaximum,
expResourceDeltaWildcardInstances,
expResourceDeltaWildcardInstancesHigh,
expResourceDeltaWildcardInstanceResourceLacks
}
STATUS current
DESCRIPTION
"Expression definition resource management."
::= { dismanExpressionMIBGroups 1 }
dismanExpressionDefinitionGroup OBJECT-GROUP
OBJECTS {
expExpression,
expExpressionValueType,
expExpressionComment,
expExpressionDeltaInterval,
expExpressionPrefix,
expExpressionErrors,
expExpressionEntryStatus,
expErrorTime,
expErrorIndex,
expErrorCode,
expErrorInstance,
expObjectID,
expObjectIDWildcard,
expObjectSampleType,
expObjectDeltaDiscontinuityID,
expObjectDiscontinuityIDWildcard,
expObjectDiscontinuityIDType,
expObjectConditional,
expObjectConditionalWildcard,
expObjectEntryStatus
}
STATUS current
DESCRIPTION
"Expression definition."
::= { dismanExpressionMIBGroups 2 }
dismanExpressionValueGroup OBJECT-GROUP
OBJECTS {
expValueCounter32Val,
expValueUnsigned32Val,
expValueTimeTicksVal,
expValueInteger32Val,
expValueIpAddressVal,
expValueOctetStringVal,
expValueOidVal,
expValueCounter64Val
}
STATUS current
DESCRIPTION
"Expression value."
::= { dismanExpressionMIBGroups 3 }
END
4. Intellectual Property
The IETF takes no position regarding the validity or scope of any
intellectual property or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; neither does it represent that it
has made any effort to identify any such rights. Information on the
IETF's procedures with respect to rights in standards-track and
standards- related documentation can be found in BCP-11. Copies of
claims of rights made available for publication and any assurances of
licenses to be made available, or the result of an attempt made to
obtain a general license or permission for the use of such
proprietary rights by implementors or users of this specification can
be obtained from the IETF Secretariat.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights which may cover technology that may be required to practice
this standard. Please address the information to the IETF Executive
Director.
5. Acknowledgements
This MIB contains considerable contributions from the Distributed
Management Design Team (Andy Bierman, Maria Greene, Bob Stewart, and
Steve Waldbusser), and colleagues at Cisco who did the first
implementation.
6. References
[RFC2571] Harrington, D., Presuhn, R. and B. Wijnen, "An
Architecture Describing SNMP Management Frameworks", RFC
2571, April 1999.
[RFC1155] Rose, M. and K. McCloghrie, "Structure and Identification
of Management Information for TCP/IP-based Internets",
STD 16, RFC1155, May 1990.
[RFC1212] Rose, M. and K. McCloghrie, "Concise MIB Definitions",
STD 16, RFC1212, March 1991.
[RFC1215] Rose, M., "A Convention for Defining Traps for use with
the SNMP", RFC1215, March 1991.
[RFC2578] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
Rose, M. and S. Waldbusser, "Structure of Management
Information Version 2 (SMIv2)", STD 58, RFC2578, April
1999.
[RFC2579] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
Rose, M. and S. Waldbusser, "Textual Conventions for
SMIv2", STD 58, RFC2579, April 1999.
[RFC2580] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
Rose, M. and S. Waldbusser, "Conformance Statements for
SMIv2", STD 58, RFC2580, April 1999.
[RFC1157] Case, J., Fedor, M., Schoffstall, M. and J. Davin,
"Simple Network Management Protocol", STD 15, RFC1157,
May 1990.
[RFC1901] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser,
"Introduction to Community-based SNMPv2", RFC1901,
January 1996.
[RFC1906] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser,
"Transport Mappings for Version 2 of the Simple Network
Management Protocol (SNMPv2)", RFC1906, January 1996.
[RFC2572] Case, J., Harrington D., Presuhn R. and B. Wijnen,
"Message Processing and Dispatching for the Simple
Network Management Protocol (SNMP)", RFC2572, April
1999.
[RFC2574] Blumenthal, U. and B. Wijnen, "User-based Security Model
(USM) for version 3 of the Simple Network Management
Protocol (SNMPv3)", RFC2574, April 1999.
[RFC1905] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser,
"Protocol Operations for Version 2 of the Simple Network
Management Protocol (SNMPv2)", RFC1905, January 1996.
[RFC2573] Levi, D., Meyer, P. and B. Stewart, "SNMPv3
Applications", RFC2573, April 1999.
[RFC2575] Wijnen, B., Presuhn, R. and K. McCloghrie, "View-based
Access Control Model (VACM) for the Simple Network
Management Protocol (SNMP)", RFC2575, April 1999.
[RFC2570] Case, J., Mundy, R., Partain, D. and B. Stewart,
"Introduction to Version 3 of the Internet-standard
Network Management Framework", RFC2570, April 1999.
[RFC1903] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser,
"Coexistence between Version 1 and version 2 of the
Internet-standard Network Management Framework", RFC
1903, January 1996.
[RFC2981] Stewart, B., "Event MIB", RFC2981, October 2000.
[PracPersp] Leinwand, A. and K. Fang, "Network Management: A
Practical Perspective", Addison-Wesley Publishing
Company, Inc., 1993.
7. Security Considerations
Expression MIB security involves two perspectives: protection of
expressions from tampering or unauthorized use of resources, and
protection of the objects used to calculate the expressions.
Security of expression definitions and results depends on the
expression owner (expExpressionOwner). With view-based access
control [RFC2575] a network manager can control who has what level of
access to what expressions.
Access control for the objects within the expression depends on the
security credentials of the expression creator. These are the
security credentials used to get the objects necessary to evaluate
the expression. They are the security credentials that were used to
set the expExpressionRowStatus object for that expression to
'active', as recorded by the managed system.
This means that the results of an expression could potentially be
made available to someone who does not have access to the raw data
that went into them. This could be either legitimate or a security
violation, depending on the specific situation and security policy.
To facilitate the provisioning of access control by a security
administrator for this MIB itself using the View-Based Access Control
Model (VACM) defined in RFC2575 [RFC2575] for tables in which
multiple users may need to independently create or modify entries,
the initial index is used as an "owner index". Such an initial index
has a syntax of SnmpAdminString, and can thus be trivially mapped to
a securityName or groupName as defined in VACM, in accordance with a
security policy.
All entries in related tables belonging to a particular user will
have the same value for this initial index. For a given user's
entries in a particular table, the object identifiers for the
information in these entries will have the same subidentifiers
(except for the "column" subidentifier) up to the end of the encoded
owner index. To configure VACM to permit access to this portion of
the table, one would create vacmViewTreeFamilyTable entries with the
value of vacmViewTreeFamilySubtree including the owner index portion,
and vacmViewTreeFamilyMask "wildcarding" the column subidentifier.
More elaborate configurations are possible.
8. Author's Address
Bob Stewart
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
U.S.A.
9. Editor's Address
Ramanathan Kavasseri
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
U.S.A.
Phone: +1 408 527 2446
EMail: ramk@cisco.com
10. Full Copyright Statement
Copyright (C) The Internet Society (2000). All Rights Reserved.
This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.
The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement
Funding for the RFCEditor function is currently provided by the
Internet Society.