RFC 2982
Distributed Management Expression MIB
RFC 2982: Distributed Management Expression MIB 💖
okay bestie, so this one is RFC 2982, titled Distributed Management Expression MIB 🦋 It's a Standards Track doc from October 2000. The editor of this version is R. Kavasseri and the author of the previous version is B. Stewart, both at Cisco Systems, Inc. ✨ This title block doesn't have an Obsoletes or Updates line, so nothing is listed there as being replaced or changed.
Status of This Memo 📋
okay so this memo is an Internet standards track protocol for the Internet community 🎀 It's asking everyone to talk about it and send ideas for making it better. 🫶 If you want the current standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1) 🔍 And yes, distribution of this memo is unlimited, so share away 💅
Copyright Notice ©️
Copyright (C) The Internet Society (2000). All Rights Reserved. 🌸
Abstract 🧚
so this memo defines a chunk of the Management Information Base (MIB) that network management protocols in the Internet community use 💜 specifically, it describes managed objects for managing expressions of MIB objects ✨ The results of those expressions become MIB objects that work just like any other MIB object, like for the test condition when you're declaring an event 🔥
the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119. 🫶
Table of Contents 🗂️
1 The SNMP Management Framework ............................... 2
2 Overview .................................................... 3
2.1 Usage ..................................................... 4
2.2 Persistence ............................................... 4
2.3 Operation ................................................. 4
2.3.1 Sampling ................................................ 5
2.3.2 Wildcards ............................................... 5
2.3.3 Evaluation .............................................. 5
2.3.4 Value Identification .................................... 6
2.4 Subsets ................................................... 6
2.4.1 No Wildcards ............................................ 6
2.4.2 No Deltas ............................................... 7
2.5 Structure ................................................. 7
2.5.1 Resource ................................................ 7
2.5.2 Definition .............................................. 7
2.5.3 Value ................................................... 8
2.6 Examples .................................................. 8
2.6.1 Wildcarding ............................................. 8
2.6.2 Calculation and Conditional ............................. 10
3 Definitions ................................................. 12
4 Intellectual Property ....................................... 36
5 Acknowledgements ............................................ 37
6 References .................................................. 37
7 Security Considerations ..................................... 38
8 Author's Address ............................................ 40
9 Editor's Address ............................................ 40
10 Full Copyright Statement ................................... 411. The SNMP Management Framework ✨
okay so the SNMP Management Framework is currently made up of five major components 👑
- an overall architecture, described in RFC 2571 [RFC2571]. 🏗️
- mechanisms for describing and naming objects and events for management purposes. The first version of this Structure of Management Information (SMI) is SMIv1, described in STD 16, RFC 1155 [RFC1155], STD 16, RFC 1212 [RFC1212] and RFC 1215 [RFC1215]. The second version, SMIv2, is described in STD 58, RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579] and STD 58, RFC 2580 [RFC2580]. 📚
- message protocols for moving management information around 💌 The first version of the SNMP message protocol is SNMPv1, described in STD 15, RFC 1157 [RFC1157]. A second version, SNMPv2c, which is not an Internet standards track protocol, is described in RFC 1901 [RFC1901] and RFC 1906 [RFC1906]. The third version is SNMPv3, described in RFC 1906 [RFC1906], RFC 2572 [RFC2572] and RFC 2574 [RFC2574]. 🦋
- protocol operations for accessing management information. The first set of operations and their PDU formats is in STD 15, RFC 1157 [RFC1157]. A second set is described in RFC 1905 [RFC1905]. 🔧
- a set of fundamental applications described in RFC 2573 [RFC2573], plus the view-based access control mechanism described in RFC 2575 [RFC2575]. 🎀
if you want a more detailed intro to the current SNMP Management Framework, check out RFC 2570 [RFC2570] 🌈
managed objects get accessed through a virtual information store called the Management Information Base, or MIB 🧚 Objects in the MIB are defined using the mechanisms in the SMI.
this memo specifies a MIB module that is compliant with SMIv2 💅 A MIB that conforms to SMIv1 can be produced through the right translations. The translated MIB must be semantically equivalent, except where objects or events are left out because no translation is possible (like using Counter64) 🙈 Some machine readable info in SMIv2 gets turned into textual descriptions in SMIv1 during translation. but losing that machine readable info does not count as changing the semantics of the MIB, so you're fine 💜
2. Overview 🌸
okay so users of MIBs keep wanting MIB objects that MIB designers never bothered to provide 😭 And those needs change depending on your management philosophy. So instead of stuffing more and more MIBs with standardized objects, the Expression MIB supports externally defined expressions of existing MIB objects ✨
in the Expression MIB, the results of an evaluated expression are MIB objects that can be used like any other MIB objects. These custom objects are usable anywhere any other MIB object is usable 🔥 For example, a management application can use them directly, or another MIB can reference them, like the Event MIB [MIBEventMIB]. They can even be used by the Expression MIB itself, making expressions of expressions 🤯
the Expression MIB is instrumentation for a relatively powerful, complex, high-level application. It's really different from simple instrumentation for a communication driver or a protocol 💅 The MIB fits a relatively powerful, resource-rich managed system, and not necessarily a severely limited environment 🫶
still, because of dependencies on the Event MIB [RFC2981] and the need to support as low-end a system as possible, the Expression MIB can be somewhat stripped down for lower-power, lower-resource implementations, as described in the Subsets section, below 🍓
implementing the Expression MIB in a managed system led to adding objects that might not have been necessary in an application environment with complete knowledge of compiled MIB definitions 🧠 That's totally fine, since implementation has to be possible within typical managed systems that have some constraints on resources 💖
2.1. Usage 🦋
on managed systems that can handle the overhead, the Expression MIB is a way to create new, customized MIB objects for monitoring ✨ Those can save some network traffic and management-system overhead. but that's often not a good tradeoff for objects that are just going to be recorded or displayed 🙈
one example: the Expression MIB can provide custom objects for the Event MIB [RFC2981]. A complex expression can evaluate to a rate of flow or a boolean, which means it can be tested as an event trigger, resulting in an SNMP notification 🔥 Without this, monitoring would be stuck with whatever objects predefined MIBs offer. So the Expression MIB gives powerful tools to network managers watching large, complex systems that can handle a serious level of self management 👑
2.2. Persistence 💜
so like most MIBs, this one has no explicit controls for persisting the values set while configuring an expression 😭 but a robust, polite implementation would definitely not make its managing applications reconfigure it every time it resets 🫶
and just like with most MIBs, how a system provides and manages that persistence is implementation specific 🤷♀️ To speculate, you could imagine persistence depending on the context where the expression was configured, or maybe on system-specific characteristics of the expression's owner. Or maybe everything in a MIB like this one, which is clearly aimed at persistent configuration, is automatically part of a system's other persistent configuration 🧚
2.3. Operation 🎀
most of how the MIB operates is described or implied in the object definitions, but a few highlights are worth mentioning here 💅
2.3.1. Sampling 📸
the MIB supports three types of object sampling for the MIB objects that make up the expression: absolute, delta, and changed 🌈
absolute samples are simply the value of the MIB object at the time it's sampled ✨
absolute samples aren't enough for expressions of counters, because counters only mean something as a delta (a difference) from one sample to the next 🧮 So objects can be sampled as deltas. Delta sampling means the application has to keep state for the value at the last sample, and it has to keep sampling continuously whether or not anyone is looking at the results 😩 So it creates constant overhead 💀
changed sampling is basically a byproduct of delta sampling. Instead of a difference, the result is a boolean that says whether or not the object changed value since the last sample 🦋
2.3.2. Wildcards 🃏
wildcards let you apply one expression to multiple instances of the same MIB object 🪄 The definer of the expression picks this and gives a partial object identifier, with some or all of the instance portion left off 🧩 Then the application does the equivalent of GetNext to get the object values and discover the instances 🔍
all wildcarded objects in an expression must have the same semantics for the missing portion of their object identifiers 🚨 Otherwise, a "successful" evaluation of the wildcarded expression would just be the result of accidentally matching the wildcarded portion of the object identifiers. That kind of evaluation will likely produce results that aren't meaningful 😭
the expression can only be evaluated for those instances where all the objects in the expression are available with the same value for the wildcarded portion of the instance 🫶
2.3.3. Evaluation ✨
okay so there are two things about evaluation that aren't obvious, bestie: what objects get used, and when it happens 👀
The objects depend on the type of request and on whether the expression has wildcarded objects in it:
- If the request was a Get, that locks down the instances to be used 🔒
- If the request was a GetNext or GetBulk, the application must work its way up to the next full set of objects for the expression 🪜
Evaluation happens at two possible times, and which one you get depends on the sampling method (delta or absolute) used for the expression ⏰
- If there are no delta or change values in an expression, evaluation happens on demand, meaning when a requester tries to read the value. In this case, all requesters get a freshly calculated value 💅
- For expressions with delta or change values, evaluation goes on continuously, every sample period. Requesters get the value as of the last sample period 🌸
For any given sample period of a given expression, only those instances exist that provided a full set of object values. A delta expression that evaluated successfully in one sample period might not evaluate successfully in the next one. For example, that could be because of missing instances for some or all of the objects in the expression 😭 In those cases, the value from the previous sample period (the one with the successful evaluation) must not be carried forward to the next sample period (the one with the failed evaluation). No sneaky leftovers allowed 🙅♀️
2.3.4. Value Identification 🦋
okay this part is about how each value gets its ID card 🪪 Values that come out of expression evaluation are identified with a combination of four things:
- the object identifier (OID) for the data type from expValueTable (such as expValueCounter32Val)
- the expression owner
- the expression name
- an OID fragment
The OID fragment is not an entire OID starting with iso.dod.org (1.3.6). Instead, it begins with 0.0. The rest is either another 0 when there's no wildcarding, or the instance that satisfied the wildcard if there is wildcarding 🧚
2.4. Subsets 🍓
to keep the Expression MIB from getting too complicated or hungry for resources, an implementor can leave out various parts 🥗
2.4.1. No Wildcards
leaving out wildcarding makes retrieving values for evaluation, and the processing needed to do it, way simpler 🧠 This kind of implementation would still allow expressions made up of individual MIB objects. But it wouldn't be great for expressions applied across large tables, because every instance in the table would need its own separate expression definition 🙃
it also wouldn't be suitable for tables with arbitrary, dynamic instances, since expression definitions couldn't predict which instance values to use 🌀
an implementation without wildcards might be useful for a self-managing system with small tables or few dynamic instances, or one that can only do calculations for a few key objects 🧮
2.4.2. No Deltas
leaving out delta processing cuts down a lot on the state that has to be kept, plus the ongoing processing burden even when nobody is looking at the results 😴 Unfortunately, it also makes expressions on counters unusable, because counters only have meaning as deltas 💔
an implementation without deltas might be useful for a severely limited, self-managing system that has no need for expressions or events on counters. Although that's conceivable, such systems would be rare 🦕
2.5. Structure 🏗️
the MIB has the following sections:
- Resource -- management of the MIB's use of system resources.
- Definition -- definition of expressions.
- Value -- values of evaluated expressions.
2.5.1. Resource
the resource section has objects to manage resource usage by wildcarded delta expressions, which can be a major consumer of CPU and memory 🔥
2.5.2. Definition
the definition section contains the tables that define expressions 📋
The expression table is indexed by expression owner and expression name. It contains the parameters that apply to the entire expression, such as the expression itself, the data type of the result, and the sampling interval if it contains delta or change values 💜
The object table is indexed by expression owner, expression name, and object index within each expression. It contains the parameters that apply to the individual objects that go into the expression, including the object identifier, sample type, discontinuity indicator, and such 🎀
2.5.3. Value
the value section contains the values of evaluated expressions 🌈
The value table is indexed by expression owner, expression name, and instance fragment. It contains a "discriminated union" of evaluated expression results. For a given expression, only one of the columns is instantiated, depending on the result data type for that expression. The instance fragment is a constant or the final section of the object identifier that filled in a wildcard ✨
2.6. Examples 📖
the examples refer to tables and objects defined below in the MIB itself. They may well make more sense after you've read those definitions 🤓
2.6.1. Wildcarding 🎀
an expression may use wildcarded MIB objects that result in multiple values for the expression. To specify a wildcarded MIB object, a management application leaves off part or all of the instance portion of the object identifier, and sets expObjectWildcard to true(1) for that object. For our example we'll use a counter of total blessings from a table of people. Another table, indexed by town and person, has blessings just from that town 💖
So the index clauses are:
personEntry OBJECT-TYPE
...
INDEX { personIndex }And:
townPersonEntry OBJECT-TYPE
...
INDEX { townIndex, personIndex }In our friendly application, we may have entered our expression as:
100 * townPersonBlessings.976.* / personBlessings.*What goes in expExpression is:
100*$1/$2For example purposes, we'll use some slightly far-fetched OIDs. The People MIB is 1.3.6.1.99.7 and the Town MIB is 1.3.6.1.99.11, so for our two counters the OIDs are:
personBlessings 1.3.6.1.99.7.1.3.1.4
townPersonBlessings 1.3.6.1.99.11.1.2.1.9The rule for wildcards is that all the wildcarded parts have to match exactly. In this case, that means we have to hardwire the town, and only the personIndex can be wildcarded 🙌 So our values for expObjectID are:
1.3.6.1.99.7.1.3.1.4
1.3.6.1.99.11.1.2.1.9.976We're hardwired to townIndex 976, and personIndex is allowed to vary 💅
The value of expExpressionPrefix can be either of those two counter OIDs (including the instance fragment in the second case). That's because either one takes you to a MIB definition where you can look at the INDEX clause and figure out what's been left off 🔍 What's been left off doesn't have to work out to be the same object, but it does have to work out to be the same values (semantics) for the result to make sense. Note that the managed system can not typically check such semantics, and if it's given nonsense, it will return nonsense 🗑️
If we have people numbered 6, 19, and 42 in town number 976, the successive values of expValueInstance will be:
0.0.6
0.0.19
0.0.42So there will be three values in expValueTable, with those OIDs as the expValueInstance part of their indexing 🥳
2.6.2. Calculation and Conditional 🧮
the following formula for line utilization of a half-duplex link is adapted from [PracPersp].
utilization = (ifInOctets + ifOutOctets) * 800 / seconds / ifSpeedThe expression results in the percentage line utilization per second. The total octets are multiplied by 8 to get bits, and by 100 to scale up the percentage as an integer 📊
The following Expression MIB object values implement this as an expression for all ifIndexes that directly represent actual hardware. Since the octet counters are Counter32 values, they must be delta sampled to be meaningful. The sample period is 6 seconds, but for accuracy and independence it's calculated as a delta of sysUpTime ⏱️
The expObjectTable entry for ifInOctets has an expObjectConditional that checks for being a hardware interface. Only one object in the expression needs that check associated, since it applies to the whole expression. Since ifConnectorPresent is a TruthValue with values of 1 or 2 rather than 0 and non-zero, it must also be in an expression rather than used directly for the conditional 🙈
The interface-specific discontinuity indicator is supplied only for ifInOctets, since invalidating that sample will invalidate an attempt at evaluation, effectively invalidating ifOutOctets as well. That's correct, because it has the same indicator 🫶
For notational clarity, in the rest of this document, a string in quotes as part of the object instance indicates the value that would actually be one subidentifier per byte. The objects all belong to owner "me" 💜
Also for clarity, OIDs are expressed as the object descriptor and instance. In fact, they must be supplied numerically, with all subidentifiers in place before the part for the particular object and instance 🔢
What the user would set in expExpressionTable:
expExpression.2."me".4."hard" = "$1==1"
expExpressionValueType.2."me".4."hard" = unsigned32
expExpressionRowStatus.2."me"4."hard" = 'active'
expExpression.2."me".4."util" = "($1+$2)*800/$4/$3"
expExpressionValueType.2."me".4."util" = integer32
expExpressionDeltaInterval.2."me".4."util" = 6
expExpressionRowStatus.2."me"4."util" = 'active'What the user would set in expObjectTable:
expObjectID.2."me".4."hard".1 = ifConnectorPresent
expObjectWildcard.2."me".4."hard".1 = 'true'
expObjectSampleType.2."me".4."hard".1 = 'absoluteValue'
expObjectRowStatus.2."me".4."hard".1 = 'active'
expObjectID.2."me".4."util".1 = ifInOctets
expObjectWildcard.2."me".4."util".1 = 'true'
expObjectSampleType.2."me".4."util".1 = 'deltaValue'
expObjectConditional.2."me".4."util".1 =
expValueUnsigned32Val.4."hard".0.0
expObjectConditionalWildcard.2."me".4."util".1 = 'true'
expObjectDiscontinuityID.2."me".4."util".1 =
ifCounterDiscontinuityTime
expObjectDiscontinuityIDWildcard.2."me".4."util".1 = 'true'
expObjectRowStatus.2."me".4."util".1 = 'active'
expObjectID.2."me".4."util".2 = ifOutOctets
expObjectWildcard.2."me".4."util".2 = 'true'
expObjectSampleType.2."me".4."util".2 = 'deltaValue'
expObjectRowStatus.2."me".4."util".2 = 'active'
expObjectID.2."me".4."util".3 = ifSpeed
expObjectWildcard.2."me".4."util".3 = 'true'
expObjectSampleType.2."me".4."util".3 = 'absoluteValue'
expObjectRowStatus.2."me".4."util".3 = 'active'
expObjectID.2."me".4."util".4 = sysUpTime.0
expObjectWildcard.2."me".4."util".4 = 'false'
expObjectSampleType.2."me".4."util".4 = 'deltaValue'
expObjectRowStatus.2."me".4."util".4 = 'active'These settings will result in populating one column of expValueTable:
expValueInteger32Val.2."me".4."util".0.0.?The subidentifier represented by "?" above takes on a value of ifIndex and identifies a row for each ifIndex value where ifConnectorPresent is 'true' and the interface was present for two samples to provide a delta 🌟
This value could in turn be used as an event threshold [RFC2981] to watch for overutilization of all hardware network connections 🚨
3. Definitions 💅
DISMAN-EXPRESSION-MIB DEFINITIONS ::= BEGINokay bestie, we're picking up right where the MIB module definitions start, and the IMPORTS list is already giving main character energy 🎀 it pulls in everything the module needs from the SNMP frameworks, so we're setting the whole stage before anything happens 💅
IMPORTS
MODULE-IDENTITY, OBJECT-TYPE,
Integer32, Gauge32, Unsigned32,
Counter32, Counter64, IpAddress,
TimeTicks, mib-2, zeroDotZero FROM SNMPv2-SMI
RowStatus, TruthValue, TimeStamp FROM SNMPv2-TC
sysUpTime FROM SNMPv2-MIB
SnmpAdminString FROM SNMP-FRAMEWORK-MIB
MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF;
dismanExpressionMIB MODULE-IDENTITY
LAST-UPDATED "200010160000Z" -- 16 October 2000
ORGANIZATION "IETF Distributed Management Working Group"
CONTACT-INFO "Ramanathan Kavasseri
Cisco Systems, Inc.
170 West Tasman Drive,
San Jose CA 95134-1706.
Phone: +1 408 527 2446
Email: ramk@cisco.com"
DESCRIPTION
"The MIB module for defining expressions of MIB objects for
management purposes."
-- Revision History
REVISION "200010160000Z" -- 16 October 2000
DESCRIPTION "This is the initial version of this MIB.
Published as RFC 2982"
::= { mib-2 90 }
dismanExpressionMIBObjects OBJECT IDENTIFIER ::=
{ dismanExpressionMIB 1 }
expResource OBJECT IDENTIFIER ::= { dismanExpressionMIBObjects 1 }
expDefine OBJECT IDENTIFIER ::= { dismanExpressionMIBObjects 2 }
expValue OBJECT IDENTIFIER ::= { dismanExpressionMIBObjects 3 }
--
-- Resource Control
--
expResourceDeltaMinimum OBJECT-TYPE
SYNTAX Integer32 (-1 | 1..600)
UNITS "seconds"
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The minimum expExpressionDeltaInterval this system will
accept. A system may use the larger values of this minimum to
lessen the impact of constantly computing deltas. For larger
delta sampling intervals the system samples less often and
suffers less overhead. This object provides a way to enforce
such lower overhead for all expressions created after it is
set.
The value -1 indicates that expResourceDeltaMinimum is
irrelevant as the system will not accept 'deltaValue' as a
value for expObjectSampleType.
Unless explicitly resource limited, a system's value for
this object should be 1, allowing as small as a 1 second
interval for ongoing delta sampling.
Changing this value will not invalidate an existing setting
of expObjectSampleType."
::= { expResource 1 }
expResourceDeltaWildcardInstanceMaximum OBJECT-TYPE
SYNTAX Unsigned32
UNITS "instances"
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"For every instance of a deltaValue object, one dynamic instance
entry is needed for holding the instance value from the previous
sample, i.e. to maintain state.
This object limits maximum number of dynamic instance entries
this system will support for wildcarded delta objects in
expressions. For a given delta expression, the number of
dynamic instances is the number of values that meet all criteria
to exist times the number of delta values in the expression.
A value of 0 indicates no preset limit, that is, the limit
is dynamic based on system operation and resources.
Unless explicitly resource limited, a system's value for
this object should be 0.
Changing this value will not eliminate or inhibit existing delta
wildcard instance objects but will prevent the creation of more
such objects.
An attempt to allocate beyond the limit results in expErrorCode
being tooManyWildcardValues for that evaluation attempt."
::= { expResource 2 }
expResourceDeltaWildcardInstances OBJECT-TYPE
SYNTAX Gauge32
UNITS "instances"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of currently active instance entries as
defined for expResourceDeltaWildcardInstanceMaximum."
::= { expResource 3 }
expResourceDeltaWildcardInstancesHigh OBJECT-TYPE
SYNTAX Gauge32
UNITS "instances"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The highest value of expResourceDeltaWildcardInstances
that has occurred since initialization of the managed
system."
::= { expResource 4 }
expResourceDeltaWildcardInstanceResourceLacks OBJECT-TYPE
SYNTAX Counter32
UNITS "instances"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of times this system could not evaluate an
expression because that would have created a value instance in
excess of expResourceDeltaWildcardInstanceMaximum."
::= { expResource 5 }
--
-- Definition
--
-- Expression Definition Table
--
expExpressionTable OBJECT-TYPE
SYNTAX SEQUENCE OF ExpExpressionEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table of expression definitions."
::= { expDefine 1 }
expExpressionEntry OBJECT-TYPE
SYNTAX ExpExpressionEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Information about a single expression. New expressions
can be created using expExpressionRowStatus.
To create an expression first create the named entry in this
table. Then use expExpressionName to populate expObjectTable.
For expression evaluation to succeed all related entries in
expExpressionTable and expObjectTable must be 'active'. If
these conditions are not met the corresponding values in
expValue simply are not instantiated.
Deleting an entry deletes all related entries in expObjectTable
and expErrorTable.
Because of the relationships among the multiple tables for an
expression (expExpressionTable, expObjectTable, and
expValueTable) and the SNMP rules for independence in setting
object values, it is necessary to do final error checking when
an expression is evaluated, that is, when one of its instances
in expValueTable is read or a delta interval expires. Earlier
checking need not be done and an implementation may not impose
any ordering on the creation of objects related to an
expression.
To maintain security of MIB information, when creating a new row in
this table, the managed system must record the security credentials
of the requester. These security credentials are the parameters
necessary as inputs to isAccessAllowed from the Architecture for
Describing SNMP Management Frameworks. When obtaining the objects
that make up the expression, the system must (conceptually) use
isAccessAllowed to ensure that it does not violate security.
The evaluation of the expression takes place under the
security credentials of the creator of its expExpressionEntry.
Values of read-write objects in this table may be changed
at any time."
INDEX { expExpressionOwner, expExpressionName }
::= { expExpressionTable 1 }
ExpExpressionEntry ::= SEQUENCE {
expExpressionOwner SnmpAdminString,
expExpressionName SnmpAdminString,
expExpression OCTET STRING,
expExpressionValueType INTEGER,
expExpressionComment SnmpAdminString,
expExpressionDeltaInterval Integer32,
expExpressionPrefix OBJECT IDENTIFIER,
expExpressionErrors Counter32,
expExpressionEntryStatus RowStatus
}
expExpressionOwner OBJECT-TYPE
SYNTAX SnmpAdminString (SIZE(0..32))
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The owner of this entry. The exact semantics of this
string are subject to the security policy defined by the
security administrator."
::= { expExpressionEntry 1 }
expExpressionName OBJECT-TYPE
SYNTAX SnmpAdminString (SIZE (1..32))
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The name of the expression. This is locally unique, within
the scope of an expExpressionOwner."
::= { expExpressionEntry 2 }expExpression OBJECT-TYPE
expExpression OBJECT-TYPE
SYNTAX OCTET STRING (SIZE (1..1024))
MAX-ACCESS read-create
STATUS currentokay so this is the big one 💅 the expression itself, the thing that actually gets evaluated! it's basically a DisplayString (RFC 1903) but with a bigger max length, and the expression is written in ANSI C syntax, except the variable names are special. you're only allowed to use a subset of the C operators and functions, so don't get creative 🙈
variables look like a dollar sign plus an integer that matches an expObjectIndex. a valid example is:
($1-$5)*100expressions must not be recursive. an expression can use the results of another expression, but it must not contain any variable that's directly or indirectly a result of its own evaluation. the managed system must check for recursive expressions, so it's on them, not you 🫶
the only operators allowed are:
( )
- (unary)
+ - * / %
& | ^ << >> ~
! && || == != > >= < <=parentheses are just for grouping the expression. they are NOT for casting data types, so don't try 😭
the only constant types are:
int (32-bit signed)
long (64-bit signed)
unsigned int
unsigned long
hexadecimal
character
string
oida positive integer defaults to int, unless it's too big, then it's long ✨
everything except oid works just like ANSI C. a hexadecimal constant can end up as a scalar or as an array of 8-bit integers. strings go in double quotes and can have backslashed individual characters, just like ANSI C.
oid constants are made of 32-bit unsigned integers and have at least one period. examples:
0.
.0
1.3.6.1no extra leading or trailing subidentifiers get added to an OID constant. what you write is what you get 🦋
integer-typed objects are treated as 32- or 64-bit, signed or unsigned, depending on what fits. when you mix them, the rules are the same as ANSI C, including what type the result ends up being. a 32-bit value only gets promoted to 64 bits when it's in an operation with a 64-bit value. and there's no handling for larger values when overflow happens, so be careful 💀
relative to SNMP data types, a result becomes unsigned whenever the calculation uses any unsigned value, counters included. if you want the final value to be a counter, you have to explicitly use the counter32() or counter64() function (more on those below) 🔥
OCTET STRINGS and OBJECT IDENTIFIERs are treated as one-dimensional arrays of unsigned 8-bit integers and unsigned 32-bit integers, respectively.
IpAddresses are treated as 32-bit unsigned integers in network byte order. so the hex version of 255.0.0.0 is:
0xff000000conditional expressions give a 32-bit unsigned integer: 0 for false, 1 for true. when any arbitrary value is used as a boolean, 0 is false and anything non-zero is true 👑
here are the result types for each operator:
- for
<<and>>, the result is the same as the left hand operand. - for
&&,||,==,!=,<,<=,>, and>=, the result is always Unsigned32. - for unary
-, the result is always Integer32. - for
+,-,*,/,%,&,|, and^, the result gets promoted using these rules, from most to least preferred:- if the left hand and right hand operands are the same type, use that.
- if either side is Counter64, use that.
- if either side is IpAddress, use that.
- if either side is TimeTicks, use that.
- if either side is Counter32, use that.
- otherwise use Unsigned32.
the next bit says which operators work with which data types. any combination that isn't explicitly defined simply does not work 🙅♀️
- for all operators, any of these can be the left hand or right hand operand: Integer32, Counter32, Unsigned32, Counter64.
- the operators
+,-,*,/,%,<,<=,>, and>=work with TimeTicks. - the operators
&,|, and^work with IpAddress. - the operators
<<and>>work with IpAddress, but only as the left hand operand. - the
+operator concatenates two OCTET STRINGs or two OBJECT IDENTIFIERs. - the operators
&and|do bitwise operations on OCTET STRINGs. if the OCTET STRING happens to be a DisplayString, the results may be meaningless, but the agent system doesn't check this because some systems don't have that info. - the operators
<<and>>do bitwise operations on OCTET STRINGs that show up as the left hand operand.
the only functions defined are:
counter32
counter64
arraySection
stringBegins
stringEnds
stringContains
oidBegins
oidEnds
oidContains
average
maximum
minimum
sum
existsthe function definitions below name the data type each parameter should be, right in the parameter spot. the parameter has to be that type, and it can usually be a constant, a MIB object, a function, or an expression 🧚
counter32(integer): wrapped around an integer value, counter32 forces Counter32 as the data type.counter64(integer): works like counter32, except the resulting data type is 'counter64'.arraySection(array, integer, integer): picks out a piece of an array (so part of an OCTET STRING or OBJECT IDENTIFIER). the integer arguments range from 0 to 4,294,967,295. the first is the starting array index (one-dimensional) and the second is the ending index. a value of 0 means first or last element, respectively. if the first element is bigger than the array length, you get a 0 length result. if the second integer is less than or equal to the first, you also get 0 length. if the second is bigger than the array length, it means last element.stringBegins/Ends/Contains(octetString, octetString): looks for the second string (which can be a string constant) in the first one, and returns the one-dimensional array index where the match started. a return value of 0 means no match, aka boolean false.oidBegins/Ends/Contains(oid, oid): looks for the second OID (which can be an OID constant) in the first one, and returns the one-dimensional index where the match started. a return value of 0 means no match, aka boolean false.average/maximum/minimum(integer): calculates the average, minimum, or maximum value of the integer-valued object over multiple sample times. if the object disappears during any sample period, the accumulation and the resulting value object stop existing until the object shows up again, and then the calculation starts over 🔄sum(integerObject*): adds up all the available values of the wildcarded integer object, giving you an integer scalar. it must be used with caution, because it wraps on overflow with no notification 😬exists(anyTypeObject): checks that the object instance exists. a return value of 0 means NoSuchInstance, aka boolean false.
::= { expExpressionEntry 3 }expExpressionValueType OBJECT-TYPE
expExpressionValueType OBJECT-TYPE
SYNTAX INTEGER { counter32(1), unsigned32(2), timeTicks(3),
integer32(4), ipAddress(5), octetString(6),
objectId(7), counter64(8) }
MAX-ACCESS read-create
STATUS currentthis one picks the type of the expression value 🎀 exactly one of the value objects in expValueTable gets instantiated, and it's the one that matches this type. if the result of the expression can't be turned into this type, you get an invalidOperandType error. the default is counter32.
DEFVAL { counter32 }
::= { expExpressionEntry 4 }expExpressionComment OBJECT-TYPE
expExpressionComment OBJECT-TYPE
SYNTAX SnmpAdminString
MAX-ACCESS read-create
STATUS currenta little note 📝 it explains what the expression is for or what it means. it's just for humans, basically.
DEFVAL { ''H }
::= { expExpressionEntry 5 }expExpressionDeltaInterval OBJECT-TYPE
expExpressionDeltaInterval OBJECT-TYPE
SYNTAX Integer32 (0..86400)
UNITS "seconds"
MAX-ACCESS read-create
STATUS currentthis is the sampling interval for objects in the expression that have expObjectSampleType 'deltaValue' ⏱️ it does nothing if the expression has no deltaValue objects.
a value of 0 means no automated sampling. in that case, the delta is the difference from the last time the expression was evaluated. heads up, this can have unpredictable delta times if there are retries or multiple managers 🙈
a value above zero is the number of seconds between automated samples.
until the delta interval has expired once, the delta for the object basically isn't instantiated. evaluating the expression then behaves as if the object itself weren't instantiated.
delta values can potentially eat up a lot of system CPU and memory. delta state and processing have to keep running constantly, even if nobody's using the expression. the expression gets evaluated every delta interval, even if no application is reading those values. for wildcarded objects, that can be a huge amount of overhead 💀
delta intervals, external expression value sampling intervals, and delta intervals for expressions inside other expressions can have weird interactions, since they can't be synchronized perfectly. in general, an interval nested below another one must be enough shorter that the higher sample sees smooth, predictable behavior. so, for example, to keep the higher level from getting the same sample twice, the lower level should sample at least twice as fast as the higher level does 🌈
DEFVAL { 0 }
::= { expExpressionEntry 6 }expExpressionPrefix OBJECT-TYPE
expExpressionPrefix OBJECT-TYPE
SYNTAX OBJECT IDENTIFIER
MAX-ACCESS read-only
STATUS currentthis is an object prefix that helps an application figure out what instance indexing to use in expValueTable 🧚♀️ it saves the app from having to scan expObjectTable to find that prefix on its own.
see expObjectTable for info on wildcarded objects.
if the expValueInstance part of the value OID can be treated as a scalar (normally 0), then expExpressionPrefix is zero length. that means no OID at all. zero length means a null OID, not the OID 0.0 ✨
otherwise, the value of expExpressionPrefix is the expObjectID value of any one of the wildcarded objects for the expression. that's enough, because the rest (the instance fragment that matters for instancing the values) has to be the same for all of the wildcarded objects in the expression 🫶
::= { expExpressionEntry 7 }okay so this next bit is where the expression MIB gets really detailed 💅🫶
expExpressionErrors is basically a tally of how many times evaluating this expression has gone wrong ✨ 🙈
expExpressionErrors OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of errors encountered while evaluating this
expression.
Note that an object in the expression not being accessible,
is not considered an error. An example of an inaccessible
object is when the object is excluded from the view of the
user whose security credentials are used in the expression
evaluation. In such cases, it is a legitimate condition
that causes the corresponding expression value not to be
instantiated."
::= { expExpressionEntry 8 }
expExpressionEntryStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The control that allows creation and deletion of entries."
::= { expExpressionEntry 9 }Okay, and here's the important bit: an object being unreadable because of your security view is NOT counted as an error. 🔐 It's just a legit reason the expression value doesn't get created at all. Not drama, just vibes 🦋
Expression Error Table
Now the error table 🌸 It's where you find out what went wrong and when. Each entry only shows up when there's a matching expExpressionEntry and that expression has actually hit one of the error codes.
--
-- Expression Error Table
--
expErrorTable OBJECT-TYPE
SYNTAX SEQUENCE OF ExpErrorEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table of expression errors."
::= { expDefine 2 }
expErrorEntry OBJECT-TYPE
SYNTAX ExpErrorEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Information about errors in processing an expression.
Entries appear in this table only when there is a matching
expExpressionEntry and then only when there has been an
error for that expression as reflected by the error codes
defined for expErrorCode."
INDEX { expExpressionOwner, expExpressionName }
::= { expErrorTable 1 }
ExpErrorEntry ::= SEQUENCE {
expErrorTime TimeStamp,
expErrorIndex Integer32,
expErrorCode INTEGER,
expErrorInstance OBJECT IDENTIFIER
}
expErrorTime OBJECT-TYPE
SYNTAX TimeStamp
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of sysUpTime the last time an error caused a
failure to evaluate this expression."
::= { expErrorEntry 1 }
expErrorIndex OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The one-dimensioned character array index into
expExpression for where the error occurred. The value
zero indicates irrelevance."
::= { expErrorEntry 2 }expErrorCode is the big one 👑 It's an enum of eleven error codes, and the DESCRIPTION spells out when each one can show up. The (S) and (E) markers tell you whether it happens on a Set or during evaluation, so read those carefully, bestie 🧚
expErrorCode OBJECT-TYPE
SYNTAX INTEGER {
invalidSyntax(1),
undefinedObjectIndex(2),
unrecognizedOperator(3),
unrecognizedFunction(4),
invalidOperandType(5),
unmatchedParenthesis(6),
tooManyWildcardValues(7),
recursion(8),
deltaTooShort(9),
resourceUnavailable(10),
divideByZero(11)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The error that occurred. In the following explanations the
expected timing of the error is in parentheses. 'S' means
the error occurs on a Set request. 'E' means the error
occurs on the attempt to evaluate the expression either due to
Get from expValueTable or in ongoing delta processing.
invalidSyntax the value sent for expExpression is not
valid Expression MIB expression syntax
(S)
undefinedObjectIndex an object reference ($n) in
expExpression does not have a matching
instance in expObjectTable (E)
unrecognizedOperator the value sent for expExpression held an
unrecognized operator (S)
unrecognizedFunction the value sent for expExpression held an
unrecognized function name (S)
invalidOperandType an operand in expExpression is not the
right type for the associated operator
or result (SE)
unmatchedParenthesis the value sent for expExpression is not
correctly parenthesized (S)
tooManyWildcardValues evaluating the expression exceeded the
limit set by
expResourceDeltaWildcardInstanceMaximum
(E)
recursion through some chain of embedded
expressions the expression invokes itself
(E)
deltaTooShort the delta for the next evaluation passed
before the system could evaluate the
present sample (E)
resourceUnavailable some resource, typically dynamic memory,
was unavailable (SE)
divideByZero an attempt to divide by zero occurred
(E)
For the errors that occur when the attempt is made to set
expExpression Set request fails with the SNMP error code
'wrongValue'. Such failures refer to the most recent failure to
Set expExpression, not to the present value of expExpression
which must be either unset or syntactically correct.
Errors that occur during evaluation for a Get* operation return
the SNMP error code 'genErr' except for 'tooManyWildcardValues'
and 'resourceUnavailable' which return the SNMP error code
'resourceUnavailable'."
::= { expErrorEntry 3 }
expErrorInstance OBJECT-TYPE
SYNTAX OBJECT IDENTIFIER
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The expValueInstance being evaluated when the error
occurred. A zero-length indicates irrelevance."
::= { expErrorEntry 4 }Last one in this table 🎀 expErrorInstance tells you which expValueInstance was being evaluated when things went sideways. Zero-length means it doesn't matter 🌈
Object Table
Here's where expressions get their ingredients 🍓 The object table lists every object an expression pulls from, one row at a time.
--
-- Object Table
--
expObjectTable OBJECT-TYPE
SYNTAX SEQUENCE OF ExpObjectEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table of object definitions for each expExpression.
Wildcarding instance IDs:
It is legal to omit all or part of the instance portion for
some or all of the objects in an expression. (See the
DESCRIPTION of expObjectID for details. However, note that
if more than one object in the same expression is wildcarded
in this way, they all must be objects where that portion of
the instance is the same. In other words, all objects may be
in the same SEQUENCE or in different SEQUENCEs but with the
same semantic index value (e.g., a value of ifIndex)
for the wildcarded portion."
::= { expDefine 3 }
expObjectEntry OBJECT-TYPE
SYNTAX ExpObjectEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Information about an object. An application uses
expObjectEntryStatus to create entries in this table while
in the process of defining an expression.
Values of read-create objects in this table may be
changed at any time."
INDEX { expExpressionOwner, expExpressionName, expObjectIndex }
::= { expObjectTable 1 }
ExpObjectEntry ::= SEQUENCE {
expObjectIndex Unsigned32,
expObjectID OBJECT IDENTIFIER,
expObjectIDWildcard TruthValue,
expObjectSampleType INTEGER,
expObjectDeltaDiscontinuityID OBJECT IDENTIFIER,
expObjectDiscontinuityIDWildcard TruthValue,
expObjectDiscontinuityIDType INTEGER,
expObjectConditional OBJECT IDENTIFIER,
expObjectConditionalWildcard TruthValue,
expObjectEntryStatus RowStatus
}
expObjectIndex OBJECT-TYPE
SYNTAX Unsigned32 (1..4294967295)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Within an expression, a unique, numeric identification for an
object. Prefixed with a dollar sign ('$') this is used to
reference the object in the corresponding expExpression."
::= { expObjectEntry 1 }
expObjectID OBJECT-TYPE
SYNTAX OBJECT IDENTIFIER
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The OBJECT IDENTIFIER (OID) of this object. The OID may be
fully qualified, meaning it includes a complete instance
identifier part (e.g., ifInOctets.1 or sysUpTime.0), or it
may not be fully qualified, meaning it may lack all or part
of the instance identifier. If the expObjectID is not fully
qualified, then expObjectWildcard must be set to true(1).
The value of the expression will be multiple
values, as if done for a GetNext sweep of the object.
An object here may itself be the result of an expression but
recursion is not allowed.
NOTE: The simplest implementations of this MIB may not allow
wildcards."
::= { expObjectEntry 2 }
expObjectIDWildcard OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"A true value indicates the expObjecID of this row is a wildcard
object. False indicates that expObjectID is fully instanced.
If all expObjectWildcard values for a given expression are FALSE,
expExpressionPrefix will reflect a scalar object (i.e. will
be 0.0).
NOTE: The simplest implementations of this MIB may not allow
wildcards."
DEFVAL { false }
::= { expObjectEntry 3 }
expObjectSampleType OBJECT-TYPE
SYNTAX INTEGER { absoluteValue(1), deltaValue(2),
changedValue(3) }
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The method of sampling the selected variable.
An 'absoluteValue' is simply the present value of the object.
A 'deltaValue' is the present value minus the previous value,
which was sampled expExpressionDeltaInterval seconds ago.
This is intended primarily for use with SNMP counters, which are
meaningless as an 'absoluteValue', but may be used with any
integer-based value.
A 'changedValue' is a boolean for whether the present value is
different from the previous value. It is applicable to any data
type and results in an Unsigned32 with value 1 if the object's
value is changed and 0 if not. In all other respects it is as a
'deltaValue' and all statements and operation regarding delta
values apply to changed values.
When an expression contains both delta and absolute values
the absolute values are obtained at the end of the delta
period."
DEFVAL { absoluteValue }
::= { expObjectEntry 4 }
sysUpTimeInstance OBJECT IDENTIFIER ::= { sysUpTime 0 }
expObjectDeltaDiscontinuityID OBJECT-TYPE
SYNTAX OBJECT IDENTIFIER
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The OBJECT IDENTIFIER (OID) of a TimeTicks, TimeStamp, or
DateAndTime object that indicates a discontinuity in the value
at expObjectID.
This object is instantiated only if expObjectSampleType is
'deltaValue' or 'changedValue'.
The OID may be for a leaf object (e.g. sysUpTime.0) or may
be wildcarded to match expObjectID.
This object supports normal checking for a discontinuity in a
counter. Note that if this object does not point to sysUpTime
discontinuity checking must still check sysUpTime for an overall
discontinuity.
If the object identified is not accessible no discontinuity
check will be made."
DEFVAL { sysUpTimeInstance }
::= { expObjectEntry 5 }
expObjectDiscontinuityIDWildcard OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"A true value indicates the expObjectDeltaDiscontinuityID of
this row is a wildcard object. False indicates that
expObjectDeltaDiscontinuityID is fully instanced.
This object is instantiated only if expObjectSampleType is
'deltaValue' or 'changedValue'.
NOTE: The simplest implementations of this MIB may not allow
wildcards."
DEFVAL { false }
::= { expObjectEntry 6 }Okay, that's the object table so far 🦋 expObjectSampleType is the one to watch: absoluteValue, deltaValue and changedValue each sample the object in a different way 💖
expObjectDiscontinuityIDType OBJECT-TYPE SYNTAX INTEGER { timeTicks(1), timeStamp(2), dateAndTime(3) } MAX-ACCESS read-create STATUS current DESCRIPTION "The value 'timeTicks' indicates the expObjectDeltaDiscontinuityID of this row is of syntax TimeTicks. The value 'timeStamp' indicates syntax TimeStamp. The value 'dateAndTime indicates syntax DateAndTime.
This object is instantiated only if expObjectSampleType is 'deltaValue' or 'changedValue'." DEFVAL { timeTicks } ::= { expObjectEntry 7 }
expObjectConditional OBJECT-TYPE SYNTAX OBJECT IDENTIFIER MAX-ACCESS read-create STATUS current DESCRIPTION "The OBJECT IDENTIFIER (OID) of an object that overrides whether the instance of expObjectID is to be considered usable. If the value of the object at expObjectConditional is 0 or not instantiated, the object at expObjectID is treated as if it is not instantiated. In other words, expObjectConditional is a filter that controls whether or not to use the value at expObjectID.
The OID may be for a leaf object (e.g. sysObjectID.0) or may be wildcarded to match expObjectID. If expObject is wildcarded and expObjectID in the same row is not, the wild portion of expObjectConditional must match the wildcarding of the rest of the expression. If no object in the expression is wildcarded but expObjectConditional is, use the lexically first instance (if any) of expObjectConditional.
If the value of expObjectConditional is 0.0 operation is as if the value pointed to by expObjectConditional is a non-zero (true) value.
Note that expObjectConditional can not trivially use an object of syntax TruthValue, since the underlying value is not 0 or 1." DEFVAL { zeroDotZero } ::= { expObjectEntry 8 }
expObjectConditionalWildcard OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-create STATUS current DESCRIPTION
"A true value indicates the expObjectConditional of this row is a wildcard object. False indicates that expObjectConditional is fully instanced.
NOTE: The simplest implementations of this MIB may not allow wildcards." DEFVAL { false } ::= { expObjectEntry 9 }
expObjectEntryStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "The control that allows creation/deletion of entries.
Objects in this table may be changed while expObjectEntryStatus is in any state." ::= { expObjectEntry 10 }
-- -- Expression Value Table --
expValueTable OBJECT-TYPE SYNTAX SEQUENCE OF ExpValueEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A table of values from evaluated expressions." ::= { expValue 1 }
expValueEntry OBJECT-TYPE SYNTAX ExpValueEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A single value from an evaluated expression. For a given instance, only one 'Val' object in the conceptual row will be instantiated, that is, the one with the appropriate type for the value. For values that contain no objects of expObjectSampleType 'deltaValue' or 'changedValue', reading a value from the table causes the evaluation of the expression for that value. For those that contain a 'deltaValue' or 'changedValue' the value read is as of the last sampling interval.
If in the attempt to evaluate the expression one or more of the necessary objects is not available, the corresponding entry in this table is effectively not instantiated.
To maintain security of MIB information, when creating a new row in this table, the managed system must record the security credentials of the requester. These security credentials are the parameters necessary as inputs to isAccessAllowed from [RFC2571]. When obtaining the objects that make up the expression, the system must (conceptually) use isAccessAllowed to ensure that it does not violate security.
The evaluation of that expression takes place under the security credentials of the creator of its expExpressionEntry.
To maintain security of MIB information, expression evaluation must take place using security credentials for the implied Gets of the objects in the expression as inputs (conceptually) to isAccessAllowed from the Architecture for Describing SNMP Management Frameworks. These are the security credentials of the creator of the corresponding expExpressionEntry." INDEX { expExpressionOwner, expExpressionName, IMPLIED expValueInstance } ::= { expValueTable 1 }
ExpValueEntry ::= SEQUENCE { expValueInstance OBJECT IDENTIFIER, expValueCounter32Val Counter32, expValueUnsigned32Val Unsigned32, expValueTimeTicksVal TimeTicks, expValueInteger32Val Integer32, expValueIpAddressVal IpAddress, expValueOctetStringVal OCTET STRING, expValueOidVal OBJECT IDENTIFIER, expValueCounter64Val Counter64 }
expValueInstance OBJECT-TYPE SYNTAX OBJECT IDENTIFIER MAX-ACCESS not-accessible STATUS current DESCRIPTION "The final instance portion of a value's OID according to the wildcarding in instances of expObjectID for the expression. The prefix of this OID fragment is 0.0, leading to the following behavior.
If there is no wildcarding, the value is 0.0.0. In other words, there is one value which standing alone would have been a scalar with a 0 at the end of its OID.
If there is wildcarding, the value is 0.0 followed by a value that the wildcard can take, thus defining one value instance for each real, possible value of the wildcard. So, for example, if the wildcard worked out to be an ifIndex, there is an expValueInstance for each applicable ifIndex." ::= { expValueEntry 1 }
expValueCounter32Val OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value when expExpressionValueType is 'counter32'." ::= { expValueEntry 2 }
expValueUnsigned32Val OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value when expExpressionValueType is 'unsigned32'." ::= { expValueEntry 3 }
expValueTimeTicksVal OBJECT-TYPE SYNTAX TimeTicks MAX-ACCESS read-only STATUS current DESCRIPTION "The value when expExpressionValueType is 'timeTicks'." ::= { expValueEntry 4 }
expValueInteger32Val OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value when expExpressionValueType is 'integer32'." ::= { expValueEntry 5 }
expValueIpAddressVal OBJECT-TYPE SYNTAX IpAddress MAX-ACCESS read-only STATUS current DESCRIPTION "The value when expExpressionValueType is 'ipAddress'." ::= { expValueEntry 6 }
expValueOctetStringVal OBJECT-TYPE SYNTAX OCTET STRING (SIZE (0..65536)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value when expExpressionValueType is 'octetString'." ::= { expValueEntry 7 }
expValueOidVal OBJECT-TYPE SYNTAX OBJECT IDENTIFIER MAX-ACCESS read-only STATUS current DESCRIPTION "The value when expExpressionValueType is 'objectId'." ::= { expValueEntry 8 }
expValueCounter64Val OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "The value when expExpressionValueType is 'counter64'." ::= { expValueEntry 9 }
-- -- Conformance --
dismanExpressionMIBConformance OBJECT IDENTIFIER ::= { dismanExpressionMIB 3 } dismanExpressionMIBCompliances OBJECT IDENTIFIER ::= { dismanExpressionMIBConformance 1 } dismanExpressionMIBGroups OBJECT IDENTIFIER ::= { dismanExpressionMIBConformance 2 }
-- Compliance
dismanExpressionMIBCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "The compliance statement for entities which implement the Expression MIB." MODULE -- this module MANDATORY-GROUPS { dismanExpressionResourceGroup, dismanExpressionDefinitionGroup, dismanExpressionValueGroup }
OBJECT expResourceDeltaMinimum SYNTAX Integer32 (-1 | 60..600) DESCRIPTION "Implementation need not allow deltas or it may implement them and restrict them to higher values."
OBJECT expObjectSampleType WRITE-SYNTAX INTEGER { absoluteValue(1) } DESCRIPTION "Implementation may disallow deltas calculation or change detection."
OBJECT expObjectIDWildcard WRITE-SYNTAX INTEGER { false(2) } DESCRIPTION "Implementation may allow wildcards."
OBJECT expObjectDiscontinuityIDWildcard WRITE-SYNTAX INTEGER { false(2) } DESCRIPTION "Implementation need not allow wildcards."
OBJECT expObjectConditionalWildcard WRITE-SYNTAX INTEGER { false(2) } DESCRIPTION "Implementation need not allow deltas wildcards."
::= { dismanExpressionMIBCompliances 1 }
-- Units of Conformance
dismanExpressionResourceGroup OBJECT-GROUP OBJECTS { expResourceDeltaMinimum, expResourceDeltaWildcardInstanceMaximum, expResourceDeltaWildcardInstances, expResourceDeltaWildcardInstancesHigh, expResourceDeltaWildcardInstanceResourceLacks } STATUS current DESCRIPTION "Expression definition resource management." ::= { dismanExpressionMIBGroups 1 }
dismanExpressionDefinitionGroup OBJECT-GROUP OBJECTS { expExpression, expExpressionValueType, expExpressionComment, expExpressionDeltaInterval, expExpressionPrefix, expExpressionErrors, expExpressionEntryStatus,
expErrorTime, expErrorIndex, expErrorCode, expErrorInstance, expObjectID, expObjectIDWildcard, expObjectSampleType, expObjectDeltaDiscontinuityID, expObjectDiscontinuityIDWildcard, expObjectDiscontinuityIDType, expObjectConditional, expObjectConditionalWildcard, expObjectEntryStatus } STATUS current DESCRIPTION "Expression definition." ::= { dismanExpressionMIBGroups 2 }
dismanExpressionValueGroup OBJECT-GROUP OBJECTS { expValueCounter32Val, expValueUnsigned32Val, expValueTimeTicksVal, expValueInteger32Val, expValueIpAddressVal, expValueOctetStringVal, expValueOidVal, expValueCounter64Val } STATUS current DESCRIPTION "Expression value." ::= { dismanExpressionMIBGroups 3 }
END
4. Intellectual Property ✨
okay so the IETF is NOT saying whether any patents or other rights apply to the tech in this doc, or whether you could even get a license for them 🫠 it also isn't claiming it looked for any. for how the IETF handles rights in standards-track and standards-related docs, check out BCP-11 📚 copies of any rights claims that were made available for publication, plus any license assurances that will be available, or the result of trying to get a general license or permission for implementers or users of this spec to use those proprietary rights, can all be requested from the IETF Secretariat 💌
the IETF also invites anyone to tell it about any copyrights, patents, patent applications, or other proprietary rights that might cover technology needed to practice this standard 🦋 send that info to the IETF Executive Director, bestie 💜
5. Acknowledgements 🫶
this MIB has a LOT of help from the Distributed Management Design Team (Andy Bierman, Maria Greene, Bob Stewart, and Steve Waldbusser) 👑 and the Cisco folks who built the first implementation, who are absolutely iconic 🔥
6. References 📖
- [RFC2571] Harrington, D., Presuhn, R. and B. Wijnen, "An Architecture Describing SNMP Management Frameworks", RFC 2571, April 1999.
- [RFC1155] Rose, M. and K. McCloghrie, "Structure and Identification of Management Information for TCP/IP-based Internets", STD 16, RFC 1155, May 1990.
- [RFC1212] Rose, M. and K. McCloghrie, "Concise MIB Definitions", STD 16, RFC 1212, March 1991.
- [RFC1215] Rose, M., "A Convention for Defining Traps for use with the SNMP", RFC 1215, March 1991.
- [RFC2578] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M. and S. Waldbusser, "Structure of Management Information Version 2 (SMIv2)", STD 58, RFC 2578, April 1999.
- [RFC2579] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M. and S. Waldbusser, "Textual Conventions for SMIv2", STD 58, RFC 2579, April 1999.
- [RFC2580] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M. and S. Waldbusser, "Conformance Statements for SMIv2", STD 58, RFC 2580, April 1999.
- [RFC1157] Case, J., Fedor, M., Schoffstall, M. and J. Davin, "Simple Network Management Protocol", STD 15, RFC 1157, May 1990.
- [RFC1901] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Introduction to Community-based SNMPv2", RFC 1901, January 1996.
- [RFC1906] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Transport Mappings for Version 2 of the Simple Network Management Protocol (SNMPv2)", RFC 1906, January 1996.
- [RFC2572] Case, J., Harrington D., Presuhn R. and B. Wijnen, "Message Processing and Dispatching for the Simple Network Management Protocol (SNMP)", RFC 2572, April 1999.
- [RFC2574] Blumenthal, U. and B. Wijnen, "User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3)", RFC 2574, April 1999.
- [RFC1905] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Protocol Operations for Version 2 of the Simple Network Management Protocol (SNMPv2)", RFC 1905, January 1996.
- [RFC2573] Levi, D., Meyer, P. and B. Stewart, "SNMPv3 Applications", RFC 2573, April 1999.
- [RFC2575] Wijnen, B., Presuhn, R. and K. McCloghrie, "View-based Access Control Model (VACM) for the Simple Network Management Protocol (SNMP)", RFC 2575, April 1999.
- [RFC2570] Case, J., Mundy, R., Partain, D. and B. Stewart, "Introduction to Version 3 of the Internet-standard Network Management Framework", RFC 2570, April 1999.
- [RFC1903] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Coexistence between Version 1 and version 2 of the Internet-standard Network Management Framework", RFC 1903, January 1996.
- [RFC2981] Stewart, B., "Event MIB", RFC 2981, October 2000.
- [PracPersp] Leinwand, A. and K. Fang, "Network Management: A Practical Perspective", Addison-Wesley Publishing Company, Inc., 1993.
7. Security Considerations 🔐
okay this part is SERIOUS bestie 😭 the Expression MIB has two security sides: keeping expressions safe from being messed with or used without permission, and keeping safe the objects that get used to calculate the expressions 🛡️
the security of expression definitions and results depends on the expression owner (expExpressionOwner) 👑 with view-based access control [RFC2575], a network manager can decide who gets what level of access to which expressions 💅
access control for the objects inside the expression depends on the security credentials of the expression creator 🧠 these are the credentials used to get the objects needed to evaluate the expression. they're also the credentials that were used to set expExpressionRowStatus for that expression to 'active', as the managed system recorded it 📝
which means the results of an expression could end up available to someone who can't access the raw data that went into them 😬 that could be totally legit, or a real security violation, depending on the situation and the security policy. no cap, it's a "know your context" moment 🔍
to make it easier for a security administrator to set up access control for this MIB itself using the View-Based Access Control Model (VACM) defined in RFC 2575 [RFC2575], on tables where lots of users might need to independently create or change entries, the initial index is used as an "owner index" 🎀 this initial index has the syntax SnmpAdminString, so it can easily be mapped to a securityName or groupName as defined in VACM, following whatever security policy you have 🦋
all the entries in related tables that belong to a particular user will have the same value for this initial index 🌸 for one user's entries in a given table, the object identifiers for that info will share the same subidentifiers (except for the "column" subidentifier) all the way up to the end of the encoded owner index. to set VACM so it lets that part of the table be accessed, you'd create vacmViewTreeFamilyTable entries where vacmViewTreeFamilySubtree includes the owner index portion, and vacmViewTreeFamilyMask "wildcards" the column subidentifier ✨ more elaborate setups are possible too 🧚
8. Author's Address 🏡
Bob Stewart
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
U.S.A.9. Editor's Address 💌
Ramanathan Kavasseri
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
U.S.A.
Phone: +1 408 527 2446
EMail: ramk@cisco.com10. Full Copyright Statement ©️
Copyright (C) The Internet Society (2000). All Rights Reserved. 🌈
this document and translations of it can be copied and handed out to others 🦋 derivative works that comment on or explain it, or help with implementing it, can be made, copied, published, and distributed, in whole or in part, with no real restrictions, as long as the copyright notice and this paragraph are included on all those copies and derivative works 💜 BUT this document itself can't be changed in any way, like taking out the copyright notice or the references to the Internet Society or other Internet orgs. the exceptions are when it's needed to develop Internet standards (in which case the Internet Standards process copyright procedures must be followed), or when it's being translated into languages other than English 🌸
the limited permissions above are perpetual and won't be revoked by the Internet Society or its successors or assigns ✨
this document and the info in it is provided on an "AS IS" basis, and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE 🙈
Acknowledgement 🍓
Funding for the RFC Editor function is currently provided by the Internet Society 💖
📦 where this page comes from
- ietf: rfc2982 2000-10
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms