RFC 3729
Application Performance Measurement MIB
RFC 3729: Application Performance Measurement MIB ✨
Okay bestie, this is RFC 3729 💖 and it's a Standards Track doc, so it's an official protocol spec, not just vibes. It was written by S. Waldbusser for the Network Working Group and published in March 2004 🎀. Its header doesn't list anything it obsoletes or updates.
Status of This Memo 📜
This document specifies an Internet standards track protocol for the Internet community, and asks for discussion and suggestions for improvements. For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1) 🌸. Distribution of this memo is unlimited 🦋.
Copyright Notice ©️
Copyright (C) The Internet Society (2004). All Rights Reserved 💜.
Abstract 🌈
This memo defines a piece of the Management Information Base (MIB) that network management protocols use in TCP/IP-based internets 🧚. Specifically, it defines objects for measuring application performance as experienced by end-users, which is the whole point, honestly 👑.
Table of Contents 📚
1. The Internet-Standard Management Framework . . . . . . . . . . 2
2. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
2.1. Report Aggregation . . . . . . . . . . . . . . . . . . . 4
2.2. AppLocalIndex Linkages . . . . . . . . . . . . . . . . . 8
2.3. Measurement Methodology. . . . . . . . . . . . . . . . . 10
2.4. Instrumentation Architectures. . . . . . . . . . . . . . 10
2.4.1. Application Directory Caching. . . . . . . . . . 10
2.4.2. Push Model . . . . . . . . . . . . . . . . . . . 11
2.5. Structure of this MIB Module . . . . . . . . . . . . . . 12
2.5.1. The APM Application Directory Group. . . . . . . 13
2.5.2. The APM User Defined Applications Group. . . . . 13
2.5.3. The APM Report Group . . . . . . . . . . . . . . 13
2.5.4. The APM Transaction Group. . . . . . . . . . . . 13
2.5.5. The APM Exception Group. . . . . . . . . . . . . 14
2.5.6. The APM Notification Group . . . . . . . . . . . 14
3. Definitions. . . . . . . . . . . . . . . . . . . . . . . . . . 14
4. Security Considerations. . . . . . . . . . . . . . . . . . . . 58
5. References . . . . . . . . . . . . . . . . . . . . . . . . . . 60
5.1. Normative References . . . . . . . . . . . . . . . . . . 60
5.2. Informative References . . . . . . . . . . . . . . . . . 60
6. Author's Address . . . . . . . . . . . . . . . . . . . . . . . 60
7. Full Copyright Statement . . . . . . . . . . . . . . . . . . . 611. The Internet-Standard Management Framework 🗂️
If you want the full tea on the documents that describe the current Internet-Standard Management Framework, go to section 7 of RFC 3410 [8] 🔍.
Managed objects live in a virtual information store called the Management Information Base, or MIB 💾. MIB objects are usually accessed through the Simple Network Management Protocol (SNMP). The objects in the MIB are defined using the mechanisms in the Structure of Management Information (SMI) 🧩. This memo specifies a MIB module that complies with SMIv2, which is described in STD 58, RFC 2578 [1], STD 58, RFC 2579 [2] and STD 58, RFC 2580 [3] ✨.
2. Overview 🦋
This document continues the architecture created in the RMON MIB [7] by analysing application performance as experienced by end-users 💅.
Application performance measurement tracks the quality of service that applications deliver to end-users 🎀. From that angle, you get a true end-to-end view of the IT infrastructure, combining the performance of the application, desktop, network and server, plus any positive or negative interactions between those components 🫶.
Okay, so despite all the technically sophisticated ways we can measure networking and system resources 🤓, human end-users only notice two things about an application 😭:
- Availability: The percentage of the time that the application is ready to give a user service.
- Responsiveness: The speed at which the application delivers the requested service.
A transaction is an action a user starts that kicks off and completes a distributed processing function 🌸. It begins when a user initiates a request for service (i.e., pushing a submit button) and ends when the work is done (i.e., information is provided or a confirmation is delivered) 💖. A transaction is the fundamental item the APM MIB measures 👑.
A failed transaction is one that doesn't provide the service the end user asked for 💀. That's true whether it failed because of a processing failure or a transport failure 🙈.
An application protocol (e.g., POP3) can have different commands, or application "verbs" (e.g., POP3 Login and POP3 Retrieval) 🍓. It's often super interesting to monitor these verbs separately, because:
- The verbs may have widely differing performance characteristics (in fact, some may be response time oriented while others are throughput oriented) 🔥.
- The verbs have varying business significance 💼.
- It gives you more granularity about exactly what might be performing poorly 🔍.
This MIB module lets you measure a parent application, its component verbs, or both 🧚. If you monitor both, you can watch the top-level application and then drill down into the verbs when trouble shows up, to learn which subcomponents are in trouble 🕵️♀️. Each application verb gets registered separately in the Protocol Directory [5] [6] as a child of its parent application 🌈.
Application protocols implement one of three types of transactions: transaction-oriented, throughput-oriented, or streaming-oriented ✨. The availability metric is the same for all three, but the responsiveness metric changes:
- Transaction-Oriented: These transactions have a fairly constant workload for every transaction 💅. To whatever degree the workload varies, it doesn't vary based on the amount of data to be transferred, but on the parameters of the transaction 🎀. The responsiveness metric here is application response time: the elapsed time between the user's request for service (e.g., pushing the submit button) and the completion of the request (e.g., displaying the results), measured in milliseconds ⏱️. This is commonly called end-user response time 💖.
- Throughput-Oriented: These transactions have widely varying workloads based on the amount of data requested 📦. The responsiveness metric for throughput-oriented applications is kilobits per second 🚀.
- Streaming-Oriented: These transactions deliver data at a constant metered rate regardless of spare capacity in the networking and computing infrastructure 🎶. But when the infrastructure can't deliver data at that speed, service can be interrupted or degraded 😱. The responsiveness metric for streaming-oriented applications is the signal quality ratio of the time the service is degraded or interrupted to the total service time 🌊. This metric is measured in parts per million 💜.
2.1. Report Aggregation 📊✨
okay so this MIB Module is all about aggregating measurements into higher level summaries 🧁 aka the big-picture stats bestie actually wants to look at 👀
Every transaction is identified by its application, server, and client 🎀, and each one has an availability measure AND a responsiveness measure 💖. The right responsiveness measure depends on the vibe of the app: it's different for transaction-oriented, throughput-oriented, or streaming-oriented apps 🦋. For example, in a 5 minute period, you might record stuff like this 👇
Application Client Server Successful Responsiveness
HTTP Jim Sales 1 6 sec.
SAP/R3 Jane Finance 1 17 sec.
HTTP Joe HR 0 -
FTP Jim FTP 1 212 Kbps
HTTP Joe HR 1 25 sec.
RealVideo Joe Videoconf 1 100.0%
HTTP Jane HR 1 5 sec.These transactions can be aggregated a bunch of ways 💅 to get statistical summaries, like summarizing all HTTP transactions, or all HTTP transactions to the HR Server 🌸. BUT data from different applications may not be summarized together, because:
- The performance characteristics of different applications differ widely enough to make statistical analysis meaningless 😭.
- The responsiveness metrics of different applications may be different, which makes a statistical analysis impossible (in other words, one application may be transaction-oriented while another is throughput-oriented) 🙈.
Aggregating transactions collected over a period needs an aggregation algorithm 🧠. In this MIB Module, transaction aggregation always gives you these statistics:
TransactionCount: The total number of transactions during this period 🔢.SuccessfulTransactions: The total number of transactions that were successful ✅. The management station can work out the percent success by dividingSuccessfulTransactionsby theTransactionCount🧮.ResponsivenessMean: The average of the responsiveness metric for all aggregated transactions that completed successfully 🫶.ResponsivenessMin: The minimum responsiveness metric for all aggregated transactions that completed successfully 📉.ResponsivenessMax: The maximum responsiveness metric for all aggregated transactions that completed successfully 📈.ResponsivenessBx: The count of successful transactions whose responsiveness metric fell into the range specified forBx🪣. There are 7 buckets specified. Because the performance of different applications varies so much, the bucket ranges are set separately for each application (in theapmAppDirTable) so they can be tuned to each app's typical performance 🎯.
For example, when you aggregate the previous set of transactions by application, you get this (for simplicity it only shows TransactionCount, SuccessfulTransactions, and ResponsivenessMean) 💕:
Application Count Successful ResponsivenessMean
HTTP 4 3 12 sec.
SAP/R3 1 1 17 sec.
FTP 1 1 212 Kbps.
RealVideo 1 1 100.0%There are four different types of aggregation 🦋.
The flows(1) aggregation is the simplest 🍓. All transactions that share common application/server/client 3-tuples get aggregated together, giving you a set of metrics for every unique 3-tuple.
The clients(2) aggregation does somewhat more aggregation (so fewer records come out) 🧚. All transactions that share common application/client tuples get aggregated together, giving you a set of metrics for every unique tuple.
The servers(3) aggregation usually does even more aggregation (so, fewer records again) 💜. All transactions that share common application/server tuples get aggregated together, giving you a set of metrics for every unique tuple.
The applications(4) aggregation does the MOST aggregation (so you end up with the fewest records) 👑. All transactions that share a common application get aggregated together, giving you a set of metrics for every unique application.
For example, if these transactions happened in a 5 minute period 🌈:
Actual Transactions:
# App Client Server Successful Responsiveness
1 HTTP Jim CallCtr N -
2 HTTP Jim HR Y 12 sec.
3 HTTP Jim Sales Y 7 sec.
4 HTTP Jim CallCtr Y 5 sec.
5 Email Jim Pop3 Y 12 sec.
6 HTTP Jane CallCtr Y 3 sec.
7 SAP/R3 Jane Finance Y 19 sec.
8 Email Jane Pop3 Y 16 sec.
9 HTTP Joe HR Y 18 sec.The flows(1) aggregation gives you this table. Note that the first record (HTTP/Jim/CallCtr) is the aggregation of transactions #1 and #4 🔥:
Flow Aggregation:
App Client Server Count Succe- Rsp Rsp Rsp RspB1 RspB2
ssful Mean Min Max
HTTP Jim CallCtr 2 1 5 5 5 1 0
HTTP Jim HR 1 1 12 12 12 0 1
HTTP Jim Sales 1 1 7 7 7 1 0
Email Jim Pop3 1 1 12 12 12 0 1
HTTP Jane CallCtr 1 1 3 3 3 1 0
SAP/R3 Jane Finance 1 1 19 19 19 0 1
Email Jane Pop3 1 1 16 16 16 0 1
HTTP Joe HR 1 1 18 18 18 0 1(Note: Columns above such as RspMean and RspB1 are abbreviations for objects in the apmReportTable 📝)
The clients(2) aggregation gives you this table. Note that the first record (HTTP/Jim) is the aggregate of transactions #1, #2, #3 and #4 💁♀️:
Client Aggregation:
App Client Count Succe- Rsp Rsp Rsp RspB1 RspB2 ...
ssful Mean Min Max
HTTP Jim 4 3 8 5 12 2 1
Email Jim 1 1 12 12 12 0 1
HTTP Jane 1 1 3 3 3 1 0
SAP/R3 Jane 1 1 19 19 19 0 1
Email Jane 1 1 16 16 16 0 1
HTTP Joe 1 1 18 18 18 0 1The servers(3) aggregation gives you this table. Note that the first record (HTTP/CallCtr) is the aggregation of transactions #1, #4 and #6 🫧:
Server Aggregation:
App Server Count Succe- Rsp Rsp Rsp RspB1 RspB2 ...
ssful Mean Min Max
HTTP CallCtr 3 2 4 3 5 2 0
HTTP HR 2 2 15 12 18 0 2
HTTP Sales 1 1 7 7 7 1 0
Email Pop3 2 2 14 12 16 0 2
SAP/R3 Finance 1 1 19 19 19 0 1The applications(4) aggregation gives you this table. Note that the first record (HTTP) is the aggregate of transactions #1, #2, #3, #5, #6 and #9 🎉:
Application Aggregation:
App Count Succe- Rsp Rsp Rsp RspB1 RspB2 ...
ssful Mean Min Max
HTTP 6 5 9 3 18 3 2
Email 2 2 14 12 16 0 2
SAP/R3 1 1 19 19 19 0 1The apmReportControlTable keeps a historical set of the last 'X' reports 🗂️, combining the historical records found in history tables with the periodic snapshots found in TopN tables. Conceptually, the components are:
apmReportControlTable: Specifies data collection and summarization parameters, including the number of reports to keep and the size of each report ⚙️.apmReport: Each APM Report holds an aggregated list of records that represent data collected during one specific time period 📦.
An apmReportControlEntry causes a whole family of APM Reports to be created, where each report summarizes a different, successive, contiguous period of time ⏰.
While the conceptual model shows APM Reports as distinct entities, they're all entries in a single apmReportTable 🧩. Entries in report 'A' are separated from entries in report 'B' by different values of the apmReportIndex 🔖. Here's the picture 🖼️:
+-----------------------+
| |
| apmReportControlTable |
| | +-----------+
+-----------------------+ | |
+-----------+ |
| | |
+-----------+ |---+
| | |
+----------+ |---+
| | | apmReport
|apmReport |----+ +-----------------------+
| | |Thu Mar 30 12-1PM |
+----------+ | |
|CLNT SERV PROT stats |
| |
|Joe News HTTP data |
|Jan POP POP3 data |
|Jan POP SMTP data |
|Bob HR PSOFT data |
|... |
|... |
+-----------------------+2.2. AppLocalIndex Linkages
okay so let's look at a few example tables that show off some key points 💅✨
- How protocolDirEntries, apmHttpFilterEntries and apmUserDefinedAppEntries(not shown) all result in entries in the apmAppDirTable.
- How a single appLocalIndex may be represented multiple times in the apmAppDirTable and apmReportTable if the agent measures multiple responsiveness types for that application.
the column convention is the columns to the left of the | separator are index columns for the table 🎀
say we have these entries in the RMON2 protocolDirectory 🦋
protocolDirectory
ID (*) Parameters | LocalIndex ...
WWW None | 1
WWW Get None | 2
SAP/R3 None | 3(*) These IDs are represented here symbolically. Consult [5] for more detail in their format
and this entry in the apmHttpFilterTable 🌸
ApmHttpFilterTable
Index | AppLocalIndex ServerAddress URLPath MatchType ...
5 | 20 hr.example.com /expense prefix(3) ...then the apmAppDirTable gets populated with these entries 🧚
apmAppDir
AppLocalIndex ResponsivenessType | Config ...
1 transaction(1) | On ...
1 throughput(2) | On ...
2 transaction(1) | On ...
2 throughput(2) | On ...
3 transaction(1) | On ...
20 transaction(1) | On ...
20 throughput(2) | On ...the entries with appLocalIndex 1, 2 and 3 match the identically named entries in the protocolDirectory table 💖 appLocalIndex #1 gets 2 entries, one for WWW's transaction responsiveness and one for its throughput responsiveness. appLocalIndex #3 only gets a transaction entry because the agent doesn't measure throughput responsiveness for SAP/R3 (probably because it isn't very meaningful, ngl 🙈). And appLocalIndex #20 matches the entry in the apmHttpFilterTable and has both transaction and throughput responsiveness measurements available 👑
if a report was set up using application aggregation, the entries might look like this 📊
apmReportTable
CtlIndex Index AppLocalIdx ResponsivenessType | TransactionCount ...
1 1 1 transaction(1) | counters...
1 1 1 throughput(2) | counters...
1 1 2 transaction(1) | counters...
1 1 2 throughput(2) | counters...
1 1 3 transaction(1) | counters...
1 1 20 transaction(1) | counters...
1 1 20 throughput(2) | counters...the index items protocolDirLocalIndex, apmReportServerAddress and apmReportClientID were left out of the apmReportTable example for brevity 🙈 they would've been equal to zero because of the application aggregation used here, so no drama
2.3. Measurement Methodology
there are so many ways to measure app performance (probe-based, client-based, synthetic-transaction, etc.) 🦋 this spec doesn't pick one for you, and any method is welcome as long as it meets the minimum requirements. the vibe is that conformance means the collected data has to match the semantics described here. a data collection methodology must be able to measure response time, throughput, streaming responsiveness and availability as specified, no exceptions bestie 💅
also, a transaction can run for a long time and still be totally successful 🥹 the measurement software shouldn't prematurely classify lengthy transactions as failures. it should wait as long as the client application will wait for a successful response ⏳✨
2.4. Instrumentation Architectures
different architectures and deployment strategies can be used to implement this spec 🧚 if you want a highly distributed setup (e.g., an agent per desktop), one or both of the two approaches below may be used to make it more practical 💜
2.4.1. Application Directory Caching
the manager needs a copy of the tables that define the Application Directory so it can interpret APM measurements 📚 in a highly distributed network with thousands of APM agents, that Application Directory is probably going to be the same on many, if not all, of the agents. repeatedly downloading it may be inefficient, which is giving "why are we doing this 😭"
the apmAppDirID object is a single object that identifies the configuration of all aspects of the Application Directory when it's equal to a well-known, registered configuration 🎀 so when a manager sees an apmAppDirID value it recognizes, it doesn't need to download the Application Directory from that agent. iconic behavior tbh 👑 in fact, the manager might discover a new registered Application Directory configuration on one agent and then reuse that configuration on another agent that shares the same apmAppDirID value.
application directory registrations are unique within an administrative domain 🌈 so an admin can make a custom application directory configuration without needing to assign it a globally-unique registration. very main character energy for admins ✨
2.4.2. Push Model
when APM agents are installed on "desktops" (including laptops), a few issues make polling kinda hard 😩
- Desktops often have dynamically-assigned addresses, so there's no long-lived address to poll.
- Desktops are not available as much as infrastructure components because of crashes, user-initiated reboots and shutdowns, and user control over monitoring software. so a desktop might not be available to answer a poll right when the manager is scheduled to poll it 💀
- Laptops that are connected via dialup connections are only sporadically connected and will routinely be unreachable when the manager is scheduled to poll.
so yeah, a push model is usually more appropriate for desktop-based agents 🫶 to make it work, the agent should follow these rules for deciding what data to send in notifications 🍓
- APM Reports: If an agent wishes to push APM reports to a manager, it must send:
apmAppDirIDapmNameTable(any data updated since the last push)
For each report the agent wishes to upload, it must send the entire apmReportControlEntry associated with that report and the associated entries in the apmReportTable that have changed since the last report.
- APM Transactions: If an agent wishes to push APM transactions to a manager, it must send:
apmAppDirIDapmNameTable(any data updated since the last push)apmTransactionTable(relevant entries)
- APM Exceptions: The agent must send:
apmAppDirIDapmNameTable(any data updated since the last push)apmTransactionEntry(of exception transaction)apmExceptionEntry(entry that generated exception)
[Note that this list supersedes the information in the OBJECTS clauses of the apmTransactionResponsivenessAlarm and apmTransactionUnsuccessfulAlarm when the agent is using a push model. This additional information eliminates the need for the manager to request additional data to understand the exception.] 🔥
the order of varbinds and where to split varbinds into PDUs is totally up to the agent 🧚
2.5. Structure of this MIB Module
the objects are sorted into these groups 🗂️
- APM Application Directory Group
- APM User Defined Applications Group
- APM Report Group
- APM Transaction Group
- APM Exception Group
- APM Notification Group
these groups are the basic unit of conformance 🎀 if an agent implements a group, then it must implement all objects in that group. this section gives an overview, but the authoritative reference for grouping and conformance info is in the MODULE-COMPLIANCE and OBJECT-GROUP macros later in this MIB Module 📖 the groups are also there to assign object identifiers and to give implementors a clear list of which objects they must implement 💜
2.5.1. The APM Application Directory Group
the APM Application Directory group holds configuration objects for every application or application verb monitored on this system. it consists of the apmAppDirTable 📚
2.5.2. The APM User Defined Applications Group
the APM User Defined Applications Group has objects that let you track applications or application verbs that aren't registered in the protocolDirTable 🌸 it consists of the apmHttpFilterTable and the apmUserDefinedAppTable.
2.5.3. The APM Report Group
the APM Report Group prepares regular reports that aggregate application performance by flow, by client, by server, or by application 📊 it consists of the apmReportControlTable and the apmReportTable.
2.5.4. The APM Transaction Group
the APM Transaction Group shows transactions that are currently in progress and ones that ended recently, along with their responsiveness metric ⏱️
transactions can be in this table for a very short time, since many last just a moment and an agent may not keep completed transactions very long 🙈 so polling this table isn't an effective way to grab every transaction, unless apmTransactionsHistorySize is suitably large for the transactions being monitored.
one big perk of this table is that it lets a management station check on the status of long-lived transactions 🫶 the apmReport and apmException mechanisms only act on transactions that have finished, so a network manager might not see the performance of long-lived transactions (like streaming apps, large data transfers, or (very) poorly performing transactions) for a while. honestly, by definition, apmReport and apmException only show a problem after nothing can be done about it 😭 this group consists primarily of the apmTransactionTable.
2.5.5. The APM Exception Group
the APM Exception Group generates immediate notifications for transactions that cross certain thresholds 🚨 the apmExceptionTable configures which thresholds get checked for which types of transactions. the apmTransactionResponsivenessAlarm notification is sent when a transaction has a responsiveness that crosses a threshold. the apmTransactionUnsuccessfulAlarm notification is sent when a transaction fails and exception checking was configured for it. this group consists primarily of the apmExceptionTable.
2.5.6. The APM Notification Group
the APM Notification Group has 2 notifications that get sent when thresholds in the APM Exception Table are exceeded 🌈
3. Definitions ✨
APM-MIB DEFINITIONS ::= BEGINokay so the imports are literally the guest list for this whole MIB 💅 SNMP framework, the textual conventions, and RMON bits all get pulled in right here 🎀
IMPORTS
MODULE-IDENTITY, OBJECT-TYPE,
NOTIFICATION-TYPE,
Counter32, Unsigned32 FROM SNMPv2-SMI
TEXTUAL-CONVENTION, RowStatus, TimeStamp,
TimeInterval, TruthValue, DateAndTime,
StorageType FROM SNMPv2-TC
MODULE-COMPLIANCE, OBJECT-GROUP,
NOTIFICATION-GROUP FROM SNMPv2-CONF
SnmpAdminString FROM SNMP-FRAMEWORK-MIB
rmon, OwnerString FROM RMON-MIB
protocolDirLocalIndex FROM RMON2-MIB;
-- Application Performance Measurement MIB
apm MODULE-IDENTITY
LAST-UPDATED "200402190000Z" -- February 19, 2004
ORGANIZATION "IETF RMON MIB Working Group"
CONTACT-INFO
"Author:
Steve Waldbusser
Phone: +1-650-948-6500
Fax : +1-650-745-0671
Email: waldbusser@nextbeacon.com
Working Group Chair:
Andy Bierman
Cisco Systems, Inc.
Postal: 170 West Tasman Drive
San Jose, CA USA 95134
Tel: +1 408 527-3711
E-mail: abierman@cisco.com
Working Group Mailing List: <rmonmib@ietf.org>
To subscribe send email to: <rmonmib-request@ietf.org>
"
DESCRIPTION
"The MIB module for measuring application performance
as experienced by end-users.
Copyright (C) The Internet Society (2004). This version of
this MIB module is part of RFC 3729; see the RFC itself for
full legal notices."
REVISION "200402190000Z" -- February 19, 2004
DESCRIPTION
"The original version of this MIB Module, published as
RFC3729."
::= { rmon 23 }
apmMibObjects OBJECT IDENTIFIER ::= { apm 1 }
apmConformance OBJECT IDENTIFIER ::= { apm 2 }
apmCompliances OBJECT IDENTIFIER ::= { apmConformance 1 }
apmGroups OBJECT IDENTIFIER ::= { apmConformance 2 }
AppLocalIndex ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"A locally arbitrary unique identifier associated with an
application or application verb.
All objects of type AppLocalIndex are assigned by the agent
out of a common number space. In other words, AppLocalIndex
values assigned to entries in one table must not overlap with
AppLocalIndex values assigned to entries in another
table. Further, every protocolDirLocalIndex value registered
by the agent automatically assigns the same value out of the
AppLocalIndex number space.
For example, if the protocolDirLocalIndex values { 1, 3, 5, 7 }
have been assigned, and the apmHttpFilterAppLocalIndex values
{ 6, 8, 9 } have been assigned:
- Assignment of new AppLocalIndex values must not use the
values { 1, 3, 5, 6, 7, 8, 9 }.
- AppLocalIndex values { 1, 3, 5, 7 } are automatically
assigned and are associated with the identical value of
protocolDirLocalIndex. In particular, an entry in the
apmAppDirTable indexed by a value provides further
information about a protocol indexed by the same value
in the protocolDirTable of RMON2.
The value for each supported application must remain constant
at least from one re-initialization of the entity's network
management system to the next re-initialization, except that
if an application is deleted and re-created, it must be
re-created with a new value that has not been used since the
last re-initialization.
The specific value is meaningful only within a given SNMP
entity. An AppLocalIndex value must not be re-used until the
next agent restart."
SYNTAX Unsigned32 (1..2147483647)
ProtocolDirNetworkAddress ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"A network level address whose semantics and encoding are
specified by an associated protocolDirLocalIndex
value. Objects of this type must specify which
protocolDirLocalIndex value is used. This value is encoded
according to the encoding rules for the identified
protocolDirectory entry.
For example, if the associated protocolDirLocalIndex indicates
an encapsulation of ip, this object is encoded as a length
octet of 4, followed by the 4 octets of the ip address,
in network byte order.
Objects of this type may allow this value to be the zero
length string. If so, they must identify they meaning of this
value."
SYNTAX OCTET STRING (SIZE(0..255))
DataSourceOrZero ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"Identifies the source of the data that the associated
function is configured to analyze. This source can be any
interface on this device.
In order to identify a particular interface, this
object shall identify the instance of the ifIndex
object, defined in [4], for the desired interface.
For example, if an entry were to receive data from
interface #1, this object would be set to ifIndex.1.
If the source of the data isn't an interface or cannot be
localized to an interface, this object would be set to 0.0"
REFERENCE "The DataSource textual convention is defined in
RFC 2021 [5]."
SYNTAX OBJECT IDENTIFIER
RmonClientID ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"A long-lived unique ID assigned to an end-system. This ID is
assigned by the agent using an implementation-specific
algorithm.
Because a client machine may be assigned multiple addresses
over any time period it can be difficult to attribute
behavior to a particular client based solely on its
address. A ClientID may be assigned to provide a more
stable handle for referencing that client. The entity that
assigns the ClientID may use various implementation
techniques to keep track of a client but if the assigning
entity is unable to track client address mappings, it may map
client identifiers to client addresses rather than to
distinct client machines.
This is named ClientID because it helps to solve a problem
seen in network clients (servers usually have well-known,
long-lived addresses). However, ClientID's may be assigned to
any end-system regardless of its role on the network."
SYNTAX Unsigned32 (0..4294967295)
TransactionAggregationType ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"Specifies one of 4 different techniques for aggregating
transactions.
The metrics for a single transaction are the responsiveness of
the transaction and whether the transaction succeeded (a
boolean). When such metrics are aggregated in this MIB Module,
these metrics are replaced by averages and distributions of
responsiveness and availability. The metrics describing
aggregates are constant no matter which type of aggregation is
being performed. These metrics may be found in the
apmReportTable.
The flows(1) aggregation is the simplest. All transactions
that share common application/server/client 3-tuples are
aggregated together, resulting in a set of metrics for all
such unique 3-tuples.
The clients(2) aggregation results in somewhat more
aggregation (i.e., fewer resulting records). All transactions
that share common application/client tuples are aggregated
together, resulting in a set of metrics for all such unique
tuples.
The servers(3) aggregation usually results in still more
aggregation (i.e., fewer resulting records). All transactions
that share common application/server tuples are aggregated
together, resulting in a set of metrics for all such unique
tuples.
The applications(4) aggregation results in the most
aggregation (i.e., the fewest resulting records). All
transactions that share a common application are aggregated
together, resulting in a set of metrics for all such unique
applications.
Note that it is not meaningful to aggregate applications, as
different applications have widely varying characteristics. As a
result, this set of aggregations is complete."
SYNTAX INTEGER {
flows(1), -- Least Aggregation
clients(2),
servers(3),
applications(4) -- Most Aggregation
}
-- The APM Application Directory Group
-- The Application Directory Table contains a record for every
-- application monitored by this agent. This table is also used to
-- configure whether or not an application will be measured and which
-- bucket boundaries will be used for the application.
--
-- The bucket boundaries define the break-points between bins of a
-- histogram analysis for that application. As an example of how this
-- works, consider an entry representing response-time for http.
-- If the boundaries are set as follows:
-- Boundary1: 500 milliseconds
-- Boundary2: 1 second
-- Boundary3: 2 seconds
-- Boundary4: 5
-- Boundary5: 15
-- Boundary6: 60
--
-- If the following measurements are made (all in milliseconds):
-- 377, 8645, 1300, 487, 1405, 775, 1115, 850, 945, 1054, 7745, 9380
--
-- A report run during this interval would report the following
-- counts:
-- Bucket1: 2
-- Bucket2: 3
-- Bucket3: 4
-- Bucket4: 0
-- Bucket5: 3
-- Bucket6: 0
-- Bucket7: 0that bucket example is literally the cutest histogram ever 🍓📊 the counts are all right there, bestie 🧚
Okay so the big one is the directory table 💖, and it's giving "admin has the final say" energy 👑. Here's the full definition, verbatim:
apmAppDirTable OBJECT-TYPE
SYNTAX SEQUENCE OF ApmAppDirEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The APM MIB directory of applications and application
verbs. The agent will populate this table with all
applications/verbs of any responsivenessType it has the
capability to monitor. Since the agent populates this table
with every entry it has the capability to monitor, the
entries in this table are read-write, allowing the management
station to modify parameters in this table but not to add new
entries or delete entries (however, entries may be
disabled). If new entries are added to the apmHttpFilterTable
or the apmUserDefinedAppTable, the agent will add the
corresponding entries to this table.
It is an implementation-dependent matter as to how the agent
sets these default parameters. For example, it may leave
certain entries in this table 'off(0)' if the agent developer
believes that combination will be infrequently used, allowing
a manager that needs that capability to set it to 'on(1)'.
Some applications are registered in the RMON2 protocol
directory and some are registered in other tables in this
MIB Module. Regardless of where an application is originally
registered, it is assigned an AppLocalIndex value that is the
primary index for this table.
The contents of this table affect all reports and exceptions
generated by this agent. Accordingly, modification of this
table should be performed by a manager acting in the role of
administrator. In particular, management software should not
require or enforce particular configuration of this table - it
should reflect the preferences of the site administrator, not
the software author. As a practical matter, this requires
management software to allow the administrator to configure
the values it will use so that it can be adapted to the site
policy."
::= { apmMibObjects 1 }So this table is the agent's little black book of every app and verb it can watch 📖✨. The agent fills it in with every app that has a responsiveness type it can monitor. Managers can edit the rows (they're read-write 🎀) but can't add or delete rows. The workaround is that rows can be disabled 🙈. If someone adds something to the apmHttpFilterTable or the apmUserDefinedAppTable, the agent adds the matching row here too.
How the defaults get set is up to the implementation. Maybe the agent leaves rarely used combos at off(0) so a manager who really needs one can flip it to on(1) 🔥.
Apps can be registered in the RMON2 protocol directory or in other tables of this MIB module, and either way each one gets an AppLocalIndex, which is the primary index here 🦋.
Also, everything in this table affects every report and exception the agent makes, so this is admin territory 👑. Management software shouldn't force a particular config. It should follow what the site admin wants, not what the software author thought was cute 💅. So the software needs to let the admin set the values it uses.
Next up is the entry definition, which is the actual row shape 🧚:
apmAppDirEntry OBJECT-TYPE
SYNTAX ApmAppDirEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The APM MIB directory of applications and application
verbs. An entry will exist in this table for all applications
for which application performance measurement is supported."
INDEX { apmAppDirAppLocalIndex,
apmAppDirResponsivenessType }
::= { apmAppDirTable 1 }
ApmAppDirEntry ::= SEQUENCE {
apmAppDirAppLocalIndex AppLocalIndex,
apmAppDirResponsivenessType INTEGER,
apmAppDirConfig INTEGER,
apmAppDirResponsivenessBoundary1 Unsigned32,
apmAppDirResponsivenessBoundary2 Unsigned32,
apmAppDirResponsivenessBoundary3 Unsigned32,
apmAppDirResponsivenessBoundary4 Unsigned32,
apmAppDirResponsivenessBoundary5 Unsigned32,
apmAppDirResponsivenessBoundary6 Unsigned32
}Each row is identified by two things together, the AppLocalIndex and the responsiveness type 💜. An entry shows up for every app that supports application performance measurement. The row has an AppLocalIndex, a responsiveness type, a config value, and six boundary values, one for each place where the buckets split.
Now the AppLocalIndex column:
apmAppDirAppLocalIndex OBJECT-TYPE
SYNTAX AppLocalIndex
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The AppLocalIndex assigned for this application Directory
entry."
::= { apmAppDirEntry 1 }This is just the AppLocalIndex given to that directory entry 🦋. You can't access it directly because it's the index.
Here's the responsiveness type, which picks how the app gets measured 🍓:
apmAppDirResponsivenessType OBJECT-TYPE
SYNTAX INTEGER {
transactionOriented(1),
throughputOriented(2),
streamingOriented(3)
}
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This object describes and configures the agent's support for
application performance measurement for this application.
There are 3 types of measurements for different types of
applications:
Transaction-Oriented applications have a fairly constant
workload to perform for all transactions. The responsiveness
metric for transaction-oriented applications is application
response time (from first request to final delivery of
service) and is measured in milliseconds. This is
commonly referred to as end-user response time.
Throughput-Oriented applications have widely varying workloads
based on the nature of the client request. In particular,
throughput-oriented applications vary widely in the amount of
data that must be transported to satisfy the request. The
responsiveness metric for throughput-oriented applications is
kilobits per second.
Streaming-Oriented applications deliver data at a constant
metered rate of speed regardless of the responsiveness of the
networking and computing infrastructure. This constant rate of
speed is generally specified to be below (sometimes well
below) the nominal capability of the infrastructure. However,
when the infrastructures cannot deliver data at this speed,
interruption of service or degradation of service can
result. The responsiveness metric for streaming-oriented
applications is the ratio of time that the service is degraded
or interrupted to the total service time. This metric is
measured in parts per million.
Note that for some applications, measuring more than one
responsiveness type may be interesting. For agents that wish
to support more than one measurement for a application, they
will populate this table with multiple entries for that
application, one for each type."
::= { apmAppDirEntry 2 }There are three flavours here 🌈:
- transactionOriented(1): the workload is pretty steady for every transaction. The metric is application response time, from the first request to the final delivery of service, in milliseconds. People also call this end-user response time ⏱️.
- throughputOriented(2): the workload swings a lot depending on the request, mostly in how much data has to move. The metric is kilobits per second 💨.
- streamingOriented(3): data flows at a steady metered speed no matter how the network and computers are doing 🎶. That speed is usually set below the infrastructure's nominal capacity, sometimes way below. When the infrastructure can't keep up, service can get interrupted or degraded 😭. The metric is the ratio of degraded or interrupted time to total service time, in parts per million.
Also, an app can be measured more than one way, and if an agent wants that, it adds one entry per type for the same app 🫶.
Next is the config object, the on/off switch 🔘:
apmAppDirConfig OBJECT-TYPE
SYNTAX INTEGER {
off(1),
on(2)
}
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"This object describes and configures support for application
performance measurement for this application.
If the value of this object is on(2), the agent supports
measurement of application performance metrics for this
application and is configured to measure such metrics for all
APM MIB functions and all interfaces. If the value of this
object is off(1), the agent supports measurement of
application performance for this application but is configured
to not measure these metrics for any APM MIB functions or
interfaces. Whenever this value changes from on(2) to off(1),
the agent shall delete all related entries in all tables in
this MIB Module.
The value of this object must persist across reboots."
::= { apmAppDirEntry 3 }on(2) means the agent measures that app for every APM MIB function and every interface 🌸. off(1) means the agent still supports the app, it just isn't measuring it for any APM function or interface 🙅♀️. Careful though, if it flips from on(2) to off(1), the agent has to delete all the related entries in all the tables in this MIB module 😱. And this value has to survive reboots 🔁.
Now the six boundaries. They're all the same shape, and each one sits between two buckets 🧁:
apmAppDirResponsivenessBoundary1 OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The boundary value between bucket1 and bucket 2. If this
value is modified, all entries in the apmReportTable must be
deleted by the agent.
The value of this object must persist across reboots."
::= { apmAppDirEntry 4 }
apmAppDirResponsivenessBoundary2 OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The boundary value between bucket2 and bucket 3. If this
value is modified, all entries in the apmReportTable must be
deleted by the agent.
The value of this object must persist across reboots."
::= { apmAppDirEntry 5 }
apmAppDirResponsivenessBoundary3 OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The boundary value between bucket3 and bucket 4. If this
value is modified, all entries in the apmReportTable must be
deleted by the agent.
The value of this object must persist across reboots."
::= { apmAppDirEntry 6 }
apmAppDirResponsivenessBoundary4 OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The boundary value between bucket4 and bucket 5. If this
value is modified, all entries in the apmReportTable must be
deleted by the agent.
The value of this object must persist across reboots."
::= { apmAppDirEntry 7 }
apmAppDirResponsivenessBoundary5 OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The boundary value between bucket5 and bucket 6. If this
value is modified, all entries in the apmReportTable must be
deleted by the agent.
The value of this object must persist across reboots."
::= { apmAppDirEntry 8 }
apmAppDirResponsivenessBoundary6 OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The boundary value between bucket6 and bucket 7. If this
value is modified, all entries in the apmReportTable must be
deleted by the agent.
The value of this object must persist across reboots."
::= { apmAppDirEntry 9 }So boundary 1 splits bucket 1 from bucket 2, boundary 2 splits bucket 2 from bucket 3, and it keeps going like that up to boundary 6, which splits bucket 6 from bucket 7 🪜. They're all read-write and all unsigned 32-bit. Here's the drama 🙀: if you change any of them, the agent has to wipe every entry in the apmReportTable. And just like the config, they persist across reboots 💾.
Last up is a scalar that sits next to the directory table 🕰️:
-- Scalars related to the Application Directory table
apmBucketBoundaryLastChange OBJECT-TYPE
SYNTAX TimeStamp
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of sysUpTime the last time that any bucket boundary
in any appDirEntry was changed. This object can help to
determine if two managers are both trying to enforce different
configurations of this table."
::= { apmMibObjects 2 }This one is read-only and tells you the sysUpTime of the last time any bucket boundary in any directory entry changed ⏰. It's super handy for spotting when two managers are fighting over who gets to set this table's config 🥊.
apmAppDirID OBJECT-TYPE ✨
apmAppDirID OBJECT-TYPE
SYNTAX OBJECT IDENTIFIER
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"This object allows managers to avoid downloading application
directory information when the directory is set to a known
(usually fixed) configuration.
If the value of this object isn't 0.0, it signifies
that the entire contents of the apmAppDirTable,
apmHttpFilterTable, apmUserDefinedAppTable and
protocolDirTable are equal to a known state identified
by the value of this object. If a manager recognizes this
value as identifying a directory configuration it has a local
copy of, it may use this local copy rather than downloading
these tables. Note that it may have downloaded this local copy
(and the ID) from another agent and used this copy for all
other agents that advertised the same ID.
If an agent recognizes that the entire contents of the
apmAppDirTable, apmHttpFilterTable,
apmUserDefinedAppTable and protocolDirTable are equal to
a known state to which an ID has been assigned, it should set
this object to that ID.
In many cases when this feature is used, the application
directory information will be in read-only memory and thus the
tables may not be modified via SNMP requests. In the event
that the tables are writable and a modification is made, the
agent is responsible for setting this object to 0.0 if it
cannot determine that the state is equal to a known state.
An agent is not obligated to recognize and advertise all such
registered states as it may not have knowledge of all states.
Thus, a manager may encounter agents whose DirectoryID value
is 0.0 even though the contents of the directory were equal to
a registered state.
Note that the contents of those tables includes the
protocolDirLocalIndex and appLocalIndex values. In other
words, these values can't be assigned randomly on each agent,
but must be equal to values that are part of the known
state. While it is possible for a manager to download
application directory details using SNMP and to set the
appropriate directoryID, the manager would need to have some
scheme to ensure consistent values of LocalIndex variables
from agent to agent. Such schemes are outside the scope of
this specification.
Application directory registrations are unique within an
administrative domain.
Typically these registrations will be made by an agent
software developer who will set the application directory
tables to a read-only state and assign a DirectoryID to that
state. Thus, all agents running this software would share the
same DirectoryID. As the application directory might change
from one software release to the next, the developer may
register different DirectoryID's for each software release.
A customer could also create a site-wide application directory
configuration and assign a DirectoryID to that configuration
as long as consistent values of LocalIndex variables can be
ensured.
The value of this object must persist across reboots."
::= { apmMibObjects 3 }okay so this one is basically the "skip the download" button 💖 If the value isn't 0.0, it's a shortcut ID for a whole app directory config. Managers that already have a local copy of that config can just use it instead of pulling all four tables over SNMP 🧚. The agent is supposed to set it to 0.0 if it can't prove the tables still match a known state, and it has to survive reboots 🔥. Also the LocalIndex values have to match too, or the shortcut is cursed 💀
APM HTTP Filter Table 🎀
-- APM HTTP Filter Table
-- The HTTP Filter Table creates virtual applications which measure the
-- performance of certain web pages or sets of web pages. Some
-- circumstances where this is particularly useful are:
--
-- - An Intranet or ASP scenario where a business application is
-- running on one or more web pages or scripts.
-- (i.e., /expense/submit.cgi?employeeID=3426&...)
-- - A web-hosting scenario where one wants to measure the
-- service level for a particular customer
-- - An e-commerce scenario where the performance of certain
-- pages needs to be monitored more closely.
-- (i.e., shopping cart, shipping, credit card authorization)
apmHttpFilterTable OBJECT-TYPE
SYNTAX SEQUENCE OF ApmHttpFilterEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table that creates virtual applications which measure the
performance of certain web pages or sets of web pages.
When an entry is added to this table, the agent will
automatically create one or more entries in the
apmAppDirTable (one for each responsivenessType it is
capable of measuring).
Note that when entries exist in this table some HTTP
transactions will be summarized twice: in applications
represented here as well as the HTTP application. If entries
in this table overlap, these transactions may be summarized
additional times.
The contents of this table affect all reports and exceptions
generated by this agent. Accordingly, modification of this
table should be performed by a manager acting in the role of
administrator. In particular, management software should not
require or enforce particular configuration of this table - it
should reflect the preferences of the site administrator, not
the software author."
::= { apmMibObjects 4 }this table is basically "make a virtual app for these web pages so I can track how fast they are" 🦋 Some fun use cases the file lists: an intranet app running on a few pages, a web host tracking one customer's service level, or an e-commerce site watching the checkout flow 🛒. Heads up though, if entries overlap, some HTTP transactions get counted more than once 🙈. And the admin is the one who should decide how this table looks, not the software author 👑.
apmHttpFilterEntry OBJECT-TYPE
SYNTAX ApmHttpFilterEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A virtual application which measure the performance of certain
web pages or sets of web pages."
INDEX { apmHttpFilterIndex }
::= { apmHttpFilterTable 1 }
ApmHttpFilterEntry ::= SEQUENCE {
apmHttpFilterIndex Unsigned32,
apmHttpFilterAppLocalIndex AppLocalIndex,
apmHttpFilterServerProtocol Unsigned32,
apmHttpFilterServerAddress ProtocolDirNetworkAddress,
apmHttpFilterURLPath OCTET STRING,
apmHttpFilterMatchType INTEGER,
apmHttpFilterOwner OwnerString,
apmHttpFilterStorageType StorageType,
apmHttpFilterRowStatus RowStatus
}so each row is one virtual app, and it's indexed by apmHttpFilterIndex 🧩 The SEQUENCE lists all nine columns that make up a row. Quick vibe check: row ✨ each one is its own mini-object ✨.
apmHttpFilterIndex OBJECT-TYPE 🔢
apmHttpFilterIndex OBJECT-TYPE
SYNTAX Unsigned32 (0..65535)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An index that uniquely identifies an entry in the
apmHttpFilterTable."
::= { apmHttpFilterEntry 1 }this is the row's name tag 🏷️ It's a number from 0 to 65535 that uniquely identifies each entry in the table. Managers can't read it directly, since it's not-accessible 🙈.
apmHttpFilterAppLocalIndex OBJECT-TYPE 🌸
apmHttpFilterAppLocalIndex OBJECT-TYPE
SYNTAX AppLocalIndex
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The AppLocalIndex that represents HTTP transactions
that match this entry.
This object is read-only. A value is created by the agent from
an unused AppLocalIndex value when this apmHttpFilterEntry is
created."
::= { apmHttpFilterEntry 2 }the agent picks this one all by itself 💅 When a row gets created, the agent grabs an unused AppLocalIndex and that's the label for all the HTTP transactions matching the row. Managers can read it but can't change it, periodt 💖.
apmHttpFilterServerProtocol OBJECT-TYPE 🌐
apmHttpFilterServerProtocol OBJECT-TYPE
SYNTAX Unsigned32 (1..2147483647)
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The protocolDirLocalIndex value of the network level protocol
of the apmHttpFilterServerAddress."
::= { apmHttpFilterEntry 3 }this is the network-layer protocol that goes with the server address 🧠 It stores the protocolDirLocalIndex of whichever network-level protocol the address belongs to. Valid values run from 1 up to 2147483647 ✨.
apmHttpFilterServerAddress OBJECT-TYPE 📍
apmHttpFilterServerAddress OBJECT-TYPE
SYNTAX ProtocolDirNetworkAddress
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This entry will only represent transactions coming from the
network address specified in this object.
This is represented as an octet string with
specific semantics and length as identified
by the associated apmHttpFilterServerProtocol object.
If this object is the zero-length string, then this entry will
match one of the addresses represented by the 'host' component
of the associated apmHttpFilterURLPath object, where the
format if a URL [9] is
http://<host>:<port>/<path>?<searchpart>."
::= { apmHttpFilterEntry 4 }so this is the address the row is allowed to match 👀 The row only counts transactions coming from this network address. Its format depends on the protocol named in apmHttpFilterServerProtocol 🧩. If it's a zero-length string, the row instead looks at the 'host' part of the URL path, which follows the form http://<host>:<port>/<path>?<searchpart> 🔗.
apmHttpFilterURLPath OBJECT-TYPE 🛤️
apmHttpFilterURLPath OBJECT-TYPE
SYNTAX OCTET STRING (SIZE(0..65535))
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This entry will only represent HTTP transactions
where the URL path component in the request matches this
value. This value represents the requested path regardless of
any substitution that the server might perform.
Prior to the matching, the URL is stripped of any server
address or DNS name and consists solely of the path name on
that server.
If the length of this object is zero, then this entry will
match if the associated apmHttpFilterServerAddress match. If
the length of that object is also zero, then this entry will
match nothing.
The value of the associated apmHttpFilterMatchType dictates
the type of matching that will be attempted."
::= { apmHttpFilterEntry 5 }the path is the page you're tracking, like a little GPS pin 📍 The row only counts requests whose path matches this value, and the server's own rewrites don't matter. Before matching, the server name and DNS name get stripped off, so you're left with just the path 🪄. If the path is empty, the row falls back on the server address. If both are empty, the row matches nothing at all 💀. And the match style comes from apmHttpFilterMatchType 🎯.
apmHttpFilterMatchType OBJECT-TYPE 🎯
apmHttpFilterMatchType OBJECT-TYPE
SYNTAX INTEGER {
exact(1),
stripTrailingSlash(2),
prefix(3)
}
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The matching algorithm used to compare the URL pathname.
If the value is exact(1), then the pathname component will be
compared with the associated apmHttpFilterURLPath and
will only be associated with this entry if it matches exactly.
If the value is stripTrailingSlash(2), then the pathname
component will be compared with the associated
apmHttpFilterURLPath and will only be associated with this
entry if it matches exactly or if the pathname ends with a '/'
symbol and matches apmHttpFilterURLPath if the '/' symbol is
removed from the pathname. This option exists for those paths
where an optional trailing slash is possible but for which a
prefix match would be too broad.
If the value is prefix(3), then the pathname component will be
compared with the associated apmHttpFilterURLPath and will
only be associated with this entry if the beginning of the
pathname matches every octet of this value. Octets that extend
beyond the length of this value are ignored."
::= { apmHttpFilterEntry 6 }three match modes, three different vibes 🎀 exact(1) means the path has to match perfectly. stripTrailingSlash(2) is for paths that might or might not end in a '/', and it's the chill option when a prefix match would be too broad 🙃. prefix(3) checks that the start of the path matches the stored value, and anything extra after that is ignored 🌈.
apmHttpFilterOwner OBJECT-TYPE 👑
apmHttpFilterOwner OBJECT-TYPE
SYNTAX OwnerString
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The entity that configured this entry and is
therefore using the resources assigned to it."
::= { apmHttpFilterEntry 7 }the owner is whoever set up the row and is using its resources ✨
apmHttpFilterStorageType OBJECT-TYPE 💾
apmHttpFilterStorageType OBJECT-TYPE
SYNTAX StorageType
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The storage type of this apmHttpFilterEntry. If the value of
this object is 'permanent', no objects in this row need to be
writable."
::= { apmHttpFilterEntry 8 }storage type is just how the row is kept around 🧸 If it's set to 'permanent', none of the objects in that row need to be writable 🔒.
apmHttpFilterRowStatus OBJECT-TYPE 🚦
apmHttpFilterRowStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The status of this apmHttpFilterEntry. No objects in this row
may be modified while the row's status is 'active'."
::= { apmHttpFilterEntry 9 }no touching an active row, bestie 🚫 While the row's status is 'active', none of its objects can be modified 🙅♀️. You have to deactivate it first if you want to change anything.
okay so this next bit is all about the knobs admins can turn 🎀 the APM filtering and naming settings are where things get really specific 💅
apmHttpIgnoreUnregisteredURLs OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"When true, APM measurements of HTTP transactions will only
measure transactions relating to URLs that match a filter in
the apmHttpFilterTable. Thus, measurements for the HTTP
application will present aggregated statistics for
URL-matching HTTP transactions and measurements for the HTTP
GET application verb will present aggregated statistics for
URL-matching HTTP GET transactions.
This will be used in environments that wish to monitor only
targeted URLs and to ignore large volumes of internet web
browsing traffic.
This object affects all APM reports and exceptions generated
by this agent. Accordingly, modification of this object should
be performed by a manager acting in the role of
administrator. In particular, management software should not
require or enforce particular configuration of this object -
it should reflect the preferences of the site administrator,
not the software author.
The value of this object must persist across reboots."
::= { apmMibObjects 5 }apmHttpIgnoreUnregisteredURLs is the "only watch my people" switch 🙈 when it's true, only the URLs that match the apmHttpFilterTable get measured, so all that random browsing noise is ignored 🌸
apmHttp4xxIsFailure OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"When true, this agent will recognize HTTP errors in the range
of 400 through 499 and will treat them as unavailable
transactions. When false or when this object isn't supported,
they will be treated as successful transactions.
This object allows such error pages to be tracked at the
possible expense of having user typos treated as poor service
on the part of the web server.
This object affects all reports and exceptions generated by
this agent. Accordingly, modification of this object should be
performed by a manager acting in the role of administrator. In
particular, management software should not require or enforce
particular configuration of this object - it should reflect
the preferences of the site administrator, not the software
author.
The value of this object must persist across reboots."
::= { apmMibObjects 6 }apmHttp4xxIsFailure is giving "do I count the 404s or nah" energy 💀 true means 400 to 499 errors count as unavailable, false (or not supported) means they count as successful 🦋
-- The APM User-Defined Application Table
-- Many application protocols will never be registered with a
-- standards body (and thus included in a protocol directory standard)
-- because they are custom, in-house or proprietary
-- applications. Nevertheless, implementation strategies exist for
-- monitoring the end-user experience of these applications.
--
-- This read-only table provides a means for the agent to advertise
-- which user-defined applications it is monitoring and to associate
-- each with an AppLocalIndex value. It is an implementation-dependent
-- matter as to how the agent learns how to monitor these
-- applications.
apmUserDefinedAppTable OBJECT-TYPE
SYNTAX SEQUENCE OF ApmUserDefinedAppEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table that advertises user-defined applications that the
agent is measuring.
The agent will automatically create one or more entries in the
apmAppDirTable (one for each responsivenessType it is
capable of measuring) for each entry in this table.
Note that when entries exist in this table some
transactions can be summarized more than once if there is
overlap between applications defined here and applications
defined in the protocol directory or in the httpFilter table."
::= { apmMibObjects 7 }
apmUserDefinedAppEntry OBJECT-TYPE
SYNTAX ApmUserDefinedAppEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A user-defined application that the agent is measuring, along
with its AppLocalIndex assignment.
The apmAppDirAppLocalIndex value in the index identifies
the agent-assigned AppLocalIndex value for this user-defined
application."
INDEX { apmAppDirAppLocalIndex }
::= { apmUserDefinedAppTable 1 }
ApmUserDefinedAppEntry ::= SEQUENCE {
apmUserDefinedAppParentIndex Unsigned32,
apmUserDefinedAppApplication SnmpAdminString
}
apmUserDefinedAppParentIndex OBJECT-TYPE
SYNTAX Unsigned32 (1..2147483647)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The protocolDirLocalIndex value of the highest-layer
protocol defined in the protocolDirTable that this
application is a child of."
::= { apmUserDefinedAppEntry 1 }
apmUserDefinedAppApplication OBJECT-TYPE
SYNTAX SnmpAdminString
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"A human readable descriptive tag for this application."
::= { apmUserDefinedAppEntry 2 }the user-defined app table is for the custom, in-house, or proprietary apps that never got registered anywhere 🧚 the agent just advertises which ones it's watching, and it's read-only, so hands off 🫶
-- The APM Name Table
apmNameTable OBJECT-TYPE
SYNTAX SEQUENCE OF ApmNameEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A client machine may have multiple addresses during a period
of monitoring. The apmNameTable assigns a long-lived
identifier to a client and records what addresses were
assigned to that client for periods of time. Various
implementation techniques exist for tracking this mapping but
if an agent is unable to track client address mappings, it may
map client identifiers to client addresses rather than to
distinct client machines.
A particular apmNameClientID should be a constant attribute of
a particular client. When available, the agent may also record
the machine name and/or user name which may be valuable for
displaying to humans. The apmNameMachineName and
apmNameUserName are relatively constant, changing only if
these attributes actually change on the client.
The agent will store a historical log of these entries, aging
out old entries as the log becomes too large. Since this table
contains information vital to the interpretation of other
tables (e.g., the apmReportTable), the agent should ensure that
the log doesn't age out entries that would be referenced by
data in those tables.
Note that an entry for a clientID is active from its
StartTime until the StartTime of another entry (for the same
clientID) that supersedes it, or 'now' if none supersede
it. Therefore, if a clientID only has a single entry, it is by
definition very new and should never be aged out. No entry for
a clientID should be aged out unless it has been updated by a
new entry for the client (i.e., with an updated address) and
only if the new entry is 'old' enough.
To determine how old is old enough, compute the maximum value
of Interval * (NumReports + 1) of all entries in the
apmReportControlTable (the '+ 1' is to allow a reasonable
period of time for the report to be downloaded). Then take the
larger of this value and the age in seconds of the oldest
entry in the current transaction table. If an entry for a
clientID is superseded by another entry whose StartTime is
more than this many seconds ago, then the older entry may be
deleted."
::= { apmMibObjects 8 }
apmNameEntry OBJECT-TYPE
SYNTAX ApmNameEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An entry in the APM name table. An entry exists for each
period of time that a client has been associated with a
particular address.
The protocolDirLocalIndex value in the index identifies
the network layer protocol for the ClientAddress for this
entry.
Note that some combinations of index values may result in an
index that exceeds 128 sub-identifiers in length which exceeds
the maximum for the SNMP protocol. Implementations should take
care to avoid such combinations."
INDEX { apmNameClientID,
protocolDirLocalIndex, apmNameClientAddress,
apmNameMappingStartTime }
::= { apmNameTable 1 }
ApmNameEntry ::= SEQUENCE {
apmNameClientID RmonClientID,
apmNameClientAddress ProtocolDirNetworkAddress,
apmNameMappingStartTime DateAndTime,
apmNameMachineName SnmpAdminString,
apmNameUserName SnmpAdminString
}
apmNameClientID OBJECT-TYPE
SYNTAX RmonClientID
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A unique ID assigned to the machine represented by this
mapping. This ID is assigned by the agent using an
implementation-specific algorithm."
::= { apmNameEntry 1 }
apmNameClientAddress OBJECT-TYPE
SYNTAX ProtocolDirNetworkAddress (SIZE(1..255))
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The network client address for this client when this mapping
was active.
This is represented as an octet string with specific semantics
and length as identified by the protocolDirLocalIndex
component of the index. This object may not be the zero length
string.
Since this object is an index variable, it is encoded in the
index according to the index encoding rules. For example, if
the protocolDirLocalIndex component of the index indicates an
encapsulation of ip, this object is encoded as a length octet
of 4, followed by the 4 octets of the ip address, in network
byte order. Care should be taken to avoid values of this
object that, in conjunction with the other index variables,
would result in an index longer than SNMP's maximum of 128
subidentifiers."
::= { apmNameEntry 2 }
apmNameMappingStartTime OBJECT-TYPE
SYNTAX DateAndTime
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The time that the agent first discovered this mapping
as active."
::= { apmNameEntry 3 }
apmNameMachineName OBJECT-TYPE
SYNTAX SnmpAdminString
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The human readable name of the client machine.
If the client has no machine name or the agent is
unable to learn the machine name, this object will be
a zero-length string."
::= { apmNameEntry 4 }
apmNameUserName OBJECT-TYPE
SYNTAX SnmpAdminString
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The human readable name of a human user using the client
machine. If more than one user name are available
simultaneously, it is an implementation-dependent matter as to
which is used here. However, if the user name changes, this
object should change to reflect that change.
Non-human user names like 'root' or 'administrator' aren't
intended as values for this object. If the client has no
recorded user name or the agent is unable to learn a user
name, this object will be a zero-length string."
::= { apmNameEntry 5 }the name table is basically a diary of who had which address and when 📖✨ it keeps old entries around until nothing still needs them, which is honestly so responsible of it 👑
-- The APM Report Group
apmReportControlTable OBJECT-TYPE
SYNTAX SEQUENCE OF ApmReportControlEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Parameters that control the creation of a set of reports that
aggregate application performance."
::= { apmMibObjects 9 }and that's the report group starting up 🌈 the control table is where the report-making settings live, so buckle up bestie 💖
okay bestie, the apmReportControlEntry is literally the row definition 💖 it says what one report-control row looks like, and it's indexed by apmReportControlIndex 🦋
apmReportControlEntry OBJECT-TYPE
SYNTAX ApmReportControlEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A conceptual row in the apmReportControlTable.
An example of the indexing of this table is
apmReportControlInterval.3"
INDEX { apmReportControlIndex }
::= { apmReportControlTable 1 }
ApmReportControlEntry ::= SEQUENCE {
apmReportControlIndex Unsigned32,
apmReportControlDataSource DataSourceOrZero,
apmReportControlAggregationType TransactionAggregationType,
apmReportControlInterval Unsigned32,
apmReportControlRequestedSize Unsigned32,
apmReportControlGrantedSize Unsigned32,
apmReportControlRequestedReports Unsigned32,
apmReportControlGrantedReports Unsigned32,
apmReportControlStartTime TimeStamp,
apmReportControlReportNumber Unsigned32,
apmReportControlDeniedInserts Counter32,
apmReportControlDroppedFrames Counter32,
apmReportControlOwner OwnerString,
apmReportControlStorageType StorageType,
apmReportControlStatus RowStatus
}The SEQUENCE is the whole row laid out column by column ✨ so you can see every field in one glance, no cap 🫶
apmReportControlIndex is the key that makes each row its own thing 🌸 It's an Unsigned32 limited to 1..65535, and it's not-accessible, so you can't read it straight off the table like a normal column 🙈 Each entry is a unique report, and the results land in the apmReportTable on behalf of that row.
apmReportControlIndex OBJECT-TYPE
SYNTAX Unsigned32 (1..65535)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An index that uniquely identifies an entry in the
apmReportControlTable. Each such entry defines a unique
report whose results are placed in the apmReportTable on
behalf of this apmReportControlEntry."
::= { apmReportControlEntry 1 }apmReportControlDataSource is all about where the data comes from 🧚 Think of it as the "who's the source" column 💅 The description gives a few different cases depending on whether a probe is doing the measuring, and if nothing's known it goes to 0.0. It's read-create, and you can't change it while the row is active(1) 🔥
apmReportControlDataSource OBJECT-TYPE
SYNTAX DataSourceOrZero
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The source of the data for APM Reports generated on
behalf of this apmReportControlEntry.
If the measurement is being performed by a probe, this should
be set to interface or port where data was received for
analysis. If the measurement isn't being performed by a probe,
this should be set to the primary interface over which the
measurement is being performed. If the measurement isn't being
performed by a probe and there is no primary interface or this
information isn't known, this object should be set to 0.0.
This object may not be modified if the associated
apmReportControlStatus object is equal to active(1)."
::= { apmReportControlEntry 2 }apmReportControlAggregationType is the "how do we group stuff" setting 🎀 It's a TransactionAggregationType with four options, and the comment block in the SYNTAX spells them out as flows(1), clients(2), servers(3), and applications(4) 🌈 Each one gets less detailed as you go, like zooming out on a map 🗺️
Quick breakdown of the vibe:
- flows(1): the most specific one, grouping by application, server, and client 3-tuples 💜
- clients(2): a bit more squished, grouping by application and client 🍓
- servers(3): grouping by application and server 🌸
- applications(4): the most squished, one group per application ✨
The description also says it's not meaningful to aggregate applications with each other since they're super different, so that's why the list stops at four, periodt 👑
apmReportControlAggregationType OBJECT-TYPE
SYNTAX TransactionAggregationType
-- INTEGER {
-- flows(1),
-- clients(2),
-- servers(3),
-- applications(4)
-- }
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The type of aggregation being performed for this set of
reports.
The metrics for a single transaction are the responsiveness of
the transaction and whether the transaction succeeded (a
boolean). When such metrics are aggregated in this MIB Module,
these metrics are replaced by averages and distributions of
responsiveness and availability. The metrics describing
aggregates are constant no matter which type of aggregation is
being performed. These metrics may be found in the
apmReportTable.
The flows(1) aggregation is the simplest. All transactions
that share common application/server/client 3-tuples are
aggregated together, resulting in a set of metrics for all
such unique 3-tuples.
The clients(2) aggregation results in somewhat more
aggregation (i.e., fewer resulting records). All transactions
that share common application/client tuples are aggregated
together, resulting in a set of metrics for all such unique
tuples.
The servers(3) aggregation usually results in still more
aggregation (i.e., fewer resulting records). All transactions
that share common application/server tuples are aggregated
together, resulting in a set of metrics for all such unique
tuples.
The applications(4) aggregation results in the most
aggregation (i.e., the fewest resulting records). All
transactions that share a common application are aggregated
together, resulting in a set of metrics for all such unique
applications.
Note that it is not meaningful to aggregate applications, as
different applications have widely varying characteristics.
As a result, this set of aggregations is complete.
This object may not be modified if the associated
apmReportControlStatus object is equal to active(1)."
::= { apmReportControlEntry 3 }apmReportControlInterval is the timer 🕰️ It's in Seconds and it's the window that data gets collected over before it turns into a report in the apmReportTable 🦋 The DEFVAL is 3600, so an hour by default, which is a very cute number honestly 💅
The description goes deep on the whole "lining reports up to the top of the hour" thing 🌈 Lots of people want that so their numbers match real business patterns, and it helps when data from different agents needs to line up too 🫶 The fun part is the agent can't let reports drift over time, because they'd get out of sync super fast 😭 If there's a fixed processing delay in between reports, that delay gets subtracted from the interval so nothing creeps 💀
apmReportControlInterval OBJECT-TYPE
SYNTAX Unsigned32
UNITS "Seconds"
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The interval in seconds over which data is accumulated before
being aggregated into a report in the apmReportTable. All
reports with the same apmReportControlIndex will be based on
the same interval. This object must be greater than zero.
Many users desire that these reports be synchronized to within
seconds of the beginning of the hour because the results may
be correlated more meaningfully to business behavior and so
that data from multiple agents is aggregated over the same
time periods. Thus management software may take extra effort
to synchronize reports to the beginning of the hour and to one
another. However, the agent must not allow reports to 'drift'
over time as they will quickly become unsynchronized. In
particular, if there is any fixed processing delay between
reports, the reports should deduct this time from the interval
so that reports don't drift.
This object may not be modified if the associated
apmReportControlStatus object is equal to active(1)."
DEFVAL { 3600 }
::= { apmReportControlEntry 4 }apmReportControlRequestedSize is the wishlist 🎀 It's how many entries you'd like to have allocated for each report ✨ Asking for it doesn't mean you get it, which is where the next object comes in 🙈
apmReportControlRequestedSize OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The number of entries requested to be allocated for each
report generated on behalf of this entry."
::= { apmReportControlEntry 5 }apmReportControlGrantedSize is the reality check 🌸 It's the number of entries per report the agent actually allocated, based on what you asked for in apmReportControlRequestedSize 💜 The total storage is this number times apmReportControlGrantedReports, or just 1 if that column doesn't exist 🧚
The description is kinda intense about storage 🔥 When you create or change the requested size, the agent should get as close to that number as the implementation and its resources allow. Then it's also saying the agent must keep enough room to fill every report in full when it's needed, and it must not lower this value unless the requested size gets set. Honestly this one's giving responsibility energy 😭
apmReportControlGrantedSize OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of entries per report the agent has allocated
based on the requested amount in apmReportControlRequestedSize.
Since multiple reports are saved, the total number of entries
allocated will be this number multiplied by the value of
apmReportControlGrantedReports, or 1 if that object doesn't
exist.
When the associated apmReportControlRequestedSize object is
created or modified, the agent should set this object as
closely to the requested value as is possible for the
particular implementation and available resources. When
considering resources available, the agent must consider its
ability to allocate this many entries for all reports.
Note that while the actual number of entries stored in the
reports may fluctuate due to changing conditions, the agent
must continue to have storage available to satisfy the full
report size for all reports when necessary. Further, the agent
must not lower this value except as a result of a set to the
associated apmReportControlRequestedSize object."
::= { apmReportControlEntry 6 }apmReportControlRequestedReports is how many saved reports you'd like to keep around 🍓 It's an Unsigned32 that goes from 0 to 65535 💖
apmReportControlRequestedReports OBJECT-TYPE
SYNTAX Unsigned32 (0..65535)
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The number of saved reports requested to be allocated on
behalf of this entry."
::= { apmReportControlEntry 7 }apmReportControlGrantedReports is the matching "here's what you actually got" 🫶 It's the saved report count the agent allocated based on the request, and the total entries come out to this number times apmReportControlGrantedSize (or 1 if that one's missing) 🦋 It follows the same rules as GrantedSize: the agent should get close to what was requested, must keep storage ready for full reports, and must not lower this value unless the requested reports object gets set 🔥
apmReportControlGrantedReports OBJECT-TYPE
SYNTAX Unsigned32 (0..65535)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of saved reports the agent has allocated
based on the requested amount in
apmReportControlRequestedReports. Since each report can have
many entries, the total number of entries allocated will be
this number multiplied by the value of
apmReportControlGrantedSize, or 1 if that object doesn't
exist.
When the associated apmReportControlRequestedReports object is
created or modified, the agent should set this object as
closely to the requested value as is possible for the
particular implementation and available resources. When
considering resources available, the agent must consider its
ability to allocate this many reports each with the number of
entries represented by apmReportControlGrantedSize, or 1 if
that object doesn't exist.
Note that while the storage required for each report may
fluctuate due to changing conditions, the agent must continue
to have storage available to satisfy the full report size for
all reports when necessary. Further, the agent must not lower
this value except as a result of a set to the associated
apmReportControlRequestedSize object."
::= { apmReportControlEntry 8 }apmReportControlStartTime is the clock for the report in progress ⭐ It's a TimeStamp that's basically the sysUpTime value from when the system started working on that report 🧚 The report in progress isn't readable yet, so you can't peek at it mid-way 🙈 Management stations can use this to work out the start times of all the older saved reports too, since they start at fixed intervals 💜
apmReportControlStartTime OBJECT-TYPE
SYNTAX TimeStamp
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of sysUpTime when the system began processing the
report in progress. Note that the report in progress is not
available.
This object may be used by the management station to figure
out the start time for all previous reports saved for this
apmReportControlEntry, as reports are started at fixed
intervals."
::= { apmReportControlEntry 9 }apmReportControlReportNumber is the counter for which report you're on 🌈 The very first report after activation is numbered one, which is the most iconic start ever 🎀 It's an Unsigned32 from 1 up to 4294967295 ✨
apmReportControlReportNumber OBJECT-TYPE
SYNTAX Unsigned32 (1..4294967295)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of the report in progress. When an
apmReportControlEntry is activated, the first report will be
numbered one."
::= { apmReportControlEntry 10 }apmReportControlDeniedInserts is the "oops, didn't fit" counter 🙈 It's a Counter32 that goes up each time the agent tries to add an entry to a report for this row but it would've gone over apmReportControlGrantedSize 💀 The description says it helps you figure out if you've allocated enough room when network usage keeps changing 🦋 It won't tell you the exact number of extra entries you need, because denied entries often get retried, but it does give you the rough size of the problem 🫶
The last bit is the spiciest tea ☕ There's no ordering rule for the entries in a report, so nothing says which ones get dropped first when space runs out. That means the agent isn't required to throw out the "least valuable" entries first 💅
apmReportControlDeniedInserts OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of failed attempts to add an entry to reports for
this apmReportControlEntry because the number of entries
would have exceeded apmReportControlGrantedSize.
This number is valuable in determining if enough entries have
been allocated for reports in light of fluctuating network
usage. Note that since an entry that is denied will often be
attempted again, this number will not predict the exact number
of additional entries needed, but can be used to understand
the relative magnitude of the problem.
Also note that there is no ordering specified for the entries
in the report, thus there are no rules for which entries will
be omitted when not enough entries are available. As a
consequence, the agent is not required to delete 'least
valuable' entries first."
::= { apmReportControlEntry 11 }okay bestie, the counters are about to get spicy 🦋💅
apmReportControlDroppedFrames OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of frames which were received by the agent
and therefore not accounted for in the *StatsDropEvents, but
for which the agent chose not to count for this entry for
whatever reason. Most often, this event occurs when the agent
is out of some resources and decides to shed load from this
collection.
This count does not include packets that were not counted
because they had MAC-layer errors.
This counter is only relevant if this apm report is based on
a data source whose collection methodology is based on
analyzing network traffic.
Note that if the apmReportTables are inactive because no
applications are enabled in the application directory, this
value should be 0.
Note that, unlike the dropEvents counter, this number is the
exact number of frames dropped."
::= { apmReportControlEntry 12 }
apmReportControlOwner OBJECT-TYPE
SYNTAX OwnerString
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The entity that configured this entry and is
therefore using the resources assigned to it."
::= { apmReportControlEntry 13 }
apmReportControlStorageType OBJECT-TYPE
SYNTAX StorageType
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The storage type of this apmReportControlEntry. If the value
of this object is 'permanent', no objects in this row need to
be writable."
::= { apmReportControlEntry 14 }
apmReportControlStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The status of this apmReportControlEntry.
An entry may not exist in the active state unless all
objects in the entry have an appropriate value. The only
objects in the entry that may be modified while the entry is
in the active state are apmReportControlRequestedSize and
apmReportControlRequestedReports.
If this object is not equal to active(1), all
associated entries in the apmReportTable shall be deleted
by the agent."
::= { apmReportControlEntry 15 }
-- The APM Report Table
apmReportTable OBJECT-TYPE
SYNTAX SEQUENCE OF ApmReportEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The data resulting from aggregated APM reports. Consult the
definition of apmReportControlAggregationType for the
definition of the various types of aggregations."
::= { apmMibObjects 10 }
apmReportEntry OBJECT-TYPE
SYNTAX ApmReportEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A conceptual row in the apmReportTable.
The apmReportControlIndex value in the index identifies the
apmReportControlEntry on whose behalf this entry was created.
The apmReportIndex value in the index identifies which report
(in the series of reports) this entry is a part of.
The apmAppDirAppLocalIndex value in the index identifies
the common application of the transactions aggregated in this
entry.
The apmAppDirResponsivenessType value in the index
identifies the type of responsiveness metric reported by
this entry and uniquely identifies this entry when more
than one responsiveness metric is measured for a flow.
Entries will only exist in this table for those
combinations of AppLocalIndex and ResponsivenessType
that are configured 'on(1)'.
The protocolDirLocalIndex value in the index identifies
the network layer protocol of the apmReportServerAddress.
When the associated apmReportControlAggregationType value is
equal to applications(4) or clients(2), this
protocolDirLocalIndex value will equal 0.
The apmReportServerAddress value in the index identifies the
network layer address of the server in transactions aggregated
in this entry.
The apmNameClientID value in the index identifies the
client in transactions aggregated in this entry. If the
associated apmReportControlAggregationType is equal to
applications(4) or servers(3), then this protocolDirLocalIndex
value will equal 0.
An example of the indexing of this entry is
apmReportTransactionCount.3.15.3.1.8.4.192.168.1.2.3232235788
Note that some combinations of index values may result in an
index that exceeds 128 sub-identifiers in length which exceeds
the maximum for the SNMP protocol. Implementations should take
care to avoid such combinations."
INDEX { apmReportControlIndex, apmReportIndex,
apmAppDirAppLocalIndex,
apmAppDirResponsivenessType,
protocolDirLocalIndex, apmReportServerAddress,
apmNameClientID }
::= { apmReportTable 1 }
ApmReportEntry ::= SEQUENCE {
apmReportIndex Unsigned32,
apmReportServerAddress ProtocolDirNetworkAddress,
apmReportTransactionCount Unsigned32,
apmReportSuccessfulTransactions Unsigned32,
apmReportResponsivenessMean Unsigned32,
apmReportResponsivenessMin Unsigned32,
apmReportResponsivenessMax Unsigned32,
apmReportResponsivenessB1 Unsigned32,
apmReportResponsivenessB2 Unsigned32,
apmReportResponsivenessB3 Unsigned32,
apmReportResponsivenessB4 Unsigned32,
apmReportResponsivenessB5 Unsigned32,
apmReportResponsivenessB6 Unsigned32,
apmReportResponsivenessB7 Unsigned32
}
apmReportIndex OBJECT-TYPE
SYNTAX Unsigned32 (1..4294967295)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The value of apmReportControlReportNumber for the report to
which this entry belongs."
::= { apmReportEntry 1 }
apmReportServerAddress OBJECT-TYPE
SYNTAX ProtocolDirNetworkAddress
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The network server address for this apmReportEntry.
This is represented as an octet string with
specific semantics and length as identified
by the protocolDirLocalIndex component of the index.
Since this object is an index variable, it is encoded in the
index according to the index encoding rules. For example, if
the protocolDirLocalIndex indicates an encapsulation of ip,
this object is encoded as a length octet of 4, followed by the
4 octets of the ip address, in network byte order. Care
should be taken to avoid values of this object that, in
conjunction with the other index variables, would result in an
index longer than SNMP's maximum of 128 subidentifiers.
If the associated apmReportControlAggregationType is equal to
applications(4) or clients(2), then this object will be a null
string and will be encoded simply as a length octet of 0."
::= { apmReportEntry 2 }
apmReportTransactionCount OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of transactions aggregated into this record."
::= { apmReportEntry 3 }
apmReportSuccessfulTransactions OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of successful transactions aggregated into
this record."
::= { apmReportEntry 4 }
apmReportResponsivenessMean OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The arithmetic mean of the responsiveness metrics for all
successful transactions aggregated into this record."
::= { apmReportEntry 5 }
apmReportResponsivenessMin OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The minimum of the responsiveness metrics for all
successful transactions aggregated into this record."
::= { apmReportEntry 6 }
apmReportResponsivenessMax OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The maximum of the responsiveness metrics for all
successful transactions aggregated into this record."
::= { apmReportEntry 7 }
-- Note that when updating a report entry, a transaction will not be
-- counted in more than 1 bucket in an entry. It will be counted in
-- the first bucket that matches, starting with Bucket 1 (B1). Note
-- that if a transaction matches 2 application types, it will update
-- one bucket in each of 2 entries in this table.
apmReportResponsivenessB1 OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of successful transactions aggregated into this
record whose responsiveness was less than boundary1 value for
this application."
::= { apmReportEntry 8 }
apmReportResponsivenessB2 OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of successful transactions aggregated into this
record whose responsiveness did not fall into Bucket 1 and was
greater than or equal to the boundary1 value for this
application and less than the boundary2 value for this
application."
::= { apmReportEntry 9 }
apmReportResponsivenessB3 OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of successful transactions aggregated into this
record whose responsiveness did not fall into Bucket 1 or 2
and as greater than or equal to the boundary2 value for this
application and less than the boundary3 value for this
application."
::= { apmReportEntry 10 }
apmReportResponsivenessB4 OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of successful transactions aggregated into this
record whose responsiveness did not fall into Buckets 1
through 3 and was greater than or equal to the boundary3 value
for this application and less than the boundary4 value for
this application."
::= { apmReportEntry 11 }
apmReportResponsivenessB5 OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of successful transactions aggregated into this
record whose responsiveness did not fall into Buckets 1
through 4 and was greater than or equal to the boundary4 value
for this application and less than the boundary5 value for
this application."
::= { apmReportEntry 12 }
apmReportResponsivenessB6 OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of successful transactions aggregated into this
record whose responsiveness did not fall into Buckets 1
through 5 and was greater than or equal to the
boundary5 value for this application and less than the
boundary6 value for this application."
::= { apmReportEntry 13 }
apmReportResponsivenessB7 OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of successful transactions aggregated into this
record whose responsiveness did not fall into Buckets 1
through 6 and was greater than or equal to the boundary6 value
for this application."
::= { apmReportEntry 14 }
-- APM Transaction TableapmTransactionTable 💖 The Transaction Table
okay bestie, this is where the transactions live 🦋 the table holds the ones that are currently running or have recently finished, so it's basically a live feed of everything happening right now ✨
apmTransactionTable OBJECT-TYPE
SYNTAX SEQUENCE OF ApmTransactionEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This table contains transactions that are currently running
or have recently finished."
::= { apmMibObjects 11 }
apmTransactionEntry OBJECT-TYPE
SYNTAX ApmTransactionEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A conceptual row in the apmTransactionTable.
The apmAppDirAppLocalIndex value in the index identifies
the application of the transaction represented by this entry.
The apmAppDirResponsivenessType value in the index
identifies the type of responsiveness metric reported by
this entry and uniquely identifies this entry when more
than one responsiveness metric is measured for a flow.
Entries will only exist in this table for those
combinations of AppLocalIndex and ResponsivenessType
that are configured 'on(1)'.
The protocolDirLocalIndex value in the index identifies
the network layer protocol of the apmTransactionServerAddress.
The apmTransactionServerAddress value in the index identifies
the network layer address of the server in the transaction
represented by this entry.
The apmNameClientID value in the index identifies the
client in the transaction represented by this entry.
An example of the indexing of this entry is
apmTransactionCount.3.1.8.4.192.168.1.2.3232235788.2987
Note that some combinations of index values may result in an
index that exceeds 128 sub-identifiers in length which exceeds
the maximum for the SNMP protocol. Implementations should take
care to avoid such combinations."
INDEX { apmAppDirAppLocalIndex,
apmAppDirResponsivenessType,
protocolDirLocalIndex, apmTransactionServerAddress,
apmNameClientID, apmTransactionID }
::= { apmTransactionTable 1 }
ApmTransactionEntry ::= SEQUENCE {
apmTransactionServerAddress ProtocolDirNetworkAddress,
apmTransactionID Unsigned32,
apmTransactionResponsiveness Unsigned32,
apmTransactionAge TimeInterval,
apmTransactionSuccess TruthValue
}
apmTransactionServerAddress OBJECT-TYPE
SYNTAX ProtocolDirNetworkAddress (SIZE (1..255))
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The network server address for this apmTransactionEntry.
This is represented as an octet string with specific semantics
and length as identified by the protocolDirLocalIndex
component of the index. This object may not be the zero length
string.
For example, if the protocolDirLocalIndex indicates an
encapsulation of ip, this object is encoded as a length octet
of 4, followed by the 4 octets of the ip address, in network
byte order. Care should be taken to avoid values of this
object that, in conjunction with the other index variables,
would result in an index longer than SNMP's maximum of 128
subidentifiers."
::= { apmTransactionEntry 1 }
apmTransactionID OBJECT-TYPE
SYNTAX Unsigned32 (0..4294967295)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A unique value for this transaction amongst other
transactions sharing the same application layer protocol and
server and client addresses. Implementations may choose to use
the value of the client's source port, when possible."
::= { apmTransactionEntry 2 }
apmTransactionResponsiveness OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The current value of the responsiveness metric for this
transaction. If this transaction has completed, the final
value of the metric will be available.
Note that this value may change over the lifetime of the
transaction and it is the final value of this metric that is
recorded as the responsiveness of the transaction for use in
other APM MIB functions."
::= { apmTransactionEntry 3 }
apmTransactionAge OBJECT-TYPE
SYNTAX TimeInterval
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"If this transaction is still executing, this value shall be
the length of time since it was started. If it has completed,
this value shall be the length of time it was executing."
::= { apmTransactionEntry 4 }
apmTransactionSuccess OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The success of this transaction up to this time. Once a
transaction has been marked as failed, it cannot move back
into the successful state."
::= { apmTransactionEntry 5 }
apmTransactionsRequestedHistorySize OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The maximum number of completed transactions desired to be
retained in the apmTransactionTable. If the agent doesn't have
enough resources to retain this many, it will retain as many as
possible. Regardless of this value, the agent must attempt to
keep records for all current transactions it is monitoring.
The value of this object must persist across reboots."
::= { apmMibObjects 12 }The Exception Table 🔔
this part is giving "tell me the second something goes wrong" 🚨 the exception table sets up filters, so a management station can get an immediate notification when a transaction has poor availability or responsiveness. it's especially useful when there are lots of agents and each one only handles a few transactions, because polling would either hammer everything or make the alerts super late 😭
-- The APM Exception table
-- The APM Exception Table creates filters so that a management
-- station can get immediate notification of a transaction that has
-- had poor availability or responsiveness.
--
-- This function is particularly helpful in unaggregated situations
-- where the numbers of agents is relatively high and the transaction
-- rate per agent is relatively low (such as agents for desktops or
-- dedicated to small workgroups). Polling agents in such an
-- environment would either cause scalability problems (high rate) or
-- lead to long notification delays (low rate).
apmExceptionTable OBJECT-TYPE
SYNTAX SEQUENCE OF ApmExceptionEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This table creates filters so that a management station can
get immediate notification of a transaction that has had poor
availability or responsiveness.
Each apmExceptionEntry is associated with a particular type of
transaction and is applied to all transactions of that
type. Multiple apmExceptionEntries may be associated with a
particular type of transaction. A transaction type is
identified by the value of the apmAppDirAppLocalIndex
component of the index.
Because the quality of a transaction is not known until it is
completed, these thresholds are only applied after the
transaction has completed."
::= { apmMibObjects 13 }
apmExceptionEntry OBJECT-TYPE
SYNTAX ApmExceptionEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A conceptual row in the apmExceptionTable.
The apmAppDirAppLocalIndex value in the index identifies
the application this entry will monitor.
The apmAppDirResponsivenessType value in the index
identifies the type of responsiveness metric this entry will
monitor."
INDEX { apmAppDirAppLocalIndex,
apmAppDirResponsivenessType, apmExceptionIndex }
::= { apmExceptionTable 1 }
ApmExceptionEntry ::= SEQUENCE {
apmExceptionIndex Unsigned32,
apmExceptionResponsivenessComparison INTEGER,
apmExceptionResponsivenessThreshold Unsigned32,
apmExceptionUnsuccessfulException INTEGER,
apmExceptionResponsivenessEvents Counter32,
apmExceptionUnsuccessfulEvents Counter32,
apmExceptionOwner OwnerString,
apmExceptionStorageType StorageType,
apmExceptionStatus RowStatus
}
apmExceptionIndex OBJECT-TYPE
SYNTAX Unsigned32 (1..65535)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An index that uniquely identifies an entry in the
apmExceptionTable amongst other entries with equivalent index
values for apmAppDirAppLocalIndex and
apmAppDirResponsivenessType. Each such entry sets up
thresholds for a particular measurement of a particular
application."
::= { apmExceptionEntry 1 }
apmExceptionResponsivenessComparison OBJECT-TYPE
SYNTAX INTEGER {
none(1),
greater(2),
less(3)
}
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"If this value is greater(2) or less(3), the associated
apmExceptionResponsivenessThreshold will be compared to this
value and an exception will be created if the responsiveness
is greater than the threshold (greater(2)) or less than the
threshold (less(3))."
::= { apmExceptionEntry 2 }
apmExceptionResponsivenessThreshold OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The threshold that responsiveness metrics are compared to."
::= { apmExceptionEntry 3 }
apmExceptionUnsuccessfulException OBJECT-TYPE
SYNTAX INTEGER {
off(1),
on(2)
}
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"If this value is on(2), an exception will be created if a
transaction of the associated type is unsuccessful."
::= { apmExceptionEntry 4 }
apmExceptionResponsivenessEvents OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of responsiveness exceptions generated. This
counter will be incremented even if no notification was sent
due to notifications not being configured or due to exceeding
the apmNotificationMaxRate value."
::= { apmExceptionEntry 5 }
apmExceptionUnsuccessfulEvents OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of unsuccessful exceptions generated. This
counter will be incremented even if no notification was sent
due to notifications not being configured or due to exceeding
the apmNotificationMaxRate value."
::= { apmExceptionEntry 6 }
apmExceptionOwner OBJECT-TYPE
SYNTAX OwnerString
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The entity that configured this entry and is
therefore using the resources assigned to it."
::= { apmExceptionEntry 7 }
apmExceptionStorageType OBJECT-TYPE
SYNTAX StorageType
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The storage type of this apmReportControlEntry. If the value
of this object is 'permanent', no objects in this row need to
be writable."
::= { apmExceptionEntry 8 }
apmExceptionStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The status of this apmExceptionEntry. The only objects in the
entry that may be modified while the entry is in the active
state are apmExceptionResponsivenessComparison,
apmExceptionResponsivenessThreshold and
apmExceptionUnsuccessfulException."
::= { apmExceptionEntry 9 }Okay so the MIB bit continues right where we left off 💖
apmThroughputExceptionMinTime OBJECT-TYPE
SYNTAX Unsigned32
UNITS "seconds"
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"Because the responsiveness for throughput-oriented
transactions is divided by the elapsed time, it can be very
sensitive to short-term performance variations for
transactions that take a short period of time. For example,
when downloading a very short file, a single dropped packet
could double or triple the total response time.
Further, throughput is usually examined for applications that
transfer a lot of data, and when doing so it is helpful to
conceptualize transaction costs that are proportional to the
amount of data separately from those costs that are relatively
fixed (i.e., independent of the amount of data). For very
short transactions, these fixed transaction costs (handshake,
setup time, authentication, round-trip time) may dominate the
total response time for the transaction, resulting in
throughput measurements that aren't really proportional to the
network's, server's and client's combined data throughput
capability.
This object controls the minimum number of seconds that an
throughput-based transaction must exceed before an exception
can be generated for it. If this object is set to zero, then
all throughput-based transactions are candidates for
exceptions.
The value of this object must persist across reboots."
DEFVAL { 10 }
::= { apmMibObjects 14 }
apmNotificationMaxRate OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The maximum number of notifications that can be generated
from this agent by the apmExceptionTable in any 60 second
period.
The value of this object must persist across reboots."
DEFVAL { 1 }
::= { apmMibObjects 15 }
-- APM Notifications
apmNotifications OBJECT IDENTIFIER ::= { apm 0 }
apmTransactionResponsivenessAlarm NOTIFICATION-TYPE
OBJECTS { apmExceptionResponsivenessThreshold,
apmTransactionResponsiveness }
STATUS current
DESCRIPTION
"Notification sent when a transaction exceeds a threshold
defined in the apmException table. The index of the
included apmExceptionResponsivenessThreshold object identifies
the apmExceptionEntry that specified the threshold. The
apmTransactionResponsiveness variable identifies the actual
transaction and its responsiveness.
Agent implementors are urged to include additional data
objects in the alarm that may explain the reason for the
alarm. It is helpful to include such data in the alarm because
it describes the situation at the time the alarm was
generated, where polls after the fact may not provide
meaningful information. Examples of such information are CPU
load, memory utilization, network utilization, and transaction
statistics."
::= { apmNotifications 1 }
apmTransactionUnsuccessfulAlarm NOTIFICATION-TYPE
OBJECTS { apmExceptionResponsivenessThreshold }
STATUS current
DESCRIPTION
"Notification sent when a transaction is unsuccessful.
The index of the included apmExceptionResponsivenessThreshold
object identifies both the type of the transaction that caused
this notification as well as the apmExceptionEntry that
specified the threshold.
Agent implementors are urged to include additional data
objects in the alarm that may explain the reason for the
alarm. It is helpful to include such data in the alarm because
it describes the situation at the time the alarm was
generated, where polls after the fact may not provide
meaningful information. Examples of such information are CPU
load, memory utilization, network utilization, and transaction
statistics."
::= { apmNotifications 2 }
apmCompliance MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"Describes the requirements for conformance to
the APM MIB"
MODULE -- this module
MANDATORY-GROUPS { apmAppDirGroup, apmReportGroup }
GROUP apmUserDefinedApplicationsGroup
DESCRIPTION
"Implementation of the apmUserDefinedApplicationsGroup
is optional."
GROUP apmTransactionGroup
DESCRIPTION
"Implementation of the apmTransactionGroup is optional."
GROUP apmExceptionGroup
DESCRIPTION
"Implementation of the apmExceptionGroup is optional."
GROUP apmNotificationGroup
DESCRIPTION
"Implementation of the apmNotificationGroup is optional."
::= { apmCompliances 1 }
apmAppDirGroup OBJECT-GROUP
OBJECTS { apmAppDirConfig,
apmAppDirResponsivenessBoundary1,
apmAppDirResponsivenessBoundary2,
apmAppDirResponsivenessBoundary3,
apmAppDirResponsivenessBoundary4,
apmAppDirResponsivenessBoundary5,
apmAppDirResponsivenessBoundary6,
apmBucketBoundaryLastChange, apmAppDirID,
apmNameMachineName, apmNameUserName }
STATUS current
DESCRIPTION
"The APM MIB directory of applications and application verbs."
::= { apmGroups 1 }
apmUserDefinedApplicationsGroup OBJECT-GROUP
OBJECTS { apmHttpFilterAppLocalIndex,
apmHttpFilterServerProtocol,
apmHttpFilterServerAddress, apmHttpFilterURLPath,
apmHttpFilterMatchType, apmHttpFilterOwner,
apmHttpFilterStorageType, apmHttpFilterRowStatus,
apmHttpIgnoreUnregisteredURLs, apmHttp4xxIsFailure,
apmUserDefinedAppParentIndex,
apmUserDefinedAppApplication }
STATUS current
DESCRIPTION
"Objects used for creating and managing user-defined
applications."
::= { apmGroups 2 }
apmReportGroup OBJECT-GROUP
OBJECTS { apmReportControlDataSource,
apmReportControlAggregationType,
apmReportControlInterval,
apmReportControlRequestedSize,
apmReportControlGrantedSize,
apmReportControlRequestedReports,
apmReportControlGrantedReports,
apmReportControlStartTime,
apmReportControlReportNumber,
apmReportControlDeniedInserts,
apmReportControlDroppedFrames,
apmReportControlOwner,
apmReportControlStorageType,
apmReportControlStatus,
apmReportTransactionCount,
apmReportSuccessfulTransactions,
apmReportResponsivenessMean,
apmReportResponsivenessMin,
apmReportResponsivenessMax,
apmReportResponsivenessB1,
apmReportResponsivenessB2,
apmReportResponsivenessB3,
apmReportResponsivenessB4,
apmReportResponsivenessB5,
apmReportResponsivenessB6,
apmReportResponsivenessB7 }
STATUS current
DESCRIPTION
"The apm report group controls the creation and retrieval of
reports that aggregate application performance."
::= { apmGroups 3 }
apmTransactionGroup OBJECT-GROUP
OBJECTS { apmTransactionResponsiveness,
apmTransactionAge, apmTransactionSuccess,
apmTransactionsRequestedHistorySize }
STATUS current
DESCRIPTION
"The apm transaction group contains statistics for
individual transactions."
::= { apmGroups 4 }
apmExceptionGroup OBJECT-GROUP
OBJECTS { apmExceptionResponsivenessComparison,
apmExceptionResponsivenessThreshold,
apmExceptionUnsuccessfulException,
apmExceptionResponsivenessEvents,
apmExceptionUnsuccessfulEvents,
apmExceptionOwner, apmExceptionStorageType,
apmExceptionStatus, apmThroughputExceptionMinTime,
apmNotificationMaxRate }
STATUS current
DESCRIPTION
"The apm exception group causes notifications to be sent
whenever transactions are detected that had poor availability
or responsiveness."
::= { apmGroups 5 }
apmNotificationGroup NOTIFICATION-GROUP
NOTIFICATIONS { apmTransactionResponsivenessAlarm,
apmTransactionUnsuccessfulAlarm }
STATUS current
DESCRIPTION
"Notifications sent by an APM MIB agent."
::= { apmGroups 6 }
END4. Security Considerations ✨
Okay so this part is serious, bestie 🫢 A bunch of the objects in this MIB module have a MAX-ACCESS of read-write and/or read-create. Those can be sensitive or vulnerable in some network environments. Doing SET operations in a non-secure environment without proper protection can seriously mess with network operations 💀
Specifically, most of the read-write and read-create objects in this MIB module can be used to configure an agent to reveal network addresses, application usage info, and conversation statistics that might be sensitive in some environments 👀
Some of the readable objects in this MIB module (aka the ones with a MAX-ACCESS other than not-accessible) may be sensitive or vulnerable in some network environments too 🙈 So it's important to control even GET and/or NOTIFY access to these objects, and possibly even encrypt their values when sending them over the network via SNMP 🔐
Specifically, this MIB contains network addresses, machine names, user names, application usage info, and conversation statistics 😭 Data like this should be considered sensitive, and the privacy of the users it was gathered from should be protected 🫶 Administrators should restrict read access to this data to specifically authorized individuals or agents that understand the privacy implications of its release. If read access to this data can't be restricted, it should not be gathered 🛑
Systems that implement the objects in this MIB module can measure how long it takes to execute transactions ⏱️ Depending on the transaction type, some or all of that transaction time may be tied to security calculations. That kind of data may help an attacker use timing attacks to extract secrets from the systems involved in the transactions 😱 See [10] for more information 📚
SNMP versions prior to SNMPv3 didn't include adequate security 💅 Even if the network itself is secure (for example by using IPSec), there's still no control over who on that secure network is allowed to access and GET/SET (read/change/create/delete) the objects in this MIB module 🙃
It is RECOMMENDED that implementers consider the security features provided by the SNMPv3 framework (see [8], section 8), including full support for the SNMPv3 cryptographic mechanisms (for authentication and privacy) 🔑
Further, deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and to enable cryptographic security. Then it's a customer/operator responsibility to make sure the SNMP entity giving access to an instance of this MIB module is properly configured, so the objects are only accessible to principals (users) that have legitimate rights to actually GET or SET (change/create/delete) them 👑
5. References ✨
5.1. Normative References
Okay bestie, the normative refs are the must-reads 📚🫶 Here's the lineup:
[1] McCloghrie, K., Perkins, D. and J. Schoenwaelder, "Structure of Management Information Version 2 (SMIv2)", STD 58, RFC 2578, April 1999. 💜
[2] McCloghrie, K., Perkins, D. and J. Schoenwaelder, "Textual Conventions for SMIv2", STD 58, RFC 2579, April 1999. 🎀
[3] McCloghrie, K., Perkins, D. and J. Schoenwaelder, "Conformance Statements for SMIv2", STD 58, RFC 2580, April 1999. ✨
[4] McCloghrie, K. and F. Kastenholz, "The Interfaces Group MIB", RFC 2863, June 2000. 🦋
[5] Waldbusser, S., "Remote Network Monitoring Management Information Base Version 2 using SMIv2", RFC 2021, January 1997. 🌸
[6] Bierman, A., Bucci, C. and R. Iddon, "Remote Network Monitoring MIB Protocol Identifiers", RFC 2895, August 2000. 🍓
[7] Waldbusser, S., "Remote Network Monitoring Management Information Base", STD 59, RFC 2819, May 2000. 👑
5.2. Informative References
Now the informative ones. Not required reading, but honestly iconic for context 🧚
[8] Case, J., Mundy, R., Partain, D. and B. Stewart, "Introduction and Applicability Statements for Internet-Standard Management Framework", RFC 3410, December 2002. 💅
[9] Berners-Lee, T., Masinter, L. and M. McCahill, "Uniform Resource Locators (URL)", RFC 1738, December 1994. 🌈
[10] Boneh, D. and D. Brumley, "Remote timing attacks are practical", Proceedings of 12th USENIX Security Symposium, August 2003. 😭 this one is lowkey terrifying, read it anyway.
6. Author's Address
Steven Waldbusser 🧑💻 EMail: waldbusser@nextbeacon.com
7. Full Copyright Statement
Copyright (C) The Internet Society (2004). This document is subject to the rights, licenses and restrictions contained in BCP 78 and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document, or the extent to which any license under such rights might or might not be available. It also does not represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification, can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org. 📩
Acknowledgement
Funding for the RFC Editor function is currently provided by the Internet Society. 🫶
📦 where this page comes from
- ietf: rfc3729 2004-03
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms