RFC 5674

Alarms in Syslog

📅 published October 2009, from ietf

RFC 5674: Alarms in Syslog 🎀

okay bestie, this one is all about sending alarm info through syslog and it's so iconic 💅

Network Working Group 🌸
Author 1: S. Chisholm (Nortel) 💖
Author 2: R. Gerhards (Adiscon GmbH) ✨
Category: Standards Track 👑
Date: October 2009 🦋
Obsoletes / Updates: no Obsoletes or Updates lines show up in its header 🙈

Abstract

so the big idea: this doc explains how to send alarm information in syslog 📣 It also maps ITU perceived severities onto syslog message fields, which is lowkey the most useful part 🔥 It includes a bunch of alarm-specific SD-PARAM definitions from X.733 and the IETF Alarm MIB too 🧚

Status of This Memo

This document specifies an Internet standards track protocol for the Internet community, and it wants your discussion and suggestions for improvements 🫶 For the current standardization state and status, check the "Internet Official Protocol Standards" (STD 1) 📚 Distribution of this memo is unlimited 🌈

Copyright Notice

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the date of publication. Please review these documents carefully, because they describe your rights and restrictions for this document 📜 Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they're provided without warranty as described in the BSD License 🔥

1. Introduction ....................................................2
2. Severity Mapping ................................................2
3. Alarm STRUCTURED-DATA Elements ..................................3
   3.1. resource ...................................................3
   3.2. probableCause ..............................................4
   3.3. perceivedSeverity ..........................................4
   3.4. eventType ..................................................4
   3.5. trendIndication ............................................4
   3.6. resourceURI ................................................5
4. Examples ........................................................5
5. Security Considerations .........................................6
6. IANA Considerations .............................................6
7. Acknowledgments .................................................6
8. References ......................................................7
   8.1. Normative References .......................................7
   8.2. Informative References .....................................7

1. Introduction ✨

Okay so alarms usually go out asynchronously over protocols like the Simple Network Management Protocol (SNMP) or the Network Configuration Protocol (Netconf) 📡 But tons of implementations also log alarms through syslog, which is why this memo exists 💅 It defines a set of SD-PARAMs to support that logging, and it maps syslog severity to the severity of the alarm 🎀

The Alarm MIB [RFC3877] includes mandatory alarm fields from X.733 [X.733], plus information from X.736 [X.736] 🦋 In addition, the Alarm MIB brings its own alarm fields to the party 🌸 This memo reuses the terminology and fields from the Alarm MIB, so nothing is reinvented, which is very slay 👑

the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 🔥

Alarm-related terminology is defined in [RFC3877] 📚

SD-ID, SD-PARAM, and other syslog-related terms are defined in [RFC5424] 🧚

2. Severity Mapping 🌈

The Alarm MIB [RFC3877] defines ITU perceived severities, and it's really useful to relate those to the syslog message fields, especially when alarms are being logged 🙌 This memo describes how ITU perceived severities are represented in the appropriate syslog fields, which are described in [RFC5424] ✨ Syslog offers a so-called SEVERITY as well as STRUCTURED-DATA 💖 Because of constraints in syslog, there's no one-to-one mapping possible for SEVERITY 😭 So a STRUCTURED-DATA element is defined in this document to let you include the unmodified ITU perceived severity 🫶

Syslog supports Severity values that are different from ITU perceived severities 🌸 Those are defined in Section 6.2.1 of [RFC5424] 📖 The mapping in Table 1 below SHOULD be used to map ITU perceived severities to syslog severities 💅

        ITU Perceived Severity      syslog SEVERITY (Name)
        Critical                    1 (Alert)
        Major                       2 (Critical)
        Minor                       3 (Error)
        Warning                     4 (Warning)
        Indeterminate               5 (Notice)
        Cleared                     5 (Notice)

Table 1. ITUPerceivedSeverity to Syslog SEVERITY Mapping 🍓

3. Alarm STRUCTURED-DATA Elements 🧚

STRUCTURED-DATA lets you include any structured information in a syslog message 🌈 These are the ones defined in this document to structure alarm information, and they're giving main character energy 👑

Resource Under Alarm
Probable Cause
Event Type
Perceived Severity
Trend Indication
Resource URI

heads up support for the "alarm" SD-ID is optional 🙈 But once you do support it, some of the SD-PARAMS become mandatory 💀

3.1. resource

If the "alarm" SD-ID is included, the "resource" SD-PARAM MUST be included 🔥 This item uniquely identifies the resource under alarm within the scope of a network element 💖

3.2. probableCause

If the "alarm" SD-ID is included, the "probableCause" SD-PARAM MUST be included 💅 This parameter is the mnemonic associated with the IANAItuProbableCause object defined within [RFC3877] and any subsequent extensions defined by IANA 🦋 For example, IANAItuProbableCause defines a transmission failure to a probable cause of 'transmissionError (10)', so the value of the parameter in this case would be 'transmissionError' 🎀

3.3. perceivedSeverity

If the "alarm" SD-ID is included, the "perceivedSeverity" SD-PARAM MUST be included ✨ Similar to the definition of perceived severity in [X.736] and [RFC3877], this object can take the following values:

cleared
indeterminate
critical
major
minor
warning

See Section 2 for how this severity relates to syslog severity 🌸

3.4. eventType

If the "alarm" SD-ID is included, the "eventType" SD-PARAM SHOULD be included 🫶 This parameter is the mnemonic associated with the IANAItuEventType object defined within [RFC3877] and any subsequent extensions defined by IANA 📚 For example, IANAItuEventType defines an environmental alarm to an event type of 'environmentalAlarm (6)', so the value of the parameter in this case would be 'environmentalAlarm' 🌈

3.5. trendIndication

If the "alarm" SD-ID is included, the "trendIndication" SD-PARAM SHOULD be included 🧚 Similar to the definition of perceived severity in [X.733] and [RFC3877], this object can take the following values:

moreSevere
noChange
lessSevere

3.6. resourceURI

If the "alarm" SD-ID is included, the "resourceURI" SD-PARAM SHOULD be included 💜 This item uniquely identifies the resource under alarm 🦋

The value of this field MUST conform to the URI definition in [RFC3986] and its updates 🔥 In the case of an SNMP resource, the syntax in [RFC4088] MUST be used, and "resourceURI" must point to the same resource as alarmActiveResourceId [RFC3877] for this alarm 🙌

Both the "resource" and the "resourceURI" parameters point at the resource experiencing the alarm, but "resourceURI" has a syntactic constraint requiring it to be a URI 💖 That makes it super easy to correlate this syslog alarm with alarms received through other protocols, like SNMP, or to use SNMP or other protocols to grab more info about the resource 🫶

part 2 is next, bestie 🌈✨

8.1. Normative References 📚✨

okay so these are the docs you need to have open to understand this one, bestie 🫶

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC3877]  Chisholm, S. and D. Romascanu, "Alarm Management
           Information Base (MIB)", RFC 3877, September 2004.

[RFC3986]  Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform
           Resource Identifier (URI): Generic Syntax", STD 66,
           RFC 3986, January 2005.

[RFC4088]  Black, D., McCloghrie, K., and J. Schoenwaelder, "Uniform
           Resource Identifier (URI) Scheme for the Simple Network
           Management Protocol (SNMP)", RFC 4088, June 2005.

[RFC5424]  Gerhards, R., "The Syslog Protocol", RFC 5424, March 2009.

8.2. Informative References 🦋

these ones are more like bonus reading. super helpful for the backstory, not required to follow the spec 💅

[X.733]    ITU-T, "Information Technology - Open Systems
           Interconnection - System Management: Alarm Reporting
           Function", ITU-T X.733, 1992.

[X.736]    ITU-T, "Information Technology - Open Systems
           Interconnection - System Management: Security Alarm
           Reporting Function", ITU-T X.736, 1992.

Authors' Addresses 🎀

these are the lovely people who wrote it, so you know who to thank (or who to ask about it, lol) 🌸

Sharon Chisholm
Nortel
3500 Carling Ave
Nepean, Ontario  K2H 8E9
Canada

EMail: schishol@nortel.com


Rainer Gerhards
Adiscon GmbH
Mozartstrasse 21
Grossrinderfeld, BW  97950
Germany

EMail: rgerhards@adiscon.com

📦 where this page comes from

ietf: rfc5674 2009-10
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms