RFC 5675
Mapping Simple Network Management Protocol (SNMP) Notifications to SYSLOG Messages
RFC 5675: Mapping SNMP Notifications to SYSLOG Messages 💖
okay bestie, this one is a Standards Track doc from October 2009, so it's an actual protocol spec and not just vibes 🧚. It's by V. Marinov and J. Schoenwaelder from Jacobs University Bremen 🎀. The header doesn't list anything it obsoletes or updates, so it just stands on its own ✨.
Abstract ✨
okay so the whole point is this: it defines a mapping from Simple Network Management Protocol (SNMP) notifications to SYSLOG messages 🦋.
Status of This Memo 📜
this doc is an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions for improvements 🫶. For the standardization state and status, check the current edition of the "Internet Official Protocol Standards" (STD 1) 💅. Distribution of this memo is unlimited 🌈.
Copyright Notice 🔥
Copyright (c) 2009 IETF Trust and the persons identified as the document authors. All rights reserved 💜.
this document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they're in effect on the publication date 📖. Read these docs carefully, because they explain your rights and restrictions for this document 🙈. Code Components pulled from this doc must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the BSD License 🍓.
Table of Contents 🗂️
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1. Conventions . . . . . . . . . . . . . . . . . . . . . . . 2
2. Background . . . . . . . . . . . . . . . . . . . . . . . . . . 3
2.1. SNMP Notifications . . . . . . . . . . . . . . . . . . . . 3
2.2. SYSLOG Notifications . . . . . . . . . . . . . . . . . . . 5
3. Mapping SNMP Notifications to SYSLOG Messages . . . . . . . . 5
3.1. SYSLOG Header . . . . . . . . . . . . . . . . . . . . . . 6
3.2. Structured Data . . . . . . . . . . . . . . . . . . . . . 7
3.3. MSG Data . . . . . . . . . . . . . . . . . . . . . . . . . 9
4. Relationship to the SYSLOG-MSG-MIB . . . . . . . . . . . . . . 10
5. Usage Example . . . . . . . . . . . . . . . . . . . . . . . . 10
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 12
7. Security Considerations . . . . . . . . . . . . . . . . . . . 13
8. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 13
9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 13
9.1. Normative References . . . . . . . . . . . . . . . . . . . 13
9.2. Informative References . . . . . . . . . . . . . . . . . . 141. Introduction ✨
SNMP and SYSLOG are two super popular protocols for sending event notifications 💅. Several management protocols can totally coexist in one environment, but some setups want every event notification collected by one single system daemon, like a SYSLOG collector or an SNMP notification receiver, through one management protocol 🎀. In those setups, you have to translate event notifications between management protocols 🔥.
the latest SYSLOG version, specified in [RFC5424], supports a structured data element format 🌸. Those structured data elements let us map between SNMP notifications and SYSLOG messages without losing information 😭. In this memo, we specify a concrete mapping from SNMP event notifications [RFC3416] into SYSLOG messages [RFC5424] 🦋. We spell out how the SYSLOG message format is used to carry what's inside an SNMP notification message 💜. We also define a brand new SYSLOG structured data element that carries the PDU portion of an SNMP notification message 👑.
1.1. Conventions 📖
a system that can receive SNMP notification messages from an SNMP notification originator, and then send the SNMP data inside them in a SYSLOG message format to a SYSLOG collector, is called an "SNMP-to-SYSLOG translator" in this memo 🧚. By definition, that box has an SNMP notification receiver application and a SYSLOG originator running so it can do the translator stuff 🍓.
the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are interpreted as described in [RFC2119] 🫶.
2. Background 🌈
2.1. SNMP Notifications 🔥
if you want a full intro to the SNMP Management Framework, check [RFC3410] 📚. The SNMP Management Architecture is described in [RFC3411] 💅. Managed objects are accessed through a virtual information store called the Management Information Base, or MIB [RFC3418] 🦋. Objects in the MIB are defined with the mechanisms from the Structure of Management Information (SMI) [RFC2578] ✨.
an SNMP notification message gets generated and sent by an SNMP entity on behalf of a notification originator application [RFC3413] 🎀. SNMP notifications are often used to tell a notification receiver application at a logically remote SNMP entity that an event happened, or that a certain condition is present 💜. Two types of SNMP protocol operations go with SNMP notification messages [RFC3416] 👑:
- SNMPv2-Trap-PDU, an unconfirmed notification delivery mechanism
- InformRequest-PDU, a confirmed notification delivery mechanism
the scopedPDU part of an SNMPv3 trap or inform message looks like this [RFC3412] 🧚:
ScopedPDU ::= SEQUENCE {
contextEngineID OCTET STRING,
contextName OCTET STRING,
data ANY -- e.g., PDUs as defined in [RFC3416]
}the data member of the SEQUENCE ScopedPDU carries an SNMPv2-Trap-PDU or an InformRequest-PDU 🍓. They have the same structure, which is:
PDUs ::= [7] IMPLICIT SEQUENCE {
request-id INTEGER,
error-status INTEGER, -- ignored in notifications
error-index INTEGER, -- ignored in notifications
variable-bindings VarBindList
}
-- variable binding
VarBind ::= SEQUENCE {
name ObjectName,
CHOICE {
value ObjectSyntax,
unSpecified NULL, -- in retrieval requests
-- exceptions in responses
noSuchObject [0] IMPLICIT NULL,
noSuchInstance [1] IMPLICIT NULL,
endOfMibView [2] IMPLICIT NULL
}
}
-- variable-binding list
VarBindList ::= SEQUENCE (SIZE (0..max-bindings)) OF VarBindthe first two variable bindings in the variable binding list of an SNMPv2-Trap-PDU or InformRequest-PDU are sysUpTime.0 [RFC3418] and snmpTrapOID.0 [RFC3418], in that order 🫶. If the OBJECTS clause is in the invocation of the matching NOTIFICATION-TYPE macro, then each corresponding variable, as instantiated by this notification, gets copied, in order, into the variable-bindings field 🌸. If any extra variables are included (that's up to the generating SNMP entity), each one is copied into the variable-bindings field too 💖.
for SNMPv1 or SNMPv2c notifications, the contextEngineID and contextName parameters aren't in the notification messages at all 🙈.
this document assumes notifications are in the format defined in [RFC3416] ✨. Notifications in the SNMPv1 notification format MUST be translated as described in Section 3.1 of [RFC3584] 🔥.
2.2. SYSLOG Notifications 🦋
the SYSLOG protocol is defined in [RFC5424] 💅. A message has a global header and a bunch of structured data elements 🌈. The ABNF [RFC5234] representation of a SYSLOG message is defined in RFC 5424 [RFC5424] 📖. These are the productions that matter for structured data elements:
STRUCTURED-DATA = NILVALUE / 1*SD-ELEMENT
SD-ELEMENT = "[" SD-ID *(SP SD-PARAM) "]"
SD-PARAM = PARAM-NAME "=" %d34 PARAM-VALUE %d34
SD-ID = SD-NAME
PARAM-NAME = SD-NAME
PARAM-VALUE = UTF-8-STRING ; characters '"', '\' and
; ']' MUST be escaped.
SD-NAME = 1*32PRINTUSASCII
; except '=', SP, ']', %d34 (")
UTF-8-STRING = *OCTET ; Any VALID UTF-8 String
; "shortest form" MUST be used
OCTET = %d00-255
SP = %d32
PRINTUSASCII = %d33-126
NILVALUE = "-"3. Mapping SNMP Notifications to SYSLOG Messages 🎀
okay this is the main event 💅. This section defines how the scopedPDU part of an SNMP notification message gets used to make a message in SYSLOG format 🦋. The notification receiver application at the SNMP-to-SYSLOG translator is listening for incoming notifications 👑. Once the SNMP engine gets a notification, the data portion is forwarded to the notification receiver application 🧚. That data portion holds the scopedPDU, and the SYSLOG originator on the SNMP-to-SYSLOG translator uses it to make a SYSLOG message and send it to a SYSLOG collector (or proxy) 💜. Also, every SNMP notification maps to exactly one SYSLOG message 🔥.
+------------+ +------------------+
|snmp | snmp | | syslog +---------+
|notification| notification | +------------+ | message |syslog |
|originator |------------->| |syslog | |-------->|collector|
+------------+ | |originator | | +---------+
+------------+ | +------------+ |
|snmp | snmp | +------------+ | syslog +---------+
|notification| notification | |snmp | | message |syslog |
|originator |------------->| |notification| |-------->|collector|
+------------+ | |receiver | | +---------+
+------------+ | +------------+ |
|snmp | snmp | |
|notification| notification | SNMP-to-SYSLOG |
|originator |------------->| translator |
+------------+ +------------------+
Figure 1: SNMP-to-SYSLOG Translator Deploymentin the common setup shown in Figure 1, lots of SNMP notification originators can send SNMP event notifications to one SNMP-to-SYSLOG translator 🌸. The translator pulls out the data portion of the notification, makes a SYSLOG message, and sends it to a SYSLOG collector, which is in charge of collecting and storing all the notification messages 🌈. The arrows in Figure 1 show message flows, not individual messages 🙈.
the SNMP-to-SYSLOG translator isn't transparent to a SYSLOG collector 😭. The global header of the SYSLOG message the translator makes gets filled with parameters specific to the system running the translator, like its hostname, timestamp, and so on ✨. The data portion (scopedPDU for SNMPv3, or PDU for SNMPv1/SNMPv2c) of the SNMP notification message lives in the structured data of the SYSLOG message 💖.
Implementations MUST drop invalid SNMP messages before they are passed to the SNMP-to-SYSLOG translator. 🚨
3.1. SYSLOG Header 🎀
okay so the SNMP-to-SYSLOG translator is the one filling in the HEADER field of a SYSLOG message, and it uses stuff specific to whatever system it's running on 🧚. the default facility level for SYSLOG messages carrying SNMP notifications SHOULD be 3, which is the one for messages from system daemons 💅. the default severity level SHOULD be 5, aka "Notice: normal but significant condition" ✨. ngl, if the translator knows what kind of notification it got, it might pick different facility and severity values, and that's totally fine 🦋
the VERSION, TIMESTAMP, HOSTNAME, APP-NAME, PROCID, and MSGID fields in the header all get values that are specific to the system the translator is running on 🌸. and the HEADER has to be seven-bit ASCII in an eight-bit field, just like [RFC5424] describes. this part is not optional, bestie, the character set MUST be that 🙈
3.2. Structured Data 🌈
the STRUCTURED-DATA field is where the ScopedPDU (or PDU) part of an SNMP notification message lives 💜. to make that possible, there's a brand new SD-ID element defined just for this. here's the ABNF from [RFC5234] for the new structured element, and it's giving very precise energy 🤓
SNMP-SD-ELEMENT = "[" SNMP-SD-ID [CTX] *VARBIND "]"
SNMP-SD-ID = %x73.6E.6D.70 ; snmp
CTX = CTXENGINE CTXNAME
CTXENGINE = SP "ctxEngine=" %d34 HEXSTRING %d34
CTXNAME = SP "ctxName=" %d34 PARAM-VALUE %d34
VARBIND = SP VARNAME [SP VARLABEL] SP VARVALUE [SP VALSTRING]
VARNAME = %d118 NUM "=" %d34 OID %d34 ; "vN="
VARLABEL = %d108 NUM "=" %d34 PARAM-VALUE %d34 ; "lN="
VARVALUE = VALOID / VALHEXSTRING / VALCOUNTER32 / VALCOUNTER64
/ VALUNSIGNED32 / VALINTEGER32 / VALIP / VALNULL
/ VALOPAQUE / VALTIMETICKS / VALSTRING
VALOID = %d111 NUM "=" %d34 OID %d34 ; "oN="
VALHEXSTRING = %d120 NUM "=" %d34 HEXSTRING %d34 ; "xN="
VALCOUNTER32 = %d99 NUM "=" %d34 UNSIGNED32 %d34 ; "cN="
VALCOUNTER64 = %d67 NUM "=" %d34 UNSIGNED64 %d34 ; "CN="
VALUNSIGNED32 = %d117 NUM "=" %d34 UNSIGNED32 %d34 ; "uN="
VALINTEGER32 = %d100 NUM "=" %d34 INTEGER32 %d34 ; "dN="
VALIP = %d105 NUM "=" %d34 IPV4ADDRESS %d34 ; "iN="
VALNULL = %d110 NUM "=" %d34 %d34 ; "nN="
VALOPAQUE = %d112 NUM "=" %d34 HEXSTRING %d34 ; "pN="
VALTIMETICKS = %d116 NUM "=" %d34 UNSIGNED32 %d34 ; "tN="
VALSTRING = %d97 NUM "=" %d34 PARAM-VALUE %d34 ; "aN="
NUM = NONZERODIGIT 0*DIGIT
OID = OIDSTART *("." OIDSUBID)
OIDSTART = (("0." / "1.") [%d49-51] DIGIT) / ("2." OIDSUBID)
OIDSUBID = ZERO / (NONZERODIGIT *DIGIT)
PARAM-VALUE = UTF-8-STRING ; characters '"', '\' and
; ']' MUST be escaped.
UTF-8-STRING = *OCTET ; Any VALID UTF-8 String
; "shortest form" MUST be used
HEXSTRING = *HEX
INTEGER32 = ["-"] NONZERODIGIT 0*DIGIT
UNSIGNED32 = NONZERODIGIT 0*DIGIT
UNSIGNED64 = NONZERODIGIT 0*DIGIT
IPV4ADDRESS = d8 "." d8 "." d8 "." d8
d8 = DIGIT ; 0-9
/ %d49-57 DIGIT ; 10-99
/ "1" 2DIGIT ; 100-199
/ "2" %d48-52 DIGIT ; 200-249
/ "25" %d48-53 ; 250-255
HEX = DIGIT / %x41-46 / %x61-66 ; 0-9 / A-F / a-f
NONZERODIGIT = %d49-57
ZERO = %d48
DIGIT = ZERO / NONZERODIGIT
SP = %d32every SNMP-SD-ELEMENT starts with the SD-ID "snmp" 🧁. the first two SD-ID parameters are "ctxEngine" and "ctxName". the context MUST be present in an SNMPv3 notification, so "ctxEngine" and "ctxName" MUST be present in a SYSLOG message made by the translator from an SNMPv3 notification 🫶. the contextEngineID gets encoded as a hexadecimal string, and the contextName gets encoded as a UTF8 string 💖
the other parameters in the "snmp" SD-ID match up with the varbind list elements in the SNMP PDU 🦋. a varbind's name is encoded as an OID in dotted notation, and that rendered OID goes in a "vN" parameter. the N tells you where the varbind sits in the varbind list (the first varbind is position 1) 🍓. a MIB-aware implementation may also generate an "lN" parameter with the descriptor of the MIB object plus the instance identifier suffix (also called an OID label). the N in that one again points to the varbind's position in the list 📚
the value of a varbind gets encoded based on its type, following Table 1 below. type-specific parameter names carry the type info, and the N once more is the varbind's position in the SNMP message's varbind list 👑. a MIB-aware implementation may also generate an "aN" parameter with an alternate textual version of the value, made by applying DISPLAY-HINTs and turning named numbers into labels or OBJECT IDENTIFIER values into descriptors 🌸. for SNMP object types with a DISPLAY-HINT of the form 'Ma' or 'Mt' (where M is some number), a MIB-aware implementation can choose to include the "aN" parameter and drop the matching "xN" parameter. this is a space-saver for textual objects 🧚. a receiver that gets an "aN" parameter with no matching value at position N can turn the "aN" value back into an OCTET STRING value without any confusion 💅
heads up: the labels and alternate values make SYSLOG messages way easier for humans to read, but they also make the message bigger, and that can cause the SYSLOG message to get truncated. so implementations SHOULD provide a configuration mechanism to turn on or off the generation of those OID label and alternate value parameters 😭
here's Table 1, the mapping of SNMP types to SD params 🌈
+--------------------+------------+--------------------------+
| SNMP Type | PARAM-NAME | Value Encoding |
+--------------------+------------+--------------------------+
| OBJECT IDENTIFIER | oN | dotted-decimal notation |
| OCTET STRING | xN | hexadecimal string |
| Counter32 | cN | unsigned decimal number |
| Counter64 | CN | unsigned decimal number |
| Unsigned32 | uN | unsigned decimal number |
| INTEGER, Integer32 | dN | signed decimal number |
| IpAddress | iN | dotted quad notation |
| Opaque | pN | hexadecimal (BER) string |
| TimeTicks | tN | unsigned decimal number |
| NULL | nN | zero-length string |
+--------------------+------------+--------------------------+
Table 1: Mapping of SNMP Types to SD Paramsthe SYSLOG message the translator generates can also include other structured data elements, alongside the SNMP-SD-ELEMENT, in its structured data part ✨. those extra elements MUST comply with the spec in [RFC5424] 💜
in particular, the parameters in the "origin" SD-ID SHOULD identify who originated the SNMP notification 🕵️♀️. a suitable value for the "ip" parameter MAY come from the snmpTrapAddress varbind if it's there, and a suitable value for the "enterpriseId" parameter MAY be pulled from the snmpTrapOID varbind 🎀
3.3. MSG Data 🦋
the MSG part of the SYSLOG message is optional 🫶. it can hold a free-form message that gives a textual description of the SNMP event notification ✨. according to [RFC5424], the character set used in MSG SHOULD be Unicode, encoded with UTF-8 as specified in [RFC3629] 🌸. if the originator can't encode the MSG in Unicode, it MAY use any other encoding 💅. the originator MAY also use the "language" parameters defined in [RFC5424] to say which natural language is used inside MSG 🌍
4. Relationship to the SYSLOG-MSG-MIB 🌈
a companion document, [RFC5676], defines an SNMP MIB module that represents SYSLOG messages and sends them as SNMP notifications to SNMP notification receivers 📬. this section looks at how the two specs can work together 👑
a SYSLOG collector that implements the SYSLOG-MSG-MIB module and the mapping of SNMP notifications to SYSLOG messages can be configured to translate received SYSLOG messages that contain SNMP notifications back into the original SNMP notification 🔁. in that setup, the relevant tables of the SYSLOG-MSG-MIB won't be populated for SYSLOG messages carrying SNMP notifications 🙈. this lets operators build a forwarding chain where SNMP notifications get "tunneled" through SYSLOG messages 🚇. but because of size limits on SYSLOG transports and the wordier textual encoding SYSLOG uses, SNMP notification content can get truncated when it's tunneled through SYSLOG, so the resulting SNMP notification may be incomplete 😭
an SNMP management application that supports the SYSLOG-MSG-MIB and the mapping of SNMP notifications to SYSLOG messages can process information from the SYSLOG-MSG-MIB to emit a SYSLOG message that represents the one recorded in the SYSLOG-MSG-MIB module 🧚. this setup lets operators build a forwarding chain where SYSLOG messages get "tunneled" through SNMP messages 🦋. a notification receiver can figure out whether a syslogMsgNotification contained all the structured data element parameters of a SYSLOG message 🔍. if parameters are missing, a forwarding application MUST retrieve the missing parameters from the SYSLOG-MSG-MIB 💅. regular polling of the SYSLOG-MSG-MIB can be used to cover any lost SNMP notifications 🫶
5. Usage Example ✨
okay so let's walk through a real example 💖 we're gonna take an SNMP linkUp trap and map it into a SYSLOG message using the mappings from Section 3.1 and Section 3.2 🦋
The linkUp notification is defined in [RFC2863] like this:
linkUp NOTIFICATION-TYPE
OBJECTS { ifIndex, ifAdminStatus, ifOperStatus }
STATUS current
DESCRIPTION
"A linkUp trap signifies that the SNMP entity, acting in an
agent role, has detected that the ifOperStatus object for
one of its communication links left the down state and
transitioned into some other state (but not into the
notPresent state). This other state is indicated by the
included value of ifOperStatus."
::= { snmpTraps 4 }The scopedPDU portion of an SNMP linkUp trap sent using the SNMPv3 message format is shown below. The left column shows the Basic Encoding Rules (BER) encoding, and the right column shows the matching ASN.1 definitions 🧚
30:7C SEQUENCE {
04:08:80:00:02:B8:04:61:62:63 800002b804616263
04:04:63:74:78:31 "ctx1"
A7:6A SNMPv2-Trap-PDU {
02:03:6D:08:67 INTEGER 7145575
02:01:00 INTEGER 0
02:01:00 INTEGER 0
30:5D SEQUENCE OF {
30:0F SEQUENCE {
06:08:2B:06:01:02:01:01:03:00 sysUpTime.0
43:03:01:72:8C 94860 }
30:17 SEQUENCE {
06:0A:2B:06:01:06:03:01:01:04:01:00 snmpTrapOID.0
06:09:2B:06:01:06:03:01:01:05:04 linkUp }
30:0F SEQUENCE {
06:0A:2B:06:01:02:01:02:02:01:01:03 ifIndex.3
02:01:03 3 }
30:0F SEQUENCE {
06:0A:2B:06:01:02:01:02:02:01:07:03 ifAdminStatus.3
02:01:01 up(1) }
30:0F SEQUENCE {
06:0A:2B:06:01:02:01:02:02:01:08:03 ifOperStatus.3
02:01:01 up(1) } } } }The corresponding SYSLOG message generated by the SNMP-to-SYSLOG translator is shown below. (SYSLOG examples should be considered to be on one line. They are wrapped on multiple lines in this document for readability purposes only.) 🌸
<29>1 2003-10-11T22:14:15.003Z mymachine.example.com snmptrapd - ID47
[snmp ctxEngine="800002b804616263" ctxName="ctx1"
v1="1.3.6.1.2.1.1.3.0" l1="sysUpTime.0" d1="94860"
v2="1.3.6.1.6.3.1.1.4.1.0" l2="snmpTrapOID.0"
o2="1.3.6.1.6.3.1.1.5.4" a2="linkUp"
v3="1.3.6.1.2.1.2.2.1.1.3" d3="3"
v4="1.3.6.1.2.1.2.2.1.7.3" d4="1" a4="up"
v5="1.3.6.1.2.1.2.2.1.8.3" d5="1" a5="up"]Okay, now let's decode the header 🔍 The priority value is 29, which means a facility level of 3 (system daemons) and a severity level of 5 (Notice: normal but significant condition), using the priority calculation from Section 6.2.1 of [RFC5424]. The rest of the header fields are parameters specific to the system running the SNMP-to-SYSLOG translator. The SYSLOG version is 1, and the message was generated at 22:14:15.003Z on 2003-10-11T by the host "mymachine.example.com". The application on the translator that made the message was "snmptrapd". There's no process id info, and the message is identified with the MSGID of ID47 on the SNMP-to-SYSLOG system 💅
Now the structured data 😭 There's one structured data element with an SD-ID of "snmp", which tells us this is the scopedPDU portion of an SNMP event notification message. The data is associated with the ContextEngineID "123456" and ContextName "ctx1". The request-id of the SNMP notification message was "7145575". After that comes the data portion of the scopedPDU. The first two variables in the data portion are always sysUpTime.0 and snmpTrapOID.0. An snmpTrapOID.0 with a value of "1.3.6.1.6.3.1.1.5.4" means it's a linkUp trap 🙈 The parameters v3="1.3.6.1.2.1.2.2.1.1.3" and d3="3" mean the notification is carrying the ifIndex object, which is type INTEGER with a value of 3. The parameters v4="1.3.6.1.2.1.2.2.1.7.3" and d4="1" mean it's carrying ifAdminStatus, type INTEGER, value 1. And v5="1.3.6.1.2.1.2.2.1.8.3" with d5="1" mean it's carrying ifOperStatus, type INTEGER, value "1". Main character energy 👑
6. IANA Considerations 🎀
IANA registered the SD-ID value "snmp" together with the PARAM-NAME values from Section 3.2 in the registry for SYSLOG Structured Data ID Values, following Section 9 in [RFC5424]. The notation <N> indicates a position number. Here's the table:
SD-ID PARAM-NAME
snmp OPTIONAL
ctxEngine OPTIONAL
ctxName OPTIONAL
v<N> OPTIONAL
l<N> OPTIONAL
o<N> OPTIONAL
x<N> OPTIONAL
c<N> OPTIONAL
C<N> OPTIONAL
u<N> OPTIONAL
d<N> OPTIONAL
i<N> OPTIONAL
n<N> OPTIONAL
p<N> OPTIONAL
t<N> OPTIONAL
a<N> OPTIONAL7. Security Considerations 🔐
The security considerations discussed in [RFC5424] apply to this document. Read those too, bestie, they matter 🫶
The SNMP architecture supports an access control mechanism, which makes sure SNMP notifications only go to receivers who are authorized to get them. So network operators using this SNMP-to-SYSLOG mapping should enforce a consistent policy 🚨 If they don't, people could reach SNMP notifications through the SYSLOG mapping that they otherwise couldn't access. That is a serious leak, and it's totally avoidable if everyone's on the same page 💀
8. Acknowledgments 💜
The editors want to thank the following people for their helpful comments on various versions of this document: Martin Bjorklund, Washam Fan, Rainer Gerhards, Tom Petch, and Dan Romascanu. Iconic squad 🌈
9. References 📚
9.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3411] Harrington, D., Presuhn, R., and B. Wijnen, "An Architecture for Describing Simple Network Management Protocol (SNMP) Management Frameworks", STD 62, RFC 3411, December 2002.
[RFC3412] Case, J., Harrington, D., Presuhn, R., and B. Wijnen, "Message Processing and Dispatching for the Simple Network Management Protocol (SNMP)", STD 62, RFC 3412, December 2002.
[RFC3413] Levi, D., Meyer, P., and B. Stewart, "Simple Network Management Protocol (SNMP) Applications", STD 62, RFC 3413, December 2002.
[RFC3416] Presuhn, R., "Version 2 of the Protocol Operations for the Simple Network Management Protocol (SNMP)", STD 62, RFC 3416, December 2002.
[RFC3418] Presuhn, R., "Management Information Base (MIB) for the Simple Network Management Protocol (SNMP)", STD 62, RFC 3418, December 2002.
[RFC3584] Frye, R., Levi, D., Routhier, S., and B. Wijnen, "Coexistence between Version 1, Version 2, and Version 3 of the Internet-standard Network Management Framework", BCP 74, RFC 3584, August 2003.
[RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO 10646", STD 63, RFC 3629, November 2003.
[RFC5234] Crocker, D. and P. Overell, "Augmented BNF for Syntax Specifications: ABNF", RFC 5234, January 2008.
[RFC5424] Gerhards, R., "The Syslog Protocol", RFC 5424, March 2009.
[RFC5676] Schoenwaelder, J., Clemm, A., and A. Karmakar, "Definitions of Managed Objects for Mapping SYSLOG Messages to Simple Network Management Protocol (SNMP) Notifications", RFC 5676, October 2009.
9.2. Informative References
[RFC2578] McCloghrie, K., Perkins, D., and J. Schoenwaelder, "Structure of Management Information Version 2 (SMIv2)", RFC 2578, STD 58, April 1999.
[RFC2863] McCloghrie, K. and F. Kastenholz, "The Interfaces Group MIB", RFC 2863, June 2000.
[RFC3410] Case, J., Mundy, R., Partain, D., and B. Stewart, "Introduction and Applicability Statements for Internet-Standard Management Framework", RFC 3410, December 2002.
Authors' Addresses 🦋
Vladislav Marinov
Jacobs University Bremen
Campus Ring 1
28725 Bremen
Germany
EMail: v.marinov@jacobs-university.de
Juergen Schoenwaelder
Jacobs University Bremen
Campus Ring 1
28725 Bremen
Germany
EMail: j.schoenwaelder@jacobs-university.de📦 where this page comes from
- ietf: rfc5675 2009-10
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms