SLAPM-MIB

OCTET STRING SIZE (0 | 4 | 16)

Address of a system that an Policy definition relates to. A zero length octet string must be used to indicate that only a single system is being represented. Otherwise, the length of the octet string must be 4 for an ipv4 address or 16 for an ipv6 address.

SlapmNameTypeThe textual convention for naming entities within this MIB. The actual contents of an object defined using this textual convention should consist of the distinguished name portion of an name. This is usually the right-most portion of the name. This convention is necessary, since names within this MIB can be used as index items and an instance identifier is limited to 128 subidentifiers. This textual convention has been deprecated. All of the tables defined within this MIB that use this textual convention have been deprecated as well since the method of using a portion of the name (either of a policy definition or of a traffic profile) has been replaced by using an Unsigned32 index. The new slapmPolicyNameTable would then map the Unsigned32 index to a real name. SIZE (0..32) · OCTET STRING · hint 255t

Policy name that this entry relates to.

SlapmNameTypeThe textual convention for naming entities within this MIB. The actual contents of an object defined using this textual convention should consist of the distinguished name portion of an name. This is usually the right-most portion of the name. This convention is necessary, since names within this MIB can be used as index items and an instance identifier is limited to 128 subidentifiers. This textual convention has been deprecated. All of the tables defined within this MIB that use this textual convention have been deprecated as well since the method of using a portion of the name (either of a policy definition or of a traffic profile) has been replaced by using an Unsigned32 index. The new slapmPolicyNameTable would then map the Unsigned32 index to a real name. SIZE (0..32) · OCTET STRING · hint 255t

The name of a traffic profile that is associated with a policy.

INTEGER1 = inactive2 = active3 = deleteNeeded · Integer32

The state of a policy entry: inactive(1) - An policy entry was either defined by local system definition or discovered via a directory search but has not been activated (not currently being used). active(2) - Policy entry is being used to affect traffic flows. deleteNeeded(3) - Either though local implementation dependent methods or by discovering that the directory entry corresponding to this table entry no longer exists and slapmPolicyPurgeTime needs to expire before attempting to remove the corresponding slapmPolicyStatsEntry and any dependent slapmPolicyMonitor table entries. Note: a policy traffic profile in a state other than active(1) is not being used to affect traffic flows.

Gauge32

The number of active TCP connections that are affected by the corresponding policy entry.

Counter32

The number of total TCP connections that are affected by the corresponding policy entry.

DateAndTimeA date-time specification. field octets contents range ----- ------ -------- ----- 1 1-2 year* 0..65536 2 3 month 1..12 3 4 day 1..31 4 5 hour 0..23 5 6 minutes 0..59 6 7 seconds 0..60 (use 60 for leap-second) 7 8 deci-seconds 0..9 8 9 direction from UTC '+' / '-' 9 10 hours from UTC* 0..13 10 11 minutes from UTC 0..59 * Notes: - the value of year is in network-byte order - daylight saving time in New Zealand is +13 For example, Tuesday May 26, 1992 at 1:30:15 PM EDT would be displayed as: 1992-5-26,13:30:15.0,-4:0 Note that if only local time is known, then timezone information (fields 8-10) is not present. SIZE (8 | 11) · OCTET STRING · hint 2d-1d-1d,1d:1d:1d.1d,1a1d:1d

The timestamp for when the corresponding policy entry is activated. The value of this object serves as the discontinuity event indicator when polling entries in this table. The value of this object is updated on transition of slapmPolicyStatsOperStatus into the active(2) state.

DateAndTimeA date-time specification. field octets contents range ----- ------ -------- ----- 1 1-2 year* 0..65536 2 3 month 1..12 3 4 day 1..31 4 5 hour 0..23 5 6 minutes 0..59 6 7 seconds 0..60 (use 60 for leap-second) 7 8 deci-seconds 0..9 8 9 direction from UTC '+' / '-' 9 10 hours from UTC* 0..13 10 11 minutes from UTC 0..59 * Notes: - the value of year is in network-byte order - daylight saving time in New Zealand is +13 For example, Tuesday May 26, 1992 at 1:30:15 PM EDT would be displayed as: 1992-5-26,13:30:15.0,-4:0 Note that if only local time is known, then timezone information (fields 8-10) is not present. SIZE (8 | 11) · OCTET STRING · hint 2d-1d-1d,1d:1d:1d.1d,1a1d:1d

The timestamp for when the last time that the associated policy entry was used.

Counter32

The number of octets that was received by IP for an entity that map to this entry.

Counter32

The number of octets that was transmitted by IP for an entity that map to this entry.

Integer32

The limit for the number of active TCP connections that are allowed for this policy definition. A value of zero for this object implies that a connection limit has not been specified.

Counter32

This counter is incremented when a policy action's Permission value is set to Accept and a session (TCP connection) is accepted.

Counter32

This counter is incremented when a policy action's Permission value is set to Deny and a session is denied, or when a session (TCP connection) is rejected due to a policy's connection limit (slapmPolicyStatsConnectLimit) being reached.

Counter32

This counter counts the number of in octets discarded. This occurs when an error is detected. Examples of this are buffer overflow, checksum error, or bad packet format.

Counter32

This counter counts the number of out octets discarded. Examples of this are buffer overflow, checksum error, or bad packet format.

Counter32

This counter counts the number of in packets received that relate to this policy entry from IP.

Counter32

This counter counts the number of out packets sent by IP that relate to this policy entry.

Counter32

This counter counts the number of in octets that are determined to be within profile.

Counter32

This counter counts the number of out octets that are determined to be within profile.

Integer32 · Kilobits per second

The minimum transfer rate defined for this entry.

Integer32 · Kilobits per second

The maximum transfer rate defined for this entry.

Integer32 · milliseconds

The maximum delay defined for this entry.

SnmpAdminStringAn octet string containing administrative information, preferably in human-readable form. To facilitate internationalization, this information is represented using the ISO/IEC IS 10646-1 character set, encoded as an octet string using the UTF-8 transformation format described in [RFC2279]. Since additional code points are added by amendments to the 10646 standard from time to time, implementations must be prepared to encounter any code point from 0x00000000 to 0x7fffffff. Byte sequences that do not correspond to the valid UTF-8 encoding of a code point or are outside this range are prohibited. The use of control codes should be avoided. When it is necessary to represent a newline, the control code sequence CR LF should be used. The use of leading or trailing white space should be avoided. For code points not directly supported by user interface hardware or software, an alternative means of entry and display, such as hexadecimal, may be provided. For information encoded in 7-bit US-ASCII, the UTF-8 encoding is identical to the US-ASCII encoding. UTF-8 may require multiple bytes to represent a single character / code point; thus the length of this object in octets may be different from the number of characters encoded. Similarly, size constraints refer to the number of encoded octets, not the number of characters represented by an encoding. Note that when this TC is used for an object that is used or envisioned to be used as an index, then a SIZE restriction MUST be specified so that the number of sub-identifiers for any object instance does not exceed the limit of 128, as defined by [RFC3416]. Note that the size of an SnmpAdminString object is measured in octets, not characters. SIZE (0..16) · OCTET STRING · hint 255t

To facilitate the provisioning of access control by a security administrator using the View-Based Access Control Model (RFC 2575, VACM) for tables in which multiple users may need to independently create or modify entries, the initial index is used as an 'owner index'. Such an initial index has a syntax of SnmpAdminString, and can thus be trivially mapped to a securityName or groupName as defined in VACM, in accordance with a security policy. All entries in that table belonging to a particular user will have the same value for this initial index. For a given user's entries in a particular table, the object identifiers for the information in these entries will have the same subidentifiers (except for the 'column' subidentifier) up to the end of the encoded owner index. To configure VACM to permit access to this portion of the table, one would create vacmViewTreeFamilyTable entries with the value of vacmViewTreeFamilySubtree including the owner index portion, and vacmViewTreeFamilyMask 'wildcarding' the column subidentifier. More elaborate configurations are possible.

OCTET STRING SIZE (0 | 4 | 16)

Address of a system that an Policy definition relates to. A zero length octet string can be used to indicate that only a single system is being represented. Otherwise, the length of the octet string should be 4 for an ipv4 address and 16 for an ipv6 address.

SlapmNameTypeThe textual convention for naming entities within this MIB. The actual contents of an object defined using this textual convention should consist of the distinguished name portion of an name. This is usually the right-most portion of the name. This convention is necessary, since names within this MIB can be used as index items and an instance identifier is limited to 128 subidentifiers. This textual convention has been deprecated. All of the tables defined within this MIB that use this textual convention have been deprecated as well since the method of using a portion of the name (either of a policy definition or of a traffic profile) has been replaced by using an Unsigned32 index. The new slapmPolicyNameTable would then map the Unsigned32 index to a real name. SIZE (0..32) · OCTET STRING · hint 255t

Policy name that this entry relates to.

SlapmNameTypeThe textual convention for naming entities within this MIB. The actual contents of an object defined using this textual convention should consist of the distinguished name portion of an name. This is usually the right-most portion of the name. This convention is necessary, since names within this MIB can be used as index items and an instance identifier is limited to 128 subidentifiers. This textual convention has been deprecated. All of the tables defined within this MIB that use this textual convention have been deprecated as well since the method of using a portion of the name (either of a policy definition or of a traffic profile) has been replaced by using an Unsigned32 index. The new slapmPolicyNameTable would then map the Unsigned32 index to a real name. SIZE (0..32) · OCTET STRING · hint 255t

The corresponding Traffic Profile name.

BITS

The value of this object determines the type and level of monitoring that is applied to a policy/profile. The value of this object can't be changed once the table entry that it is a part of is activated via a slapmPolicyMonitorRowStatus transition to active state. monitorMinRate(0) - Monitor minimum transfer rate. monitorMaxRate(1) - Monitor maximum transfer rate. monitorMaxDelay(2) - Monitor maximum delay. enableAggregateTraps(3) - The enableAggregateTraps(3) BITS setting enables notification generation when monitoring a policy traffic profile as an aggregate using the values in the corresponding slapmPolicyStatsEntry. By default this function is not enabled. enableSubcomponentTraps(4) - This BITS setting enables notification generation when monitoring all subcomponents that are mapped to an corresponding slapmPolicyStatsEntry. By default this function is not enabled. monitorSubcomponents(5) - This BITS setting enables monitoring of each subcomponent (typically a TCP connection or UDP listener) individually.

SlapmStatusThe textual convention for defining the various slapmPRMonTable (or old slapmPolicyMonitorTable) and the slapmSubcomponentTable states for actual policy rule traffic monitoring. · BITS

The value of this object indicates when a monitored value has not meet a threshold or isn't meeting the defined service level. The SlapmStatus TEXTUAL-CONVENTION defines two levels of not meeting a threshold. The first set: slaMinInRateNotAchieved(0), slaMaxInRateExceeded(1), slaMaxDelayExceeded(2), slaMinOutRateNotAchieved(3), slaMaxOutRateExceeded(4) are used to indicate when the SLA as an aggregate is not meeting a threshold while the second set: monitorMinInRateNotAchieved(5), monitorMaxInRateExceeded(6), monitorMaxDelayExceeded(7), monitorMinOutRateNotAchieved(8), monitorMaxOutRateExceeded(9) indicate that at least one subcomponent is not meeting a threshold.

Integer32 (15..86400) · seconds

The number of seconds that defines the sample period.

DateAndTimeA date-time specification. field octets contents range ----- ------ -------- ----- 1 1-2 year* 0..65536 2 3 month 1..12 3 4 day 1..31 4 5 hour 0..23 5 6 minutes 0..59 6 7 seconds 0..60 (use 60 for leap-second) 7 8 deci-seconds 0..9 8 9 direction from UTC '+' / '-' 9 10 hours from UTC* 0..13 10 11 minutes from UTC 0..59 * Notes: - the value of year is in network-byte order - daylight saving time in New Zealand is +13 For example, Tuesday May 26, 1992 at 1:30:15 PM EDT would be displayed as: 1992-5-26,13:30:15.0,-4:0 Note that if only local time is known, then timezone information (fields 8-10) is not present. SIZE (8 | 11) · OCTET STRING · hint 2d-1d-1d,1d:1d:1d.1d,1a1d:1d

The timestamp for when the last interval ended.

Gauge32 · kilobits per second

Using the value of the corresponding slapmPolicyMonitorInterval, slapmPolicyStatsInOctets is sampled and then divided by slapmPolicyMonitorInterval to determine the current in transfer rate.

Gauge32 · kilobits per second

Using the value of the corresponding slapmPolicyMonitorInterval, slapmPolicyStatsOutOctets is sampled and then divided by slapmPolicyMonitorInterval to determine the current out transfer rate.

Integer32 · kilobits per second

The threshold for generating a slapmMonitoredEventNotAchieved notification, signalling that a monitored minimum transfer rate has not been meet. A slapmMonitoredEventNotAchieved notification is not generated again for an slapmPolicyMonitorEntry until the minimum transfer rate exceeds slapmPolicyMonitorMinRateHigh (a slapmMonitoredEventOkay notification is then transmitted) and then fails below slapmPolicyMonitorMinRateLow. This behavior reduces the slapmMonitoredEventNotAchieved notifications that are transmitted. A value of zero for this object is returned when the slapmPolicyMonitorControl monitorMinRate(0) is not enabled. When enabled the default value for this object is the min rate value specified in the associated action definition minus 10%. If the action definition doesn't have a min rate defined then there is no default for this object and a value MUST be specified prior to activating this entry when monitorMinRate(0) is selected. Note: The corresponding slapmPolicyMonitorControl BITS setting, enableAggregateTraps(3), MUST be selected in order for any notification relating to this entry to potentially be generated.

Integer32 · kilobits per second

The threshold for generating a slapmMonitoredEventOkay notification, signalling that a monitored minimum transfer rate has increased to an acceptable level. A value of zero for this object is returned when the slapmPolicyMonitorControl monitorMinRate(0) is not enabled. When enabled the default value for this object is the min rate value specified in the associated action definition plus 10%. If the action definition doesn't have a min rate defined then there is no default for this object and a value MUST be specified prior to activating this entry when monitorMinRate(0) is selected. Note: The corresponding slapmPolicyMonitorControl BITS setting, enableAggregateTraps(3), MUST be selected in order for any notification relating to this entry to potentially be generated.

Integer32 · kilobits per second

The threshold for generating a slapmMonitoredEventNotAchieved notification, signalling that a monitored maximum transfer rate has been exceeded. A slapmMonitoredEventNotAchieved notification is not generated again for an slapmPolicyMonitorEntry until the maximum transfer rate fails below slapmPolicyMonitorMaxRateLow (a slapmMonitoredEventOkay notification is then transmitted) and then raises above slapmPolicyMonitorMaxRateHigh. This behavior reduces the slapmMonitoredEventNotAchieved notifications that are transmitted. A value of zero for this object is returned when the slapmPolicyMonitorControl monitorMaxRate(1) is not enabled. When enabled the default value for this object is the max rate value specified in the associated action definition plus 10%. If the action definition doesn't have a max rate defined then there is no default for this object and a value MUST be specified prior to activating this entry when monitorMaxRate(1) is selected. Note: The corresponding slapmPolicyMonitorControl BITS setting, enableAggregateTraps(3), MUST be selected in order for any notification relating to this entry to potentially be generated.

Integer32 · kilobits per second

The threshold for generating a slapmMonitoredEventOkay notification, signalling that a monitored maximum transfer rate has fallen to an acceptable level. A value of zero for this object is returned when the slapmPolicyMonitorControl monitorMaxRate(1) is not enabled. When enabled the default value for this object is the max rate value specified in the associated action definition minus 10%. If the action definition doesn't have a max rate defined then there is no default for this object and a value MUST be specified prior to activating this entry when monitorMaxRate(1) is selected. Note: The corresponding slapmPolicyMonitorControl BITS setting, enableAggregateTraps(3), MUST be selected in order for any notification relating to this entry to potentially be generated.

Integer32 · milliseconds

The threshold for generating a slapmMonitoredEventNotAchieved notification, signalling that a monitored maximum delay rate has been exceeded. A slapmMonitoredEventNotAchieved notification is not generated again for an slapmPolicyMonitorEntry until the maximum delay rate falls below slapmPolicyMonitorMaxDelayLow (a slapmMonitoredEventOkay notification is then transmitted) and raises above slapmPolicyMonitorMaxDelayHigh. This behavior reduces the slapmMonitoredEventNotAchieved notifications that are transmitted. A value of zero for this object is returned when the slapmPolicyMonitorControl monitorMaxDelay(4) is not enabled. When enabled the default value for this object is the max delay value specified in the associated action definition plus 10%. If the action definition doesn't have a max delay defined then there is no default for this object and a value MUST be specified prior to activating this entry when monitorMaxDelay(4) is selected. Note: The corresponding slapmPolicyMonitorControl BITS setting, enableAggregateTraps(3), MUST be selected in order for any notification relating to this entry to potentially be generated.

Integer32 · milliseconds

The threshold for generating a slapmMonitoredEventOkay notification, signalling that a monitored maximum delay rate has fallen to an acceptable level. A value of zero for this object is returned when the slapmPolicyMonitorControl monitorMaxDelay(4) is not enabled. When enabled the default value for this object is the max delay value specified in the associated action definition minus 10%. If the action definition doesn't have a max delay defined then there is no default for this object and a value MUST be specified prior to activating this entry when monitorMaxDelay(4) is selected. Note: The corresponding slapmPolicyMonitorControl BITS setting, enableAggregateTraps(3), MUST be selected in order for any notification relating to this entry to potentially be generated.

Counter32

The number of times that a minimum transfer in rate was not achieved.

Counter32

The number of times that a maximum transfer in rate was exceeded.

Counter32

The number of times that a maximum delay in rate was exceeded.

Counter32

The number of times that a minimum transfer out rate was not achieved.

Counter32

The number of times that a maximum transfer out rate was exceeded.

Gauge32 · milliseconds

The current delay rate for this entry. This is calculated by taking the average of the TCP round trip times for all associating slapmSubcomponentTable entries within a interval.

RowStatus1 = active2 = notInService3 = notReady4 = createAndGo5 = createAndWait6 = destroyThe RowStatus textual convention is used to manage the creation and deletion of conceptual rows, and is used as the value of the SYNTAX clause for the status column of a conceptual row (as described in Section 7.7.1 of [2].) The status column has six defined values: - `active', which indicates that the conceptual row is available for use by the managed device; - `notInService', which indicates that the conceptual row exists in the agent, but is unavailable for use by the managed device (see NOTE below); 'notInService' has no implication regarding the internal consistency of the row, availability of resources, or consistency with the current state of the managed device; - `notReady', which indicates that the conceptual row exists in the agent, but is missing information necessary in order to be available for use by the managed device (i.e., one or more required columns in the conceptual row have not been instanciated); - `createAndGo', which is supplied by a management station wishing to create a new instance of a conceptual row and to have its status automatically set to active, making it available for use by the managed device; - `createAndWait', which is supplied by a management station wishing to create a new instance of a conceptual row (but not make it available for use by the managed device); and, - `destroy', which is supplied by a management station wishing to delete all of the instances associated with an existing conceptual row. Whereas five of the six values (all except `notReady') may be specified in a management protocol set operation, only three values will be returned in response to a management protocol retrieval operation: `notReady', `notInService' or `active'. That is, when queried, an existing conceptual row has only three states: it is either available for use by the managed device (the status column has value `active'); it is not available for use by the managed device, though the agent has sufficient information to attempt to make it so (the status column has value `notInService'); or, it is not available for use by the managed device, and an attempt to make it so would fail because the agent has insufficient information (the state column has value `notReady'). NOTE WELL This textual convention may be used for a MIB table, irrespective of whether the values of that table's conceptual rows are able to be modified while it is active, or whether its conceptual rows must be taken out of service in order to be modified. That is, it is the responsibility of the DESCRIPTION clause of the status column to specify whether the status column must not be `active' in order for the value of some other column of the same conceptual row to be modified. If such a specification is made, affected columns may be changed by an SNMP set PDU if the RowStatus would not be equal to `active' either immediately before or after processing the PDU. In other words, if the PDU also contained a varbind that would change the RowStatus value, the column in question may be changed if the RowStatus was not equal to `active' as the PDU was received, or if the varbind sets the status to a value other than 'active'. Also note that whenever any elements of a row exist, the RowStatus column must also exist. To summarize the effect of having a conceptual row with a status column having a SYNTAX clause value of RowStatus, consider the following state diagram: STATE +--------------+-----------+-------------+------------- | A | B | C | D | |status col.|status column| |status column | is | is |status column ACTION |does not exist| notReady | notInService| is active --------------+--------------+-----------+-------------+------------- set status |noError ->D|inconsist- |inconsistent-|inconsistent- column to | or | entValue| Value| Value createAndGo |inconsistent- | | | | Value| | | --------------+--------------+-----------+-------------+------------- set status |noError see 1|inconsist- |inconsistent-|inconsistent- column to | or | entValue| Value| Value createAndWait |wrongValue | | | --------------+--------------+-----------+-------------+------------- set status |inconsistent- |inconsist- |noError |noError column to | Value| entValue| | active | | | | | | or | | | | | | | |see 2 ->D|see 8 ->D| ->D --------------+--------------+-----------+-------------+------------- set status |inconsistent- |inconsist- |noError |noError ->C column to | Value| entValue| | notInService | | | | | | or | | or | | | | | |see 3 ->C| ->C|see 6 --------------+--------------+-----------+-------------+------------- set status |noError |noError |noError |noError ->A column to | | | | or destroy | ->A| ->A| ->A|see 7 --------------+--------------+-----------+-------------+------------- set any other |see 4 |noError |noError |see 5 column to some| | | | value | | see 1| ->C| ->D --------------+--------------+-----------+-------------+------------- (1) goto B or C, depending on information available to the agent. (2) if other variable bindings included in the same PDU, provide values for all columns which are missing but required, and all columns have acceptable values, then return noError and goto D. (3) if other variable bindings included in the same PDU, provide legal values for all columns which are missing but required, then return noError and goto C. (4) at the discretion of the agent, the return value may be either: inconsistentName: because the agent does not choose to create such an instance when the corresponding RowStatus instance does not exist, or inconsistentValue: if the supplied value is inconsistent with the state of some other MIB object's value, or noError: because the agent chooses to create the instance. If noError is returned, then the instance of the status column must also be created, and the new state is B or C, depending on the information available to the agent. If inconsistentName or inconsistentValue is returned, the row remains in state A. (5) depending on the MIB definition for the column/table, either noError or inconsistentValue may be returned. (6) the return value can indicate one of the following errors: wrongValue: because the agent does not support notInService (e.g., an agent which does not support createAndWait), or inconsistentValue: because the agent is unable to take the row out of service at this time, perhaps because it is in use and cannot be de-activated. (7) the return value can indicate the following error: inconsistentValue: because the agent is unable to remove the row at this time, perhaps because it is in use and cannot be de-activated. (8) the transition to D can fail, e.g., if the values of the conceptual row are inconsistent, then the error code would be inconsistentValue. NOTE: Other processing of (this and other varbinds of) the set request may result in a response other than noError being returned, e.g., wrongValue, noCreation, etc. Conceptual Row Creation There are four potential interactions when creating a conceptual row: selecting an instance-identifier which is not in use; creating the conceptual row; initializing any objects for which the agent does not supply a default; and, making the conceptual row available for use by the managed device. Interaction 1: Selecting an Instance-Identifier The algorithm used to select an instance-identifier varies for each conceptual row. In some cases, the instance- identifier is semantically significant, e.g., the destination address of a route, and a management station selects the instance-identifier according to the semantics. In other cases, the instance-identifier is used solely to distinguish conceptual rows, and a management station without specific knowledge of the conceptual row might examine the instances present in order to determine an unused instance-identifier. (This approach may be used, but it is often highly sub-optimal; however, it is also a questionable practice for a naive management station to attempt conceptual row creation.) Alternately, the MIB module which defines the conceptual row might provide one or more objects which provide assistance in determining an unused instance-identifier. For example, if the conceptual row is indexed by an integer-value, then an object having an integer-valued SYNTAX clause might be defined for such a purpose, allowing a management station to issue a management protocol retrieval operation. In order to avoid unnecessary collisions between competing management stations, `adjacent' retrievals of this object should be different. Finally, the management station could select a pseudo-random number to use as the index. In the event that this index was already in use and an inconsistentValue was returned in response to the management protocol set operation, the management station should simply select a new pseudo-random number and retry the operation. A MIB designer should choose between the two latter algorithms based on the size of the table (and therefore the efficiency of each algorithm). For tables in which a large number of entries are expected, it is recommended that a MIB object be defined that returns an acceptable index for creation. For tables with small numbers of entries, it is recommended that the latter pseudo-random index mechanism be used. Interaction 2: Creating the Conceptual Row Once an unused instance-identifier has been selected, the management station determines if it wishes to create and activate the conceptual row in one transaction or in a negotiated set of interactions. Interaction 2a: Creating and Activating the Conceptual Row The management station must first determine the column requirements, i.e., it must determine those columns for which it must or must not provide values. Depending on the complexity of the table and the management station's knowledge of the agent's capabilities, this determination can be made locally by the management station. Alternately, the management station issues a management protocol get operation to examine all columns in the conceptual row that it wishes to create. In response, for each column, there are three possible outcomes: - a value is returned, indicating that some other management station has already created this conceptual row. We return to interaction 1. - the exception `noSuchInstance' is returned, indicating that the agent implements the object-type associated with this column, and that this column in at least one conceptual row would be accessible in the MIB view used by the retrieval were it to exist. For those columns to which the agent provides read-create access, the `noSuchInstance' exception tells the management station that it should supply a value for this column when the conceptual row is to be created. - the exception `noSuchObject' is returned, indicating that the agent does not implement the object-type associated with this column or that there is no conceptual row for which this column would be accessible in the MIB view used by the retrieval. As such, the management station can not issue any management protocol set operations to create an instance of this column. Once the column requirements have been determined, a management protocol set operation is accordingly issued. This operation also sets the new instance of the status column to `createAndGo'. When the agent processes the set operation, it verifies that it has sufficient information to make the conceptual row available for use by the managed device. The information available to the agent is provided by two sources: the management protocol set operation which creates the conceptual row, and, implementation-specific defaults supplied by the agent (note that an agent must provide implementation-specific defaults for at least those objects which it implements as read-only). If there is sufficient information available, then the conceptual row is created, a `noError' response is returned, the status column is set to `active', and no further interactions are necessary (i.e., interactions 3 and 4 are skipped). If there is insufficient information, then the conceptual row is not created, and the set operation fails with an error of `inconsistentValue'. On this error, the management station can issue a management protocol retrieval operation to determine if this was because it failed to specify a value for a required column, or, because the selected instance of the status column already existed. In the latter case, we return to interaction 1. In the former case, the management station can re-issue the set operation with the additional information, or begin interaction 2 again using `createAndWait' in order to negotiate creation of the conceptual row. NOTE WELL Regardless of the method used to determine the column requirements, it is possible that the management station might deem a column necessary when, in fact, the agent will not allow that particular columnar instance to be created or written. In this case, the management protocol set operation will fail with an error such as `noCreation' or `notWritable'. In this case, the management station decides whether it needs to be able to set a value for that particular columnar instance. If not, the management station re-issues the management protocol set operation, but without setting a value for that particular columnar instance; otherwise, the management station aborts the row creation algorithm. Interaction 2b: Negotiating the Creation of the Conceptual Row The management station issues a management protocol set operation which sets the desired instance of the status column to `createAndWait'. If the agent is unwilling to process a request of this sort, the set operation fails with an error of `wrongValue'. (As a consequence, such an agent must be prepared to accept a single management protocol set operation, i.e., interaction 2a above, containing all of the columns indicated by its column requirements.) Otherwise, the conceptual row is created, a `noError' response is returned, and the status column is immediately set to either `notInService' or `notReady', depending on whether it has sufficient information to (attempt to) make the conceptual row available for use by the managed device. If there is sufficient information available, then the status column is set to `notInService'; otherwise, if there is insufficient information, then the status column is set to `notReady'. Regardless, we proceed to interaction 3. Interaction 3: Initializing non-defaulted Objects The management station must now determine the column requirements. It issues a management protocol get operation to examine all columns in the created conceptual row. In the response, for each column, there are three possible outcomes: - a value is returned, indicating that the agent implements the object-type associated with this column and had sufficient information to provide a value. For those columns to which the agent provides read-create access (and for which the agent allows their values to be changed after their creation), a value return tells the management station that it may issue additional management protocol set operations, if it desires, in order to change the value associated with this column. - the exception `noSuchInstance' is returned, indicating that the agent implements the object-type associated with this column, and that this column in at least one conceptual row would be accessible in the MIB view used by the retrieval were it to exist. However, the agent does not have sufficient information to provide a value, and until a value is provided, the conceptual row may not be made available for use by the managed device. For those columns to which the agent provides read-create access, the `noSuchInstance' exception tells the management station that it must issue additional management protocol set operations, in order to provide a value associated with this column. - the exception `noSuchObject' is returned, indicating that the agent does not implement the object-type associated with this column or that there is no conceptual row for which this column would be accessible in the MIB view used by the retrieval. As such, the management station can not issue any management protocol set operations to create an instance of this column. If the value associated with the status column is `notReady', then the management station must first deal with all `noSuchInstance' columns, if any. Having done so, the value of the status column becomes `notInService', and we proceed to interaction 4. Interaction 4: Making the Conceptual Row Available Once the management station is satisfied with the values associated with the columns of the conceptual row, it issues a management protocol set operation to set the status column to `active'. If the agent has sufficient information to make the conceptual row available for use by the managed device, the management protocol set operation succeeds (a `noError' response is returned). Otherwise, the management protocol set operation fails with an error of `inconsistentValue'. NOTE WELL A conceptual row having a status column with value `notInService' or `notReady' is unavailable to the managed device. As such, it is possible for the managed device to create its own instances during the time between the management protocol set operation which sets the status column to `createAndWait' and the management protocol set operation which sets the status column to `active'. In this case, when the management protocol set operation is issued to set the status column to `active', the values held in the agent supersede those used by the managed device. If the management station is prevented from setting the status column to `active' (e.g., due to management station or network failure) the conceptual row will be left in the `notInService' or `notReady' state, consuming resources indefinitely. The agent must detect conceptual rows that have been in either state for an abnormally long period of time and remove them. It is the responsibility of the DESCRIPTION clause of the status column to indicate what an abnormally long period of time would be. This period of time should be long enough to allow for human response time (including `think time') between the creation of the conceptual row and the setting of the status to `active'. In the absence of such information in the DESCRIPTION clause, it is suggested that this period be approximately 5 minutes in length. This removal action applies not only to newly-created rows, but also to previously active rows which are set to, and left in, the notInService state for a prolonged period exceeding that which is considered normal for such a conceptual row. Conceptual Row Suspension When a conceptual row is `active', the management station may issue a management protocol set operation which sets the instance of the status column to `notInService'. If the agent is unwilling to do so, the set operation fails with an error of `wrongValue' or `inconsistentValue'. Otherwise, the conceptual row is taken out of service, and a `noError' response is returned. It is the responsibility of the DESCRIPTION clause of the status column to indicate under what circumstances the status column should be taken out of service (e.g., in order for the value of some other column of the same conceptual row to be modified). Conceptual Row Deletion For deletion of conceptual rows, a management protocol set operation is issued which sets the instance of the status column to `destroy'. This request may be made regardless of the current value of the status column (e.g., it is possible to delete conceptual rows which are either `notReady', `notInService' or `active'.) If the operation succeeds, then all instances associated with the conceptual row are immediately removed. · Integer32

This object allows entries to be created and deleted in the slapmPolicyMonitorTable. An entry in this table is deleted by setting this object to destroy(6). Removal of a corresponding (same policy and traffic profile names) slapmPolicyStatsEntry has the side effect of the automatic deletion an entry in this table.

OCTET STRING SIZE (0 | 4 | 16)

Indicate the remote address of a subcomponent. A remote address can be either an ipv4 address in which case 4 octets are required or as an ipv6 address that requires 16 octets. The value of this subidentifier is a zero length octet string when this entry relates to a UDP listener.

Integer32 (0..65535)

Indicate the remote port of a subcomponent. The value of this subidentifier is 0 when this entry relates to a UDP listener.

OCTET STRING SIZE (4 | 16)

Indicate the local address of a subcomponent. A local address can be either an ipv4 address in which case 4 octets are required or as an ipv6 address that requires 16 octets.

Integer32 (0..65535)

Indicate the local port of a subcomponent.

INTEGER1 = udpListener2 = tcpConnection · Integer32

Indicate the protocol in use that identifies the type of subcomponent.

OCTET STRING SIZE (0 | 4 | 16)

Address of a system that an Policy definition relates to. A zero length octet string can be used to indicate that only a single system is being represented. Otherwise, the length of the octet string should be 4 for an ipv4 address and 16 for an ipv6 address.

SlapmNameTypeThe textual convention for naming entities within this MIB. The actual contents of an object defined using this textual convention should consist of the distinguished name portion of an name. This is usually the right-most portion of the name. This convention is necessary, since names within this MIB can be used as index items and an instance identifier is limited to 128 subidentifiers. This textual convention has been deprecated. All of the tables defined within this MIB that use this textual convention have been deprecated as well since the method of using a portion of the name (either of a policy definition or of a traffic profile) has been replaced by using an Unsigned32 index. The new slapmPolicyNameTable would then map the Unsigned32 index to a real name. SIZE (0..32) · OCTET STRING · hint 255t

Policy name that this entry relates to. This object, along with slapmSubcomponentTrafficProfileName, have been replaced with the use of an unsigned integer index that is mapped to an slapmPolicyNameEntry to actually identify policy naming.

SlapmNameTypeThe textual convention for naming entities within this MIB. The actual contents of an object defined using this textual convention should consist of the distinguished name portion of an name. This is usually the right-most portion of the name. This convention is necessary, since names within this MIB can be used as index items and an instance identifier is limited to 128 subidentifiers. This textual convention has been deprecated. All of the tables defined within this MIB that use this textual convention have been deprecated as well since the method of using a portion of the name (either of a policy definition or of a traffic profile) has been replaced by using an Unsigned32 index. The new slapmPolicyNameTable would then map the Unsigned32 index to a real name. SIZE (0..32) · OCTET STRING · hint 255t

The corresponding traffic profile name. This object, along with slapmSubcomponentProfileName, have been replaced with the use of an unsigned integer index that is mapped to an slapmPolicyNameEntry to actually identify policy naming.

DateAndTimeA date-time specification. field octets contents range ----- ------ -------- ----- 1 1-2 year* 0..65536 2 3 month 1..12 3 4 day 1..31 4 5 hour 0..23 5 6 minutes 0..59 6 7 seconds 0..60 (use 60 for leap-second) 7 8 deci-seconds 0..9 8 9 direction from UTC '+' / '-' 9 10 hours from UTC* 0..13 10 11 minutes from UTC 0..59 * Notes: - the value of year is in network-byte order - daylight saving time in New Zealand is +13 For example, Tuesday May 26, 1992 at 1:30:15 PM EDT would be displayed as: 1992-5-26,13:30:15.0,-4:0 Note that if only local time is known, then timezone information (fields 8-10) is not present. SIZE (8 | 11) · OCTET STRING · hint 2d-1d-1d,1d:1d:1d.1d,1a1d:1d

The date and timestamp of when this entry was last used.

Counter32

The number of octets received from IP for this connection.

Counter32

The number of octets sent to IP for this connection.

Counter32

Number of outgoing octets buffered. The value of this object is zero when the entry is not for a TCP connection.

Counter32

Number of incoming octets buffered. The value of this object is zero when the entry is not for a TCP connection.

Counter32

Number of retransmissions. The value of this object is zero when the entry is not for a TCP connection.

Integer32 · milliseconds

The amount of time that has elapsed, measured in milliseconds, from when the last TCP segment was transmitted by the TCP Stack until the ACK was received. The value of this object is zero when the entry is not for a TCP connection.

Integer32

Round trip time variance. The value of this object is zero when the entry is not for a TCP connection.

Counter32

The number of protocol related data units transferred inbound: slapmSubcomponentProtocol PDU Type udpListener(1) UDP datagrams tcpConnection(2) TCP segments

Counter32

The number of protocol related data units transferred outbound: slapmSubcomponentProtocol PDU Type udpListener(1) UDP datagrams tcpConnection(2) TCP segments

SnmpAdminStringAn octet string containing administrative information, preferably in human-readable form. To facilitate internationalization, this information is represented using the ISO/IEC IS 10646-1 character set, encoded as an octet string using the UTF-8 transformation format described in [RFC2279]. Since additional code points are added by amendments to the 10646 standard from time to time, implementations must be prepared to encounter any code point from 0x00000000 to 0x7fffffff. Byte sequences that do not correspond to the valid UTF-8 encoding of a code point or are outside this range are prohibited. The use of control codes should be avoided. When it is necessary to represent a newline, the control code sequence CR LF should be used. The use of leading or trailing white space should be avoided. For code points not directly supported by user interface hardware or software, an alternative means of entry and display, such as hexadecimal, may be provided. For information encoded in 7-bit US-ASCII, the UTF-8 encoding is identical to the US-ASCII encoding. UTF-8 may require multiple bytes to represent a single character / code point; thus the length of this object in octets may be different from the number of characters encoded. Similarly, size constraints refer to the number of encoded octets, not the number of characters represented by an encoding. Note that when this TC is used for an object that is used or envisioned to be used as an index, then a SIZE restriction MUST be specified so that the number of sub-identifiers for any object instance does not exceed the limit of 128, as defined by [RFC3416]. Note that the size of an SnmpAdminString object is measured in octets, not characters. SIZE (0..32) · OCTET STRING · hint 255t

The application name associated with this entry if known, otherwise a zero-length octet string is returned as the value of this object.

SlapmStatusThe textual convention for defining the various slapmPRMonTable (or old slapmPolicyMonitorTable) and the slapmSubcomponentTable states for actual policy rule traffic monitoring. · BITS

The value of this object indicates when a monitored value has exceeded a threshold or isn't meeting the defined service level. Only the following SlapmStatus BITS setting can be reported here: monitorMinInRateNotAchieved(5), monitorMaxInRateExceeded(6), monitorMaxDelayExceeded(7), monitorMinOutRateNotAchieved(8), monitorMaxOutRateExceeded(9) This object only has meaning when an corresponding slapmPolicyMonitorEntry exists with the slapmPolicyMonitorControl BITS setting monitorSubcomponents(5) enabled.

DateAndTimeA date-time specification. field octets contents range ----- ------ -------- ----- 1 1-2 year* 0..65536 2 3 month 1..12 3 4 day 1..31 4 5 hour 0..23 5 6 minutes 0..59 6 7 seconds 0..60 (use 60 for leap-second) 7 8 deci-seconds 0..9 8 9 direction from UTC '+' / '-' 9 10 hours from UTC* 0..13 10 11 minutes from UTC 0..59 * Notes: - the value of year is in network-byte order - daylight saving time in New Zealand is +13 For example, Tuesday May 26, 1992 at 1:30:15 PM EDT would be displayed as: 1992-5-26,13:30:15.0,-4:0 Note that if only local time is known, then timezone information (fields 8-10) is not present. SIZE (8 | 11) · OCTET STRING · hint 2d-1d-1d,1d:1d:1d.1d,1a1d:1d

The timestamp for when the last interval ended. This object only has meaning when an corresponding slapmPRMonEntry (or old slapmPolicyMonitorEntry) exists with the slapmPRMonControl (or slapmPolicyMonitorControl) BITS setting monitorSubcomponents(5) enabled. All of the octets returned when monitoring is not in effect must be zero.

Gauge32 · kilobits per second

Using the value of the corresponding slapmPRMonInterval (or slapmPolicyMonitorInterval), slapmSubcomponentStatsInOctets is divided by slapmSubcomponentMonitorInterval to determine the current in transfer rate. This object only has meaning when an corresponding slapmPRMonEntry (or slapmPolicyMonitorEntry) exists with the slapmPRMonControl (or slapmPolicyMonitorControl) BITS setting monitorSubcomponents(5) enabled. The value of this object is zero when monitoring is not in effect.

Gauge32 · kilobits per second

Using the value of the corresponding slapmPRMonInterval (or slapmPolicyMonitorInterva)l, slapmSubcomponentStatsOutOctets is divided by slapmPRMonInterval (or slapmPolicyMonitorInterval) to determine the current out transfer rate. This object only has meaning when an corresponding slapmPRMonEntry (or slapmPolicyMonitorEntry) exists with the slapmPRMonControl (or slapmPolicyMonitorControl) BITS setting monitorSubcomponents(5) enabled. The value of this object is zero when monitoring is not in effect.

Unsigned32

Points to an slapmPolicyNameEntry when combined with slapmSubcomponentSystemAddress to indicate the policy naming that relates to this entry. A value of 0 for this object MUST be returned when the corresponding slapmSubcomponentEntry has no policy rule associated with it.

OCTET STRING SIZE (0 | 4 | 16)

Address of a system that an Policy rule definition relates to. A zero length octet string must be used to indicate that only a single system is being represented. Otherwise, the length of the octet string must be 4 for an ipv4 address or 16 for an ipv6 address.

Unsigned32 (1..4294967295)

A locally arbitrary, but unique identifier associated with this table entry. This value is not expected to remain constant across reIPLs.

SlapmPolicyRuleNameTo facilitate internationalization, this TC represents information taken from the ISO/IEC IS 10646-1 character set, encoded as an octet string using the UTF-8 character encoding scheme described in RFC 2044. For strings in 7-bit US-ASCII, there is no impact since the UTF-8 representation is identical to the US-ASCII encoding. SIZE (0..1024) · OCTET STRING · hint 1024t

The unique name that identifies a policy rule definition.

INTEGER1 = inactive2 = active3 = deleteNeeded · Integer32

The state of a policy entry: inactive(1) - An policy entry was either defined by local system definition or discovered via a directory search but has not been activated (not currently being used). active(2) - Policy entry is being used to affect traffic flows. deleteNeeded(3) - Either though local implementation dependent methods or by discovering that the directory entry corresponding to this table entry no longer exists and slapmPolicyPurgeTime needs to expire before attempting to remove the corresponding slapmPolicyStatsEntry and any dependent slapmPolicyMonitor table entries. Note: a policy rule in a state other than active(2) is not being used to affect traffic flows.

Gauge32

The number of active TCP connections that are affected by the corresponding policy entry.

Counter32

The number of total TCP connections that are affected by the corresponding policy entry.

DateAndTimeA date-time specification. field octets contents range ----- ------ -------- ----- 1 1-2 year* 0..65536 2 3 month 1..12 3 4 day 1..31 4 5 hour 0..23 5 6 minutes 0..59 6 7 seconds 0..60 (use 60 for leap-second) 7 8 deci-seconds 0..9 8 9 direction from UTC '+' / '-' 9 10 hours from UTC* 0..13 10 11 minutes from UTC 0..59 * Notes: - the value of year is in network-byte order - daylight saving time in New Zealand is +13 For example, Tuesday May 26, 1992 at 1:30:15 PM EDT would be displayed as: 1992-5-26,13:30:15.0,-4:0 Note that if only local time is known, then timezone information (fields 8-10) is not present. SIZE (8 | 11) · OCTET STRING · hint 2d-1d-1d,1d:1d:1d.1d,1a1d:1d

The timestamp for when the corresponding policy entry was last activated. The value of this object serves as the discontinuity event indicator when polling entries in this table. The value of this object is updated on transition of slapmPolicyRuleStatsOperStatus into the active(2) state.

DateAndTimeA date-time specification. field octets contents range ----- ------ -------- ----- 1 1-2 year* 0..65536 2 3 month 1..12 3 4 day 1..31 4 5 hour 0..23 5 6 minutes 0..59 6 7 seconds 0..60 (use 60 for leap-second) 7 8 deci-seconds 0..9 8 9 direction from UTC '+' / '-' 9 10 hours from UTC* 0..13 10 11 minutes from UTC 0..59 * Notes: - the value of year is in network-byte order - daylight saving time in New Zealand is +13 For example, Tuesday May 26, 1992 at 1:30:15 PM EDT would be displayed as: 1992-5-26,13:30:15.0,-4:0 Note that if only local time is known, then timezone information (fields 8-10) is not present. SIZE (8 | 11) · OCTET STRING · hint 2d-1d-1d,1d:1d:1d.1d,1a1d:1d

The timestamp for when the last time that the associated policy entry was used.

Counter32

The number of octets that was received by IP for an entity that map to this entry.

Counter32

The number of octets that was transmitted by IP for an entity that map to this entry.

Unsigned32

The limit for the number of active TCP connections that are allowed for this policy definition. A value of zero for this object implies that a connection limit has not been specified.

Counter32

This counter is incremented when a policy action's Permission value is set to Accept and a session (TCP connection) is accepted.

Counter32

This counter is incremented when a policy action's Permission value is set to Deny and a session is denied, or when a session (TCP connection) is rejected due to a policy's connection limit (slapmPolicyRuleStatsConnectLimit) being reached.

Counter32

This counter counts the number of in octets discarded. This occurs when an error is detected. Examples of this are buffer overflow, checksum error, or bad packet format.

Counter32

This counter counts the number of out octets discarded. Examples of this are buffer overflow, checksum error, or bad packet format.

Counter32

This counter counts the number of in packets received that relate to this policy entry from IP.

Counter32

This counter counts the number of out packets sent by IP that relate to this policy entry.

Counter32

This counter counts the number of in octets that are determined to be within profile.

Counter32

This counter counts the number of out octets that are determined to be within profile.

Unsigned32 · Kilobits per second

The minimum transfer rate defined for this entry.

Unsigned32 · Kilobits per second

The maximum transfer rate defined for this entry.

Unsigned32 · milliseconds

The maximum delay defined for this entry.

Counter32

Total number of RSVP flows that have be activated.

Gauge32

Current number of active RSVP flows.

SnmpAdminStringAn octet string containing administrative information, preferably in human-readable form. To facilitate internationalization, this information is represented using the ISO/IEC IS 10646-1 character set, encoded as an octet string using the UTF-8 transformation format described in [RFC2279]. Since additional code points are added by amendments to the 10646 standard from time to time, implementations must be prepared to encounter any code point from 0x00000000 to 0x7fffffff. Byte sequences that do not correspond to the valid UTF-8 encoding of a code point or are outside this range are prohibited. The use of control codes should be avoided. When it is necessary to represent a newline, the control code sequence CR LF should be used. The use of leading or trailing white space should be avoided. For code points not directly supported by user interface hardware or software, an alternative means of entry and display, such as hexadecimal, may be provided. For information encoded in 7-bit US-ASCII, the UTF-8 encoding is identical to the US-ASCII encoding. UTF-8 may require multiple bytes to represent a single character / code point; thus the length of this object in octets may be different from the number of characters encoded. Similarly, size constraints refer to the number of encoded octets, not the number of characters represented by an encoding. Note that when this TC is used for an object that is used or envisioned to be used as an index, then a SIZE restriction MUST be specified so that the number of sub-identifiers for any object instance does not exceed the limit of 128, as defined by [RFC3416]. Note that the size of an SnmpAdminString object is measured in octets, not characters. SIZE (0..16) · OCTET STRING · hint 255t

To facilitate the provisioning of access control by a security administrator using the View-Based Access Control Model (RFC 2575, VACM) for tables in which multiple users may need to independently create or modify entries, the initial index is used as an 'owner index'. Such an initial index has a syntax of SnmpAdminString, and can thus be trivially mapped to a securityName or groupName as defined in VACM, in accordance with a security policy. All entries in that table belonging to a particular user will have the same value for this initial index. For a given user's entries in a particular table, the object identifiers for the information in these entries will have the same subidentifiers (except for the 'column' subidentifier) up to the end of the encoded owner index. To configure VACM to permit access to this portion of the table, one would create vacmViewTreeFamilyTable entries with the value of vacmViewTreeFamilySubtree including the owner index portion, and vacmViewTreeFamilyMask 'wildcarding' the column subidentifier. More elaborate configurations are possible.

OCTET STRING SIZE (0 | 4 | 16)

Address of a system that an Policy definition relates to. A zero length octet string can be used to indicate that only a single system is being represented. Otherwise, the length of the octet string should be 4 for an ipv4 address and 16 for an ipv6 address.

Unsigned32

An slapmPolicyNameTable index, slapmPolicyNameIndex, that points to the unique name associated with a policy rule definition.

BITS

The value of this object determines the type and level of monitoring that is applied to a policy rule. The value of this object can't be changed once the table entry that it is a part of is activated via a slapmPRMonRowStatus transition to active state. monitorMinRate(0) - Monitor minimum transfer rate. monitorMaxRate(1) - Monitor maximum transfer rate. monitorMaxDelay(2) - Monitor maximum delay. enableAggregateTraps(3) - The enableAggregateTraps(3) BITS setting enables notification generation when monitoring a policy rule as an aggregate using the values in the corresponding slapmPRMonStatsEntry. By default this function is not enabled. enableSubcomponentTraps(4) - This BITS setting enables notification generation when monitoring all subcomponents that are mapped to an corresponding slapmPRMonStatsEntry. By default this function is not enabled. monitorSubcomponents(5) - This BITS setting enables monitoring of each subcomponent (typically a TCP connection or UDP listener) individually.

SlapmStatusThe textual convention for defining the various slapmPRMonTable (or old slapmPolicyMonitorTable) and the slapmSubcomponentTable states for actual policy rule traffic monitoring. · BITS

The value of this object indicates when a monitored value has not meet a threshold or isn't meeting the defined service level. The SlapmStatus TEXTUAL-CONVENTION defines two levels of not meeting a threshold. The first set: slaMinInRateNotAchieved(0), slaMaxInRateExceeded(1), slaMaxDelayExceeded(2), slaMinOutRateNotAchieved(3), slaMaxOutRateExceeded(4) are used to indicate when the SLA as an aggregate is not meeting a threshold while the second set: monitorMinInRateNotAchieved(5), monitorMaxInRateExceeded(6), monitorMaxDelayExceeded(7), monitorMinOutRateNotAchieved(8), monitorMaxOutRateExceeded(9) indicate that at least one subcomponent is not meeting a threshold.

Unsigned32 (15..86400) · seconds

The number of seconds that defines the sample period.

DateAndTimeA date-time specification. field octets contents range ----- ------ -------- ----- 1 1-2 year* 0..65536 2 3 month 1..12 3 4 day 1..31 4 5 hour 0..23 5 6 minutes 0..59 6 7 seconds 0..60 (use 60 for leap-second) 7 8 deci-seconds 0..9 8 9 direction from UTC '+' / '-' 9 10 hours from UTC* 0..13 10 11 minutes from UTC 0..59 * Notes: - the value of year is in network-byte order - daylight saving time in New Zealand is +13 For example, Tuesday May 26, 1992 at 1:30:15 PM EDT would be displayed as: 1992-5-26,13:30:15.0,-4:0 Note that if only local time is known, then timezone information (fields 8-10) is not present. SIZE (8 | 11) · OCTET STRING · hint 2d-1d-1d,1d:1d:1d.1d,1a1d:1d

The timestamp for when the last interval ended.

Gauge32 · kilobits per second

Using the value of the corresponding slapmPRMonInterval, slapmPolicyRuleStatsInOctets is sampled and then divided by slapmPRMonInterval to determine the current in transfer rate.

Gauge32 · kilobits per second

Using the value of the corresponding slapmPolicyMonInterval, slapmPolicyRuleStatsOutOctets is sampled and then divided by slapmPRMonInterval to determine the current out transfer rate.

Unsigned32 · kilobits per second

The threshold for generating a slapmPolicyRuleMonNotOkay notification, signalling that a monitored minimum transfer rate has not been meet. A slapmPolicyRuleMonNotOkay notification is not generated again for an slapmPRMonEntry until the minimum transfer rate exceeds slapmPRMonMinRateHigh (a slapmPolicyRuleMonOkay notification is then transmitted) and then fails below slapmPRMonMinRateLow. This behavior reduces the slapmPolicyRuleMonNotOkay notifications that are transmitted. A value of zero for this object is returned when the slapmPRMonControl monitorMinRate(0) is not enabled. When enabled the default value for this object is the min rate value specified in the associated action definition minus 10%. If the action definition doesn't have a min rate defined then there is no default for this object and a value MUST be specified prior to activating this entry when monitorMinRate(0) is selected. Note: The corresponding slapmPRMonControl BITS setting, enableAggregateTraps(3), MUST be selected in order for any notification relating to this entry to potentially be generated.

Unsigned32 · kilobits per second

The threshold for generating a slapmPolicyRuleMonOkay notification, signalling that a monitored minimum transfer rate has increased to an acceptable level. A value of zero for this object is returned when the slapmPRMonControl monitorMinRate(0) is not enabled. When enabled the default value for this object is the min rate value specified in the associated action definition plus 10%. If the action definition doesn't have a min rate defined then there is no default for this object and a value MUST be specified prior to activating this entry when monitorMinRate(0) is selected. Note: The corresponding slapmPRMonControl BITS setting, enableAggregateTraps(3), MUST be selected in order for any notification relating to this entry to potentially be generated.

Unsigned32 · kilobits per second

The threshold for generating a slapmPolicyRuleMonNotOkay notification, signalling that a monitored maximum transfer rate has been exceeded. A slapmPolicyRuleNotOkay notification is not generated again for an slapmPRMonEntry until the maximum transfer rate fails below slapmPRMonMaxRateLow (a slapmPolicyRuleMonOkay notification is then transmitted) and then raises above slapmPRMonMaxRateHigh. This behavior reduces the slapmPolicyRuleMonNotOkay notifications that are transmitted. A value of zero for this object is returned when the slapmPRMonControl monitorMaxRate(1) is not enabled. When enabled the default value for this object is the max rate value specified in the associated action definition plus 10%. If the action definition doesn't have a max rate defined then there is no default for this object and a value MUST be specified prior to activating this entry when monitorMaxRate(1) is selected. Note: The corresponding slapmPRMonControl BITS setting, enableAggregateTraps(3), MUST be selected in order for any notification relating to this entry to potentially be generated.

Unsigned32 · kilobits per second

The threshold for generating a slapmPolicyRuleMonOkay notification, signalling that a monitored maximum transfer rate has fallen to an acceptable level. A value of zero for this object is returned when the slapmPRMonControl monitorMaxRate(1) is not enabled. When enabled the default value for this object is the max rate value specified in the associated action definition minus 10%. If the action definition doesn't have a max rate defined then there is no default for this object and a value MUST be specified prior to activating this entry when monitorMaxRate(1) is selected. Note: The corresponding slapmPRMonControl BITS setting, enableAggregateTraps(3), MUST be selected in order for any notification relating to this entry to potentially be generated.

Unsigned32 · milliseconds

The threshold for generating a slapmPolicyRuleMonNotOkay notification, signalling that a monitored maximum delay rate has been exceeded. A slapmPolicyRuleMonNotOkay notification is not generated again for an slapmPRMonEntry until the maximum delay rate falls below slapmPRMonMaxDelayLow (a slapmPolicyRuleMonOkay notification is then transmitted) and raises above slapmPRMonMaxDelayHigh. This behavior reduces the slapmPolicyRuleMonNotOkay notifications that are transmitted. A value of zero for this object is returned when the slapmPRMonControl monitorMaxDelay(4) is not enabled. When enabled the default value for this object is the max delay value specified in the associated action definition plus 10%. If the action definition doesn't have a max delay defined then there is no default for this object and a value MUST be specified prior to activating this entry when monitorMaxDelay(4) is selected. Note: The corresponding slapmPRMonControl BITS setting, enableAggregateTraps(3), MUST be selected in order for any notification relating to this entry to potentially be generated.

Unsigned32 · milliseconds

The threshold for generating a slapmPolicyRuleMonOkay notification, signalling that a monitored maximum delay rate has fallen to an acceptable level. A value of zero for this object is returned when the slapmPRMonControl monitorMaxDelay(4) is not enabled. When enabled the default value for this object is the max delay value specified in the associated action definition minus 10%. If the action definition doesn't have a max delay defined then there is no default for this object and a value MUST be specified prior to activating this entry when monitorMaxDelay(4) is selected. Note: The corresponding slapmPRMonControl BITS setting, enableAggregateTraps(3), MUST be selected in order for any notification relating to this entry to potentially be generated.

Counter32

The number of times that a minimum transfer in rate was not achieved.

Counter32

The number of times that a maximum transfer in rate was exceeded.

Counter32

The number of times that a maximum delay in rate was exceeded.

Counter32

The number of times that a minimum transfer out rate was not achieved.

Counter32

The number of times that a maximum transfer out rate was exceeded.

Gauge32 · milliseconds

The current delay rate for this entry. This is calculated by taking the average of the TCP round trip times for all associating slapmSubcomponentTable entries within a interval.

RowStatus1 = active2 = notInService3 = notReady4 = createAndGo5 = createAndWait6 = destroyThe RowStatus textual convention is used to manage the creation and deletion of conceptual rows, and is used as the value of the SYNTAX clause for the status column of a conceptual row (as described in Section 7.7.1 of [2].) The status column has six defined values: - `active', which indicates that the conceptual row is available for use by the managed device; - `notInService', which indicates that the conceptual row exists in the agent, but is unavailable for use by the managed device (see NOTE below); 'notInService' has no implication regarding the internal consistency of the row, availability of resources, or consistency with the current state of the managed device; - `notReady', which indicates that the conceptual row exists in the agent, but is missing information necessary in order to be available for use by the managed device (i.e., one or more required columns in the conceptual row have not been instanciated); - `createAndGo', which is supplied by a management station wishing to create a new instance of a conceptual row and to have its status automatically set to active, making it available for use by the managed device; - `createAndWait', which is supplied by a management station wishing to create a new instance of a conceptual row (but not make it available for use by the managed device); and, - `destroy', which is supplied by a management station wishing to delete all of the instances associated with an existing conceptual row. Whereas five of the six values (all except `notReady') may be specified in a management protocol set operation, only three values will be returned in response to a management protocol retrieval operation: `notReady', `notInService' or `active'. That is, when queried, an existing conceptual row has only three states: it is either available for use by the managed device (the status column has value `active'); it is not available for use by the managed device, though the agent has sufficient information to attempt to make it so (the status column has value `notInService'); or, it is not available for use by the managed device, and an attempt to make it so would fail because the agent has insufficient information (the state column has value `notReady'). NOTE WELL This textual convention may be used for a MIB table, irrespective of whether the values of that table's conceptual rows are able to be modified while it is active, or whether its conceptual rows must be taken out of service in order to be modified. That is, it is the responsibility of the DESCRIPTION clause of the status column to specify whether the status column must not be `active' in order for the value of some other column of the same conceptual row to be modified. If such a specification is made, affected columns may be changed by an SNMP set PDU if the RowStatus would not be equal to `active' either immediately before or after processing the PDU. In other words, if the PDU also contained a varbind that would change the RowStatus value, the column in question may be changed if the RowStatus was not equal to `active' as the PDU was received, or if the varbind sets the status to a value other than 'active'. Also note that whenever any elements of a row exist, the RowStatus column must also exist. To summarize the effect of having a conceptual row with a status column having a SYNTAX clause value of RowStatus, consider the following state diagram: STATE +--------------+-----------+-------------+------------- | A | B | C | D | |status col.|status column| |status column | is | is |status column ACTION |does not exist| notReady | notInService| is active --------------+--------------+-----------+-------------+------------- set status |noError ->D|inconsist- |inconsistent-|inconsistent- column to | or | entValue| Value| Value createAndGo |inconsistent- | | | | Value| | | --------------+--------------+-----------+-------------+------------- set status |noError see 1|inconsist- |inconsistent-|inconsistent- column to | or | entValue| Value| Value createAndWait |wrongValue | | | --------------+--------------+-----------+-------------+------------- set status |inconsistent- |inconsist- |noError |noError column to | Value| entValue| | active | | | | | | or | | | | | | | |see 2 ->D|see 8 ->D| ->D --------------+--------------+-----------+-------------+------------- set status |inconsistent- |inconsist- |noError |noError ->C column to | Value| entValue| | notInService | | | | | | or | | or | | | | | |see 3 ->C| ->C|see 6 --------------+--------------+-----------+-------------+------------- set status |noError |noError |noError |noError ->A column to | | | | or destroy | ->A| ->A| ->A|see 7 --------------+--------------+-----------+-------------+------------- set any other |see 4 |noError |noError |see 5 column to some| | | | value | | see 1| ->C| ->D --------------+--------------+-----------+-------------+------------- (1) goto B or C, depending on information available to the agent. (2) if other variable bindings included in the same PDU, provide values for all columns which are missing but required, and all columns have acceptable values, then return noError and goto D. (3) if other variable bindings included in the same PDU, provide legal values for all columns which are missing but required, then return noError and goto C. (4) at the discretion of the agent, the return value may be either: inconsistentName: because the agent does not choose to create such an instance when the corresponding RowStatus instance does not exist, or inconsistentValue: if the supplied value is inconsistent with the state of some other MIB object's value, or noError: because the agent chooses to create the instance. If noError is returned, then the instance of the status column must also be created, and the new state is B or C, depending on the information available to the agent. If inconsistentName or inconsistentValue is returned, the row remains in state A. (5) depending on the MIB definition for the column/table, either noError or inconsistentValue may be returned. (6) the return value can indicate one of the following errors: wrongValue: because the agent does not support notInService (e.g., an agent which does not support createAndWait), or inconsistentValue: because the agent is unable to take the row out of service at this time, perhaps because it is in use and cannot be de-activated. (7) the return value can indicate the following error: inconsistentValue: because the agent is unable to remove the row at this time, perhaps because it is in use and cannot be de-activated. (8) the transition to D can fail, e.g., if the values of the conceptual row are inconsistent, then the error code would be inconsistentValue. NOTE: Other processing of (this and other varbinds of) the set request may result in a response other than noError being returned, e.g., wrongValue, noCreation, etc. Conceptual Row Creation There are four potential interactions when creating a conceptual row: selecting an instance-identifier which is not in use; creating the conceptual row; initializing any objects for which the agent does not supply a default; and, making the conceptual row available for use by the managed device. Interaction 1: Selecting an Instance-Identifier The algorithm used to select an instance-identifier varies for each conceptual row. In some cases, the instance- identifier is semantically significant, e.g., the destination address of a route, and a management station selects the instance-identifier according to the semantics. In other cases, the instance-identifier is used solely to distinguish conceptual rows, and a management station without specific knowledge of the conceptual row might examine the instances present in order to determine an unused instance-identifier. (This approach may be used, but it is often highly sub-optimal; however, it is also a questionable practice for a naive management station to attempt conceptual row creation.) Alternately, the MIB module which defines the conceptual row might provide one or more objects which provide assistance in determining an unused instance-identifier. For example, if the conceptual row is indexed by an integer-value, then an object having an integer-valued SYNTAX clause might be defined for such a purpose, allowing a management station to issue a management protocol retrieval operation. In order to avoid unnecessary collisions between competing management stations, `adjacent' retrievals of this object should be different. Finally, the management station could select a pseudo-random number to use as the index. In the event that this index was already in use and an inconsistentValue was returned in response to the management protocol set operation, the management station should simply select a new pseudo-random number and retry the operation. A MIB designer should choose between the two latter algorithms based on the size of the table (and therefore the efficiency of each algorithm). For tables in which a large number of entries are expected, it is recommended that a MIB object be defined that returns an acceptable index for creation. For tables with small numbers of entries, it is recommended that the latter pseudo-random index mechanism be used. Interaction 2: Creating the Conceptual Row Once an unused instance-identifier has been selected, the management station determines if it wishes to create and activate the conceptual row in one transaction or in a negotiated set of interactions. Interaction 2a: Creating and Activating the Conceptual Row The management station must first determine the column requirements, i.e., it must determine those columns for which it must or must not provide values. Depending on the complexity of the table and the management station's knowledge of the agent's capabilities, this determination can be made locally by the management station. Alternately, the management station issues a management protocol get operation to examine all columns in the conceptual row that it wishes to create. In response, for each column, there are three possible outcomes: - a value is returned, indicating that some other management station has already created this conceptual row. We return to interaction 1. - the exception `noSuchInstance' is returned, indicating that the agent implements the object-type associated with this column, and that this column in at least one conceptual row would be accessible in the MIB view used by the retrieval were it to exist. For those columns to which the agent provides read-create access, the `noSuchInstance' exception tells the management station that it should supply a value for this column when the conceptual row is to be created. - the exception `noSuchObject' is returned, indicating that the agent does not implement the object-type associated with this column or that there is no conceptual row for which this column would be accessible in the MIB view used by the retrieval. As such, the management station can not issue any management protocol set operations to create an instance of this column. Once the column requirements have been determined, a management protocol set operation is accordingly issued. This operation also sets the new instance of the status column to `createAndGo'. When the agent processes the set operation, it verifies that it has sufficient information to make the conceptual row available for use by the managed device. The information available to the agent is provided by two sources: the management protocol set operation which creates the conceptual row, and, implementation-specific defaults supplied by the agent (note that an agent must provide implementation-specific defaults for at least those objects which it implements as read-only). If there is sufficient information available, then the conceptual row is created, a `noError' response is returned, the status column is set to `active', and no further interactions are necessary (i.e., interactions 3 and 4 are skipped). If there is insufficient information, then the conceptual row is not created, and the set operation fails with an error of `inconsistentValue'. On this error, the management station can issue a management protocol retrieval operation to determine if this was because it failed to specify a value for a required column, or, because the selected instance of the status column already existed. In the latter case, we return to interaction 1. In the former case, the management station can re-issue the set operation with the additional information, or begin interaction 2 again using `createAndWait' in order to negotiate creation of the conceptual row. NOTE WELL Regardless of the method used to determine the column requirements, it is possible that the management station might deem a column necessary when, in fact, the agent will not allow that particular columnar instance to be created or written. In this case, the management protocol set operation will fail with an error such as `noCreation' or `notWritable'. In this case, the management station decides whether it needs to be able to set a value for that particular columnar instance. If not, the management station re-issues the management protocol set operation, but without setting a value for that particular columnar instance; otherwise, the management station aborts the row creation algorithm. Interaction 2b: Negotiating the Creation of the Conceptual Row The management station issues a management protocol set operation which sets the desired instance of the status column to `createAndWait'. If the agent is unwilling to process a request of this sort, the set operation fails with an error of `wrongValue'. (As a consequence, such an agent must be prepared to accept a single management protocol set operation, i.e., interaction 2a above, containing all of the columns indicated by its column requirements.) Otherwise, the conceptual row is created, a `noError' response is returned, and the status column is immediately set to either `notInService' or `notReady', depending on whether it has sufficient information to (attempt to) make the conceptual row available for use by the managed device. If there is sufficient information available, then the status column is set to `notInService'; otherwise, if there is insufficient information, then the status column is set to `notReady'. Regardless, we proceed to interaction 3. Interaction 3: Initializing non-defaulted Objects The management station must now determine the column requirements. It issues a management protocol get operation to examine all columns in the created conceptual row. In the response, for each column, there are three possible outcomes: - a value is returned, indicating that the agent implements the object-type associated with this column and had sufficient information to provide a value. For those columns to which the agent provides read-create access (and for which the agent allows their values to be changed after their creation), a value return tells the management station that it may issue additional management protocol set operations, if it desires, in order to change the value associated with this column. - the exception `noSuchInstance' is returned, indicating that the agent implements the object-type associated with this column, and that this column in at least one conceptual row would be accessible in the MIB view used by the retrieval were it to exist. However, the agent does not have sufficient information to provide a value, and until a value is provided, the conceptual row may not be made available for use by the managed device. For those columns to which the agent provides read-create access, the `noSuchInstance' exception tells the management station that it must issue additional management protocol set operations, in order to provide a value associated with this column. - the exception `noSuchObject' is returned, indicating that the agent does not implement the object-type associated with this column or that there is no conceptual row for which this column would be accessible in the MIB view used by the retrieval. As such, the management station can not issue any management protocol set operations to create an instance of this column. If the value associated with the status column is `notReady', then the management station must first deal with all `noSuchInstance' columns, if any. Having done so, the value of the status column becomes `notInService', and we proceed to interaction 4. Interaction 4: Making the Conceptual Row Available Once the management station is satisfied with the values associated with the columns of the conceptual row, it issues a management protocol set operation to set the status column to `active'. If the agent has sufficient information to make the conceptual row available for use by the managed device, the management protocol set operation succeeds (a `noError' response is returned). Otherwise, the management protocol set operation fails with an error of `inconsistentValue'. NOTE WELL A conceptual row having a status column with value `notInService' or `notReady' is unavailable to the managed device. As such, it is possible for the managed device to create its own instances during the time between the management protocol set operation which sets the status column to `createAndWait' and the management protocol set operation which sets the status column to `active'. In this case, when the management protocol set operation is issued to set the status column to `active', the values held in the agent supersede those used by the managed device. If the management station is prevented from setting the status column to `active' (e.g., due to management station or network failure) the conceptual row will be left in the `notInService' or `notReady' state, consuming resources indefinitely. The agent must detect conceptual rows that have been in either state for an abnormally long period of time and remove them. It is the responsibility of the DESCRIPTION clause of the status column to indicate what an abnormally long period of time would be. This period of time should be long enough to allow for human response time (including `think time') between the creation of the conceptual row and the setting of the status to `active'. In the absence of such information in the DESCRIPTION clause, it is suggested that this period be approximately 5 minutes in length. This removal action applies not only to newly-created rows, but also to previously active rows which are set to, and left in, the notInService state for a prolonged period exceeding that which is considered normal for such a conceptual row. Conceptual Row Suspension When a conceptual row is `active', the management station may issue a management protocol set operation which sets the instance of the status column to `notInService'. If the agent is unwilling to do so, the set operation fails with an error of `wrongValue' or `inconsistentValue'. Otherwise, the conceptual row is taken out of service, and a `noError' response is returned. It is the responsibility of the DESCRIPTION clause of the status column to indicate under what circumstances the status column should be taken out of service (e.g., in order for the value of some other column of the same conceptual row to be modified). Conceptual Row Deletion For deletion of conceptual rows, a management protocol set operation is issued which sets the instance of the status column to `destroy'. This request may be made regardless of the current value of the status column (e.g., it is possible to delete conceptual rows which are either `notReady', `notInService' or `active'.) If the operation succeeds, then all instances associated with the conceptual row are immediately removed. · Integer32

This object allows entries to be created and deleted in the slapmPRMonTable. An entry in this table is deleted by setting this object to destroy(6). Removal of an corresponding (same policy index) slapmPolicyRuleStatsEntry has the side effect of the automatic deletion an entry in this table. Note that an attempt to set any read-create object defined within an slapmPRMonEntry while the value of slapmPRMonRowStatus is active(1) will result in an inconsistentValue error.