Translation between SNMP and
SYSLOG Notifications
Vladislav Marinov
Outline
1 Background on SNMP and SYSLOG
2 Motivation
3 SNMP-to-SYSLOG Mapping Definition
Outline
1 Background on SNMP and SYSLOG
2 Motivation
3 SNMP-to-SYSLOG Mapping Definition
The SNMP Management Protocol
An application layer protocol for management and configuration of network attached devices (such as routers, switches, etc.)
Utilizes the Manager/Agent model
The management information is stored in a Management Information Base (MIB) [4]
A tree-like structure with individual variables being the leaves
SNMP Notifications Format
SNMP notification messages are sent by SNMP agents to notify SNMP managers that an event has occurred or that a condition is present
The body of a message is carried in a SNMP Protocol Data Unit (PDU)
A SNMPv2/3 notification messages PDU contains a list of varbinds [4]
sysUpTime.0 and snmpTrapOID.0 are always the first two varbinds in the list
SNMPv3 notifications carry two additional parameters -contextName and contextEngineID
SNMPv1 notifications follows a slightly different format [2].
The SYSLOG Management Protocol
Do you remember my first talk?
A lightweight management protocol used to convey event notification messages [5]
Mesages contain plain text
The SYSLOG Management Protocol
Do you remember my first talk?
A lightweight management protocol used to convey event notification messages [5]
Mesages contain plain text
SYSLOG Message Format[5]
A SYSLOG Message
<66>1 2003-10-11T22:14:15.003Z foo.example.com evntslog - ID47 [exampleSDID@0 iut="3"
eventSource= "Application" eventID="1011"] An application event log entry...
SYSLOG Header - contains priority, version, timestamp, hostname of originator, application name. process ID, message ID
Structured Data - a number of structured data elements Each structured element has an identifier and a number of name-value pairs
Outline
1 Background on SNMP and SYSLOG
2 Motivation
3 SNMP-to-SYSLOG Mapping Definition
Motivation and Goals
Motivation
Some operators prefer SNMP notifications, some operators prefer SYSLOG messages
Some devices generate SNMP notifications, others generate SYSLOG messages
Latest SYSLOG can carry structured data elements
Goals
Specify a mapping from SNMP notifications to SYSLOG messages as an Internet Draft
Create a new SYSLOG structured data element to carry the SNMP notification parameters
Outline
1 Background on SNMP and SYSLOG
2 Motivation
3 SNMP-to-SYSLOG Mapping Definition
SNMP-to-SYSLOG Translator
SNMP-to-SYSLOG Mapping
The SYSLOG header contains values that are specific to the system on which the SNMP-to-SYSLOG translator is running
Priority value of 29 - message of notice for a significant condition generated by a system daemon
Application name of snmptrapd
All SNMP data is kept in an snmp structured data element
Most varbinds are represented by two SD parameters; one SD parameter for the OID and one SD parameter for the value
SNMP Notification
BER Encoding ASN.1 Interpretation
30:7C SEQUENCE { 04:08:80:00:02:B8:04:61:62:63 800002b804616263 04:04:63:74:78:31 "ctx1" A7:6A SNMPv2-Trap-PDU { 02:03:6D:08:67 INTEGER 7145575 02:01:00 INTEGER 0 02:01:00 INTEGER 0 30:5D SEQUENCE OF { 30:0F SEQUENCE { 06:08:2B:06:01:02:01:01:03:00 sysUpTime.0 43:03:01:72:8C 94860 } 30:17 SEQUENCE { 06:0A:2B:06:01:06:03:01:01:04:01:00 snmpTrapOID.0 06:09:2B:06:01:06:03:01:01:05:04 linkUp } 30:0F SEQUENCE { 06:0A:2B:06:01:02:01:02:02:01:01:03 ifIndex.3 02:01:03 3 } 30:0F SEQUENCE { 06:0A:2B:06:01:02:01:02:02:01:07:03 ifAdminStatus.3 02:01:01 up(1) } 30:0F SEQUENCE { 06:0A:2B:06:01:02:01:02:02:01:08:03 ifOperStatus.3 02:01:01 up(1) } } } }
SYSLOG Message
<29>1 2003-10-11T22:14:15.003Z mymachine.example.com snmptrapd - ID47 [snmp ctxEngine="800002b804616263" ctxName="ctx1" sysUpTime="94860" snmpTrapOID="1.3.6.1.6.3.1.1.5.4" o="1.3.6.1.2.1.2.2.1.1.3" d="3" o="1.3.6.1.2.1.2.2.1.7.3" d="1" o="1.3.6.1.2.1.2.2.1.8.3" d="1"]Outline
1 Background on SNMP and SYSLOG
2 Motivation
3 SNMP-to-SYSLOG Mapping Definition
Implementation
The Net-SNMP[1] SNMP open source implementation was extended
A set of functions for manipulating the PDU varbinds A function for creating a SYSLOG message by extracting the SNMP notification parameters from the SNMP message
Conclusion
Translating of notifications between various management protocols is necessary in certain operational environments We have defined a new SYSLOG structured data element carrying the information from an SNMP notification An Internet Draft has been submitted to the SYSLOG working group of the IETF
A prototype of an SNMP-to-SYSLOG translator has been implemented by extending the Net-SNMP code
Future Work:
Some further refining of the map specification following the IETF feedback (i.e should varbinds be also identified by a symbolic name)
References
Net-SNMP, http://www.net-snmp.org/. J. Case, M. Fedor, M. Schoffstall, J. Davin. A Simple Network Management Protocol (SNMP).
RFC 1157, SNMP Research, Performance Systems International, Performance Systems International, MIT Laboratory for Computer Science , May 1990.
R. Frye, D. Levi, S. Routhier, B. Wijnen.
Coexistence between Version 1, Version 2, and Version 3 of the Internet-standard Network Management Framework.
RFC 3584, Vibrant Solutions, Nortel Networks, Wind River Systems, Inc., Lucent Technologies, August 2003.
R. Presuhn.
Management Information Base (MIB) for the Simple Network Management Protocol (SNMP). RFC 3418, BMC Software, Inc., December 2002.
R.Gerhards. The Syslog Protocol.
Internet Draft (work in progress) <draft-ietf-syslog-protocol-23>, Adiscon GmbH, 2007. J. Schoenwaelder V. Marinov.
Mapping Simple Network Management Protocol (SNMP) Notifications to SYSLOG Messages.
