Subject: Re: [Disman] Event MIB Implementation Survey

From: Benoit Claise <[email-masked]>
Date: Wed, 11 Aug 2004 12:25:41 +0200

Hi Randy,

Sorry for the late reply.
Note that some URLs below might require a www.cisco.com login.

Implementation Survey for RFC 2981, Event MIB

_Module:_ DISMAN-EVENT-MIB

_Implementation Source:_ 
Cisco IOS
	Release 12.0(12)S was based on the draft-ietf-disman-event-mib-10.txt
	Release 12.2(4)T is compliant to RFC2981
	http://www.cisco.com/en/US/customer/products/sw/iosswrel/ps1834/products_feature_guide09186a00800801fd.html
	http://www.cisco.com/en/US/products/sw/iosswrel/ps1839/products_feature_guide09186a00800c391a.html

_Management Application / Agent:_ Agent

<>_GROUPs:_
dismanEventResourceGroup (y/n): y
dismanEventTriggerGroup (y/n): y
dismanEventObjectsGroup (y/n): y
dismanEventEventGroup (y/n): y
dismanEventNotificationObjectGroup (y/n): y
dismanEventNotificationGroup (y/n): y

_OBJECTs:_
mteTriggerTargetTag (ro/rw): ro
mteEventSetTargetTag (ro/rw): ro
mteTriggerValueIDWildcard (ro/rw): rw
mteTriggerContextNameWildcard (ro/rw): ro
mteObjectsIDWildcard (ro/rw): rw
mteEventSetContextNameWildcard (ro/rw): ro

_Deployment / Operational Experience:_
We have a couple of working examples posted on www.cisco.com
- The example monitors the locIfInputQueueDrops MIB object for increases
http://www.cisco.com/en/US/customer/products/hw/routers/ps133/products_white_paper09186a00801a5a68.shtml

- A combined exampled of the EVENT and EXPRESSION MIBs
http://www.cisco.com/en/US/tech/tk648/tk362/technologies_configuration_example09186a008023267a.shtml

Some other working examples will be posted soon:
- Customized notification.
A trigger will monitor the status of the ifOperStatus snmp-variable of 
all the interfaces. When this value changes for one of the interfaces, 
then a snmp-trap will be sent that will contain some customized fields: 
ifIndex, ifDescr, ifType, sysLocation, sysName.
This example uses the existence + notification functionalities of the 
EVENT-MIB

- Writing the new configuration automatically to a tftp server.
A trigger will monitor the status of the ccmHistoryRunningLastChanged 
snmp-variable. When the value
changes (which means that the config was possibly changed), a copy of 
the current config will be sent to a server via tftp.
This example uses the existence + SNMPSet functionalities of the EVENT-MIB

- Backup interface
A trigger will monitor the status of the ifInOctets snmp-variable of a 
specific the interface. When the delta reaches a threshold, a secondary 
line will be brought up using ifOperStatus. When the delta goes below a 
threshold then the secondary line will be shut down.
This example uses the threshold + SNMPSet functionalities of the EVENT-MIB

_Comments:_
This MIB has been implemented for a couple of years already, but not widely used.
The first issue is that not many customers knew about it.
I presented a "Fault Management" update at 2 big events recently (total: 300 customers). After presenting the EVENT MIB, I asked a few questions. To be perfectly accurate, the questions were for both EVENT & EXPRESSION MIB, as those 2 MIBs go along together. The EXPRESSION MIB will triger another email later on; anyway the conclusions are useful for the EVENT MIB.
	1. Who knew about this MIBs before Networkers?
           Just one of two hands up
        2. Who consider those 2 MIBs useful in their environments?
           A majority of hands up
        3. Who will be playing with those 2 MIBs back home?
           I would say 1/3 of the audience.
The second issue is that this MIB is not easy to set up. For example, the indexing must be clearly explained with one example. So more examples should be posted to help the easier deployement.

Customizing the events in the network elements in time consuming. We don't want to loose the configuration in case of network element reload. The EVENT MIB persistence was introduced
http://www.cisco.com/en/US/partner/products/sw/iosswrel/ps1839/products_feature_guide09186a0080087bdc.html

Regards, Benoit.

---

From: Benoit Claise <[email-masked]>
Date: Wed, 11 Aug 2004 18:15:31 +0200

> mteEventSetContextNameWildcard (ro/rw): ro

Actually, when I wrote ro, I wanted to say that remote monitoring and 
context wildcarding are not implemented.
So potentially, the right answer should: no

Regards, Benoit

> then a snmp-trap will be sent that will contain some customized 
> fields: ifIndex, ifDescr, ifType, sysLocation, sysName.
> specific the interface. When the delta reaches a threshold, a 
> secondary line will be brought up using ifOperStatus. When the delta 
> goes below a threshold then the secondary line will be shut down.

---

From: "Randy Presuhn" <[email-masked]>
Date: Wed, 11 Aug 2004 12:02:52 -0700

Hi -

Thanks for the implementation report and the clarification.

Randy

> From: "Benoit Claise" <[email-masked]>
> To: "Benoit Claise" <[email-masked]>
> Cc: "Randy Presuhn" <[email-masked]>; "Disman (E-mail)" <[email-masked]>
> Sent: Wednesday, August 11, 2004 9:15 AM
> Subject: Re: [Disman] Event MIB Implementation Survey
>

> >I presented a "Fault Management" update at 2 big events recently (total: 300 customers). After presenting the EVENT MIB, I asked
a few questions. To be perfectly accurate, the questions were for both EVENT & EXPRESSION MIB, as those 2 MIBs go along together.
The EXPRESSION MIB will triger another email later on; anyway the conclusions are useful for the EVENT MIB.
> >The second issue is that this MIB is not easy to set up. For example, the indexing must be clearly explained with one example. So
more examples should be posted to help the easier deployement.
> >
> >Customizing the events in the network elements in time consuming. We don't want to loose the configuration in case of network
element reload. The EVENT MIB persistence was introduced