Management Information Base (MIB) files

What is a MIB file?

When we tested the snmpd daemon using the snmpwalk application at the end of the previous section you may have noticed that the output contained reference to a number of MIB objects. For your convenience the output is replicated below.

SNMPv2-MIB::sysDescr.0 = STRING: "Web server (node 1)" 

SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10 

DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (216451) 0:36:04.51 

SNMPv2-MIB::sysContact.0 = STRING: sysdamin@internal.hacking.co.uk 

SNMPv2-MIB::sysName.0 = STRING: web-1-1 

SNMPv2-MIB::sysLocation.0 = STRING: "Colo 1 Shelf 2" 

SNMPv2-MIB::sysServices.0 = INTEGER: 72 

... 

The SNMP standard was designed to be extremely flexible, allowing for the monitoring and configuration of a wide range networked devices, so one of the main design requirements was that it be easily extensible. The solution that was devised was to create a hierarchical namespace of objects which could then be standardised and shipped at a later stage by both the Internet Engineering Task Force◳ (IETF) and, more importantly, by third party organisations to support their own custom hardware and extensions. Addresses in this namespace are allocated by IANA in a similar manner to Internet Protocol addresses.

Clearly, if objects which were to be specified in the future were to be integrated with existing SNMP capable software without that software requiring modification, a standard format for describing such objects had to be created so that these descriptions could be easily distributed and used by all SNMP implementations. The solution was to use the already existing Abstract Syntax Notation One (ASN.1)◳ standard to describe this "Management Information" in a standardised format, as described in RFC-1155◳. A file containing a database of such descriptions is therefore known as a Management Information Base or MIB file.

Exploring the MIB tree

As mentioned above, the Management Information Base is organised in a hierarchical manner and is addressed in a similar manner to the Internet Protocol using either dotted-decimal notation or the more user-friendly dotted-names notation, any part of which may or may not be unique.

The net-analyzer/net-snmp package includes the snmptranslate utility which may be used to convert between notations and explore the MIB tree. In the example below we have used the snmptranslate utility to convert the user-friendly name SNMPv2-MIB::sysDescr.0 to its dotted-name equivalent.

.iso.org.dod.internet.mgmt.mib-2.system.sysDescr.0 

Should you wish to obtain the dotted-decimal address of an object then the -On option may be used instead, as shown below.

.1.3.6.1.2.1.1.1.0 

Now that we know that the SNMPv2-MIB::sysDescr.0 object is actually only a part of a much larger tree we can explore that branch by specifying the -Tp option (to print a tree) and supplying the the address of the branch, as demonstrated in the following example.

+--system(1) 

   | 

   +-- -R-- String    sysDescr(1) 

   |        Textual Convention: DisplayString 

   |        Size: 0..255 

   +-- -R-- ObjID     sysObjectID(2) 

   +-- -R-- TimeTicks sysUpTime(3) 

   |  | 

   |  +--sysUpTimeInstance(0) 

   | 

   +-- -RW- String    sysContact(4) 

   |        Textual Convention: DisplayString 

   |        Size: 0..255 

   +-- -RW- String    sysName(5) 

   |        Textual Convention: DisplayString 

   |        Size: 0..255 

   +-- -RW- String    sysLocation(6) 

   |        Textual Convention: DisplayString 

   |        Size: 0..255 

   +-- -R-- INTEGER   sysServices(7) 

   |        Range: 0..127 

   +-- -R-- TimeTicks sysORLastChange(8) 

   |        Textual Convention: TimeStamp 

   | 

   +--sysORTable(9) 

      | 

      +--sysOREntry(1) 

         |  Index: sysORIndex 

         | 

         +-- ---- INTEGER   sysORIndex(1) 

         |        Range: 1..2147483647 

         +-- -R-- ObjID     sysORID(2) 

         +-- -R-- String    sysORDescr(3) 

         |        Textual Convention: DisplayString 

         |        Size: 0..255 

         +-- -R-- TimeTicks sysORUpTime(4) 

                  Textual Convention: TimeStamp 

As you can see in the above output there are a variety of objects located under the iso.org.dod.internet.mgmt.mib-2.system branch, most of which we configured in the /etc/snmp/snmpd.conf file in the previous section.

Searching the MIB tree

There are times of course when we may wish to search for an object in the tree. Usually this is because we believe that there is a MIB object which describes the information which we which to retrieve but do not know the address or name of the object. In the example below we use the snmptranslate utility to search for any object containing the regular expression '.*cpu', which should provide us with a list of the objects representing information relating to the CPU.

UCD-SNMP-MIB::ssCpuRawSoftIRQ 

UCD-SNMP-MIB::ssCpuRawInterrupt 

UCD-SNMP-MIB::ssCpuRawKernel 

UCD-SNMP-MIB::ssCpuRawWait 

UCD-SNMP-MIB::ssCpuRawIdle 

UCD-SNMP-MIB::ssCpuRawSystem 

UCD-SNMP-MIB::ssCpuRawNice 

UCD-SNMP-MIB::ssCpuRawUser 

UCD-SNMP-MIB::ssCpuIdle 

UCD-SNMP-MIB::ssCpuSystem 

UCD-SNMP-MIB::ssCpuUser 

HOST-RESOURCES-MIB::hrSWRunPerfCPU 

As the above output shows there are a number of objects in the default MIB tree which provide CPU related information. Most of them are defined by the UCD-SNMP-MIB, apart from one which is defined in the HOST-RESOURCES-MIB. The ssCpuRawWait object looks to be interesting as it probably reveals how much time our system has spent in a wait state, usually as a result of slow I/O forcing the system to stop and wait for data.

We can locate the address of the UCD-SNMP-MIB::ssCpuRawWait object using the snmptranslate utility, as before.

.iso.org.dod.internet.private.enterprises.ucdavis.systemStats.ssCpuRawWait 

There may be other objects of interest in the iso.org.dod.internet.private.enterprises.ucdavis.systemStats section of the MIB tree. As we demonstrated in an earlier example we can print a tree view of that portion of the MIB tree to see what other objects it contains which may interest us.

+--systemStats(11) 

   | 

   +-- -R-- Integer32 ssIndex(1) 

   +-- -R-- String    ssErrorName(2) 

   |        Textual Convention: DisplayString 

   |        Size: 0..255 

   +-- -R-- Integer32 ssSwapIn(3) 

   +-- -R-- Integer32 ssSwapOut(4) 

   +-- -R-- Integer32 ssIOSent(5) 

   +-- -R-- Integer32 ssIOReceive(6) 

   +-- -R-- Integer32 ssSysInterrupts(7) 

   +-- -R-- Integer32 ssSysContext(8) 

   +-- -R-- Integer32 ssCpuUser(9) 

   +-- -R-- Integer32 ssCpuSystem(10) 

   +-- -R-- Integer32 ssCpuIdle(11) 

   +-- -R-- Counter   ssCpuRawUser(50) 

   +-- -R-- Counter   ssCpuRawNice(51) 

   +-- -R-- Counter   ssCpuRawSystem(52) 

   +-- -R-- Counter   ssCpuRawIdle(53) 

   +-- -R-- Counter   ssCpuRawWait(54) 

   +-- -R-- Counter   ssCpuRawKernel(55) 

   +-- -R-- Counter   ssCpuRawInterrupt(56) 

   +-- -R-- Counter   ssIORawSent(57) 

   +-- -R-- Counter   ssIORawReceived(58) 

   +-- -R-- Counter   ssRawInterrupts(59) 

   +-- -R-- Counter   ssRawContexts(60) 

   +-- -R-- Counter   ssCpuRawSoftIRQ(61) 

   +-- -R-- Counter   ssRawSwapIn(62) 

   +-- -R-- Counter   ssRawSwapOut(63) 

You can also use the snmptranslate utility to display the contents of a particular MIB file, and any MIB files it references as dependencies, as a tree. The example command below will show the contents of the LM-SENSORS-MIB file.

Browsing the MIB tree

Sometimes however it is more convenient to browse the MIB tree using a graphical application. An example of such an application is the mbrowse application in the net-analyzer/mbrowse package.