Created attachment 934049 [details]
sample redhat MIB

Benefit to ovirt:
Allow an easy integration with monitoring applications(e.g nagious).

Impact:
Configuration would not have to change although the traps would change
so monitoring triggers might have to be redefined.

Current state:
SNMP traps are being sent from ovirt-engine-notifier, see example[1].

The current OID's sent make it hard to define them under a simple MIB
as we nest all data fields under the id of a specific ALT (AuditLogType).
In order to create a MIB file we would have to parse AuditLogType at each build
and define all ALT in it and for each one define the objects that exist under
it (severity, message type, message text, etc.).

The idea is to have a simple tree MIB under 1.3.6.1.4.1.2312.13.1.1 (===baseoid)
(same as now, so configuration would not need to change)
Where we would define 2 entities:

baseoid.notification.trap[3.1]:
an OID representing trap messages by ovirt-engine-notifier, 
it will be the value of the generic key: SNMPv2-MIB::snmpTrapOID

baseoid.object[3.2]:
baseoid.object.auditlog.alt     (string e.g VDC_STOP)
baseoid.object.auditlog.id      (int e.g 2)
baseoid.object.auditlog.message 
baseoid.object.auditlog.sevirity
baseoid.object.auditlog.type
baseoid.object.auditlog.logTime
baseoid.object.auditlog.userName
baseoid.object.auditlog.vmName
baseoid.object.auditlog.vdsName
baseoid.object.auditlog.vmTemplateName
baseoid.object.auditlog.storagePoolName
baseoid.object.auditlog.storageDomainName
(If a field does not exist for a certain audit message, it will not be included)

In this manner we have the id as a value and not an OID.

A sample message after the change is provided[3].

Additional info:

* 2312 is the OID registered for redhat[2], although we would probably 
  need to distribute a REDHAT-MIB file do define notifications under it.
  A first draft for such is attached.

* We currently define 1.3.6.1.4.1.2312.13.1.1 ovirt-engine-notifier.conf as:
  iso.organization.DoD.Internet.private.enterprises.redhat.ovirt-engine.notifications.audit-log
  We would like to redefine (the same OID) as:
  iso.organization.DoD.Internet.private.enterprises.redhat.ovirt.ovirt-engine.notifications
  as this will allow us in the future to define OID for messages from different
  ovirt entities(e.g hosts).

* We currently append 0[1] after the event id to designate it as
  ENTERPRISE_SPECIFIC trap we would like to drop this as it is unneeded for
  snmpv2 support.

--------------------------------------------------------------------
[1]
Current traps as received by a snmptrapd (line breaks added):
2014-09-02 17:57:03 dhcp-1-204.tlv.redhat.com [UDP: [10.35.1.204]:46652->[10.35.215.71]:162]:
SNMPv2-MIB::snmpTrapOID.0 = OID: SNMPv2-SMI::enterprises.2312.13.1.1.0.2
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (3794) 0:00:37.94
SNMPv2-SMI::enterprises.2312.13.1.1.0.2.0 = STRING: "Engine server is not responding."
SNMPv2-SMI::enterprises.2312.13.1.1.0.2.1 = STRING: "ERROR"
SNMPv2-SMI::enterprises.2312.13.1.1.0.2.2 = STRING: "alertMessage"
SNMPv2-SMI::enterprises.2312.13.1.1.0.2.3 = STRING: "2014-09-02 10:56:26.176
SNMPv2-SMI::enterprises.2312.13.1.1.0.2.4 = STRING: "VDC_STOP"

[2] http://www.alvestrand.no/objectid/1.3.6.1.4.1.2312.html

[3]
2014-09-02 17:57:03 dhcp-1-204.tlv.redhat.com [UDP: [10.35.1.204]:46652->[10.35.215.71]:162]:
SNMPv2-MIB::snmpTrapOID = OID: SNMPv2-SMI::enterprises.2312.13.1.1.1.1[3.1]
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (3794) 0:00:37.94
SNMPv2-SMI::enterprises.2312.13.1.1.2.1.1 = STRING: "VDC_STOP."
SNMPv2-SMI::enterprises.2312.13.1.1.0.2.1 = INTEGER: "3"
...

Given a MIB the numbers above would be translated to meaningful names:
OVIRT-ENGINE-MIB::event_name
OVIRT-ENGINE-MIB::event_id
etc.