-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
--
-- Trend Micro, Inc.
-- Copyright information is in the DESCRIPTION section of the MODULE-IDENTITY.
-- 
-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

TPT-MISC-NOTIFY-MIB

DEFINITIONS ::= BEGIN

IMPORTS
  MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE, 
  Unsigned32, IpAddress, Integer32, Counter64
    FROM SNMPv2-SMI

  DateAndTime,
  TEXTUAL-CONVENTION
    FROM SNMPv2-TC

  Ipv6Address
    FROM IPV6-TC

  InetAddress,
  InetAddressType
    FROM INET-ADDRESS-MIB
    
  SnmpAdminString
    FROM SNMP-FRAMEWORK-MIB

  tpt-tpa-objs, tpt-tpa-eventsV2, tpt-tpa-unkparams
    FROM TPT-TPAMIBS-MIB
    
  SslInspectedFlag
    FROM TPT-POLICY-MIB
  ;

tpt-misc-notify MODULE-IDENTITY
  LAST-UPDATED "201605251854Z" -- May 25, 2016
  ORGANIZATION "Trend Micro, Inc."
  CONTACT-INFO "www.trendmicro.com"
  DESCRIPTION
    "Notification definitions that have no other place to call home.

     Copyright (C) 2016 Trend Micro Incorporated. All Rights Reserved.
     
     Trend Micro makes no warranty of any kind with regard to this material,
     including, but not limited to, the implied warranties of merchantability
     and fitness for a particular purpose. Trend Micro shall not be liable for
     errors contained herein or for incidental or consequential damages in
     connection with the furnishing, performance, or use of this material. This
     document contains proprietary information, which is protected by copyright. No
     part of this document may be photocopied, reproduced, or translated into
     another language without the prior written consent of Trend Micro. The
     information is provided 'as is' without warranty of any kind and is subject to
     change without notice. The only warranties for Trend Micro products and
     services are set forth in the express warranty statements accompanying such
     products and services. Nothing herein should be construed as constituting an
     additional warranty. Trend Micro shall not be liable for technical or editorial
     errors or omissions contained herein. TippingPoint(R), the TippingPoint logo, and
     Digital Vaccine(R) are registered trademarks of Trend Micro. All other company
     and product names may be trademarks of their respective holders. All rights
     reserved. This document contains confidential information, trade secrets or
     both, which are the property of Trend Micro. No part of this documentation may
     be reproduced in any form or by any means or used to make any derivative work
     (such as translation, transformation, or adaptation) without written permission
     from Trend Micro or one of its subsidiaries. All other company and product
     names may be trademarks of their respective holders.
    "

  REVISION "201605251854Z" -- May 25, 2016 
  DESCRIPTION "Updated copyright information. Minor MIB syntax fixes."
  
  REVISION    "201605031726Z" -- May 03, 2016
  DESCRIPTION "Added emergency, alert, notice, info, and debug severity values to SystemLogSeverity."

  REVISION    "201505281330Z" -- May 28, 2015
  DESCRIPTION "Added SSL inspected flag parameter to quarantine notifications."
  
  REVISION    "201411111843Z" -- November 12, 2014
  DESCRIPTION "Added audit log notification and objects."

  ::= { tpt-tpa-objs 2 }

-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
--
-- Device ID: first payload parameter of all notifications in this module.
--
-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

tptMiscNotifyDeviceID OBJECT-TYPE
  SYNTAX      OCTET STRING (SIZE (0..40))
  MAX-ACCESS  read-only
  STATUS      current
  DESCRIPTION
    "The unique identifier of the device sending this notification."
  ::= { tpt-tpa-unkparams 31 }

-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
--
-- Managed notification
--
-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

tptManagedNotify NOTIFICATION-TYPE
  OBJECTS     { tptMiscNotifyDeviceID }
  STATUS      current
  DESCRIPTION
    "Notification: Used to inform the management station that the device 
     is now being managed by said management station."
  ::= { tpt-tpa-eventsV2 9 }

-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
--
-- Unmanaged notification
--
-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

tptUnmanagedNotify NOTIFICATION-TYPE
  OBJECTS     { tptMiscNotifyDeviceID }
  STATUS      current
  DESCRIPTION
    "Notification: Used to inform the management station that the device 
     is no longer being managed by said management station."
  ::= { tpt-tpa-eventsV2 10 }


-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
--
-- Textual convention for log file rollover notifications
--
-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

LogFileType ::= TEXTUAL-CONVENTION
  STATUS      current
  DESCRIPTION 
    "The type of the file that has rolled over."
  SYNTAX      INTEGER { system(1), alert(2), block(3), peer(4), audit(5),
						quarantine(6) }

-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
--
-- Log file rollover notifications
--
-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

tptRolloverNotifyFileType OBJECT-TYPE
  SYNTAX      LogFileType
  MAX-ACCESS  read-only
  STATUS      current
  DESCRIPTION
    "The type of the file that has rolled over."
  ::= { tpt-tpa-unkparams 32 }

tptRolloverNotifyMaxFiles OBJECT-TYPE
  SYNTAX      Unsigned32
  MAX-ACCESS  read-only
  STATUS      deprecated
  DESCRIPTION
    "The maximum number of files maintained for this log file type."
  ::= { tpt-tpa-unkparams 33 }

tptRolloverNotifyNumFiles OBJECT-TYPE
  SYNTAX      Unsigned32
  MAX-ACCESS  read-only
  STATUS      deprecated
  DESCRIPTION
    "The number of files that have rolled over."
  ::= { tpt-tpa-unkparams 34 }

tptRolloverNotifyTime OBJECT-TYPE
  SYNTAX      Unsigned32
  MAX-ACCESS  read-only
  STATUS      current
  DESCRIPTION
    "The rollover time of the most recent file pertaining to this notification 
     (in seconds since January 1, 1970)."
  ::= { tpt-tpa-unkparams 35 }

tptRolloverNotify NOTIFICATION-TYPE
  OBJECTS     { tptMiscNotifyDeviceID,     tptRolloverNotifyFileType,
                tptRolloverNotifyTime }
  STATUS      current
  DESCRIPTION
    "Notification: Used to inform the management station that a log file 
     has rolled over."
  ::= { tpt-tpa-eventsV2 11 }


-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
--
-- Textual convention for discovery notifications
--
-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

DiscoveryDelta ::= TEXTUAL-CONVENTION
  STATUS      current
  DESCRIPTION 
    "An indication of whether discovery results changed from the previous scan."
  SYNTAX      INTEGER { changed(1), unchanged(2) }

-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
--
-- Discovery notifications
--
-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

tptDiscoveryNotifyScanID OBJECT-TYPE
  SYNTAX      OCTET STRING (SIZE (0..40))
  MAX-ACCESS  read-only
  STATUS      obsolete
  DESCRIPTION
    "The unique identifier of the scan pertaining to this notification."
  ::= { tpt-tpa-unkparams 42 }

tptDiscoveryNotifySegmentName OBJECT-TYPE
  SYNTAX      OCTET STRING (SIZE (0..128))
  MAX-ACCESS  read-only
  STATUS      obsolete
  DESCRIPTION
    "The name of the scanned segment pertaining to this notification."
  ::= { tpt-tpa-unkparams 43 }

tptDiscoveryNotifyScanRange OBJECT-TYPE
  SYNTAX      OCTET STRING (SIZE (0..40))
  MAX-ACCESS  read-only
  STATUS      obsolete
  DESCRIPTION
    "The network address range requested in the scan pertaining to this 
     notification."
  ::= { tpt-tpa-unkparams 44 }

tptDiscoveryNotifyDelta OBJECT-TYPE
  SYNTAX      DiscoveryDelta
  MAX-ACCESS  read-only
  STATUS      obsolete
  DESCRIPTION
    "An indication of whether discovery results changed from the previous scan.
     Undefined if this notification signifies the start of a scan."
  ::= { tpt-tpa-unkparams 45 }

tptDiscoveryNotifyNewHosts OBJECT-TYPE
  SYNTAX      Integer32
  MAX-ACCESS  read-only
  STATUS      obsolete
  DESCRIPTION
    "The number of new hosts found by this scan (compared to the previous scan).
     Undefined if this notification signifies the start of a scan."
  ::= { tpt-tpa-unkparams 46 }

tptDiscoveryNotifyChanged OBJECT-TYPE
  SYNTAX      Integer32
  MAX-ACCESS  read-only
  STATUS      obsolete
  DESCRIPTION
    "The number of hosts for which this scan found different results 
     from the previous scan.  
     Undefined if this notification signifies the start of a scan."
  ::= { tpt-tpa-unkparams 47 }

tptDiscoveryNotifyUnchanged OBJECT-TYPE
  SYNTAX      Integer32
  MAX-ACCESS  read-only
  STATUS      obsolete
  DESCRIPTION
    "The number of existing hosts for which this scan found the same results 
     (compared to the previous scan).  
     Undefined if this notification signifies the start of a scan."
  ::= { tpt-tpa-unkparams 48 }

tptDiscoveryNotifyNotFound OBJECT-TYPE
  SYNTAX      Integer32
  MAX-ACCESS  read-only
  STATUS      obsolete
  DESCRIPTION
    "The number of hosts found by the previous scan but not by this scan.  
     Undefined if this notification signifies the start of a scan."
  ::= { tpt-tpa-unkparams 49 }

tptDiscoveryNotifyUnknown OBJECT-TYPE
  SYNTAX      Integer32
  MAX-ACCESS  read-only
  STATUS      obsolete
  DESCRIPTION
    "The number of addresses scanned where no host was found and for which 
     there was no previous scan data.  
     Undefined if this notification signifies the start of a scan."
  ::= { tpt-tpa-unkparams 50 }

tptDiscoveryNotifyStartTime OBJECT-TYPE
  SYNTAX      Unsigned32
  MAX-ACCESS  read-only
  STATUS      obsolete
  DESCRIPTION
    "The start time of the scan pertaining to this notification (in seconds 
     since January 1, 1970)."
  ::= { tpt-tpa-unkparams 51 }

tptDiscoveryNotifyStopTime OBJECT-TYPE
  SYNTAX      Unsigned32
  MAX-ACCESS  read-only
  STATUS      obsolete
  DESCRIPTION
    "The stop time of the scan pertaining to this notification (in seconds 
     since January 1, 1970).  A zero value indicates that this notification 
     signifies the start of a scan."
  ::= { tpt-tpa-unkparams 52 }

tptDiscoveryNotifyErrorText OBJECT-TYPE
  SYNTAX      OCTET STRING (SIZE (0..80))
  MAX-ACCESS  read-only
  STATUS      obsolete
  DESCRIPTION
    "If the current scan terminated abnormally, this string describes the 
     error condition.  Otherwise, an empty string."
  ::= { tpt-tpa-unkparams 53 }

tptDiscoveryNotifySchedID OBJECT-TYPE
  SYNTAX      OCTET STRING (SIZE (0..40))
  MAX-ACCESS  read-only
  STATUS      obsolete
  DESCRIPTION
    "For a notification resulting from a scheduled scan, this value holds 
     the scheduled scan identifier.  Otherwise, this value is undefined."
  ::= { tpt-tpa-unkparams 56 }

tptDiscoveryNotifyStartStop NOTIFICATION-TYPE
  OBJECTS     { tptMiscNotifyDeviceID,          tptDiscoveryNotifyScanID, 
                tptDiscoveryNotifySegmentName,  tptDiscoveryNotifyScanRange,
                tptDiscoveryNotifyDelta,        tptDiscoveryNotifyNewHosts, 
                tptDiscoveryNotifyChanged,      tptDiscoveryNotifyUnchanged, 
                tptDiscoveryNotifyNotFound,     tptDiscoveryNotifyUnknown, 
                tptDiscoveryNotifyStartTime,    tptDiscoveryNotifyStopTime,    
                tptDiscoveryNotifyErrorText,    tptDiscoveryNotifySchedID }
  STATUS      obsolete
  DESCRIPTION
    "Notification: Used to inform the management station that a network 
     discovery scan has started or stopped."
  ::= { tpt-tpa-eventsV2 12 }


tptDiscoveryNotifyHostNetAddr OBJECT-TYPE
  SYNTAX      IpAddress
  MAX-ACCESS  read-only
  STATUS      obsolete
  DESCRIPTION
    "The network address of the newly discovered host."
  ::= { tpt-tpa-unkparams 54 }

tptDiscoveryNotifyHostDeviceID OBJECT-TYPE
  SYNTAX      OCTET STRING (SIZE (0..40))
  MAX-ACCESS  read-only
  STATUS      obsolete
  DESCRIPTION
    "The unique identifier of the newly discovered host."
  ::= { tpt-tpa-unkparams 55 }

tptDiscoveryNotifyNewHost NOTIFICATION-TYPE
  OBJECTS     { tptMiscNotifyDeviceID,  tptDiscoveryNotifyHostNetAddr, 
                tptDiscoveryNotifyHostDeviceID }
  STATUS      obsolete
  DESCRIPTION
    "Notification: Used to inform the management station that a previously 
     unknown host was discovered by a scan."
  ::= { tpt-tpa-eventsV2 13 }


-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
--
-- Textual convention for system log notifications
--
-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

SystemLogSeverity ::= TEXTUAL-CONVENTION
  STATUS      current
  DESCRIPTION 
    "An indication of the severity of a system log message."
  SYNTAX      INTEGER { critical(1), error(2), emergency(3), warning(4), alert(5), notice(6), info(7), debug(8) }

-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
--
-- System log notifications
--
-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

tptSystemLogNotifyText OBJECT-TYPE
  SYNTAX      OCTET STRING (SIZE (0..1024))
  MAX-ACCESS  read-only
  STATUS      current
  DESCRIPTION
    "The text of the message being logged."
  ::= { tpt-tpa-unkparams 92 }

tptSystemLogNotifySequence OBJECT-TYPE
  SYNTAX      Counter64
  MAX-ACCESS  read-only
  STATUS      current
  DESCRIPTION
    "The log file entry sequence number corresponding to this notification."
  ::= { tpt-tpa-unkparams 93 }

tptSystemLogNotifySeverity OBJECT-TYPE
  SYNTAX      SystemLogSeverity
  MAX-ACCESS  read-only
  STATUS      current
  DESCRIPTION
    "The severity of the attack for this notification."
  ::= { tpt-tpa-unkparams 94 }

tptSystemLogNotifyTimeSec OBJECT-TYPE
  SYNTAX      Unsigned32
  MAX-ACCESS  read-only
  STATUS      current
  DESCRIPTION
    "The time this message was logged (in seconds since January 1, 1970)."
  ::= { tpt-tpa-unkparams 95 }

tptSystemLogNotifyTimeNano OBJECT-TYPE
  SYNTAX      Unsigned32
  MAX-ACCESS  read-only
  STATUS      current
  DESCRIPTION
    "The nanoseconds portion of tptSystemLogNotifyTimeSec."
  ::= { tpt-tpa-unkparams 96 }

tptSystemLogNotify NOTIFICATION-TYPE
  OBJECTS     { tptMiscNotifyDeviceID,          tptSystemLogNotifyText, 
                tptSystemLogNotifySequence,     tptSystemLogNotifySeverity, 
                tptSystemLogNotifyTimeSec,      tptSystemLogNotifyTimeNano }
  STATUS      current
  DESCRIPTION
    "Notification: Used to inform the management station that a critical, 
     error, or warning message has been logged."
  ::= { tpt-tpa-eventsV2 16 }

-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
--
-- Textual convention for quarantine notifications
--
-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

AddOrRemove ::= TEXTUAL-CONVENTION
  STATUS      current
  DESCRIPTION 
    "An indication of whether a host was added to or removed from 
     the quarantine list."
  SYNTAX      INTEGER { add(1), remove(2) }

-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
--
-- Quarantine notifications
--
-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

tptQuarantineNotifyHostNetAddr OBJECT-TYPE
  SYNTAX      IpAddress
  MAX-ACCESS  read-only
  STATUS      current
  DESCRIPTION
    "The network address of the host being quarantined (or removed)."
  ::= { tpt-tpa-unkparams 132 }

tptQuarantineNotifyHostNetAddrV6 OBJECT-TYPE
  SYNTAX      Ipv6Address
  MAX-ACCESS  read-only
  STATUS      current
  DESCRIPTION
    "The IPv6 network address of the host being quarantined (or removed)."
  ::= { tpt-tpa-unkparams 136 }

tptQuarantineNotifyReason OBJECT-TYPE
  SYNTAX      OCTET STRING (SIZE (0..40))
  MAX-ACCESS  read-only
  STATUS      current
  DESCRIPTION
    "The reason that a host was quarantined (undefined if action is remove)."
  ::= { tpt-tpa-unkparams 133 }

tptQuarantineNotifySegmentName OBJECT-TYPE
  SYNTAX      OCTET STRING (SIZE (0..128))
  MAX-ACCESS  read-only
  STATUS      current
  DESCRIPTION
    "A string of the format <slot>:<index> that uniquely identifies the 
     segment pertaining to this notification."
  ::= { tpt-tpa-unkparams 134 }

tptQuarantineNotifyAction OBJECT-TYPE
  SYNTAX      AddOrRemove
  MAX-ACCESS  read-only
  STATUS      current
  DESCRIPTION
    "Whether the host was added to or removed from the quarantine list." 
  ::= { tpt-tpa-unkparams 135 }
  
tptQuarantineNotifySslInspected OBJECT-TYPE
  SYNTAX      SslInspectedFlag
  MAX-ACCESS  read-only
  STATUS      current
  DESCRIPTION
    "Flag indicating if this quarantine action was performed on an inspected SSL data stream." 
  ::= { tpt-tpa-unkparams 181 }

tptQuarantineNotify NOTIFICATION-TYPE
  OBJECTS     { tptMiscNotifyDeviceID,        tptQuarantineNotifyHostNetAddr, 
                tptQuarantineNotifyReason,    tptQuarantineNotifySegmentName, 
                tptQuarantineNotifyAction,    tptQuarantineNotifyHostNetAddrV6,
                tptQuarantineNotifySslInspected}
  STATUS      current
  DESCRIPTION
    "Notification: Used to inform the management station that a host has 
     been either added to or removed from the quarantine list." 
  ::= { tpt-tpa-eventsV2 20 }

-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
--
-- Textual convention(s) specific to congestion threshold notifications
--
-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

CongestionThresholdPhase ::= TEXTUAL-CONVENTION
  STATUS                  current
  DESCRIPTION
    "The congestion threshold phase (entering, continuing, or exiting)."
  SYNTAX      INTEGER { entering(1), continuing(2), exiting (3) }

-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
--
-- Congestion threshold notifications
--
-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

tptCongestionPacketLoss OBJECT-TYPE
  SYNTAX      Unsigned32
  MAX-ACCESS  read-only
  STATUS      current
  DESCRIPTION
    "The current packet loss rate per thousand (percent * 10)."
  ::= { tpt-tpa-unkparams 153 }

tptCongestionNotifyPhase OBJECT-TYPE
  SYNTAX      CongestionThresholdPhase
  MAX-ACCESS  read-only
  STATUS      current
  DESCRIPTION
    "Whether entering, continuing, or exiting congestion threshold mode."
  ::= { tpt-tpa-unkparams 154 }

tptCongestionThreshold OBJECT-TYPE
  SYNTAX      Unsigned32
  MAX-ACCESS  read-only
  STATUS      current
  DESCRIPTION
    "The current packet loss threshold per thousand (percent * 10)."
  ::= { tpt-tpa-unkparams 155 }

tptTier3CongestionPacketLoss OBJECT-TYPE
  SYNTAX      Unsigned32
  MAX-ACCESS  read-only
  STATUS      current
  DESCRIPTION
    "The current tier3 packet loss rate per thousand (percent * 10)."
  ::= { tpt-tpa-unkparams 156 }

tptTier3CongestionNotifyPhase OBJECT-TYPE
  SYNTAX      CongestionThresholdPhase
  MAX-ACCESS  read-only
  STATUS      current
  DESCRIPTION
    "Whether entering, continuing, or exiting tier3 congestion threshold mode."
  ::= { tpt-tpa-unkparams 157 }

tptTier3CongestionThreshold OBJECT-TYPE
  SYNTAX      Unsigned32
  MAX-ACCESS  read-only
  STATUS      current
  DESCRIPTION
    "The current tier3 packet loss threshold per thousand (percent * 10)."
  ::= { tpt-tpa-unkparams 158 }

tptCongestionThresholdNotify NOTIFICATION-TYPE
  OBJECTS     { tptMiscNotifyDeviceID,        tptCongestionNotifyPhase,
                tptCongestionPacketLoss,      tptCongestionThreshold }
  STATUS      current
  DESCRIPTION
    "Notification: Used to inform the management station that the device-wide
     congestion has exceeded the configured congestion threshold."
  ::= { tpt-tpa-eventsV2 25 }

tptiTier3CongestionThresholdNotify NOTIFICATION-TYPE
  OBJECTS     { tptMiscNotifyDeviceID,        tptTier3CongestionNotifyPhase,
                tptTier3CongestionPacketLoss, tptTier3CongestionThreshold }
  STATUS      current
  DESCRIPTION
    "Notification: Used to inform the management station that the tier3
     congestion has exceeded the configured congestion threshold."
  ::= { tpt-tpa-eventsV2 26 }


-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
--
-- Audit Log Notification
--
-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

tptAuditLogNotify NOTIFICATION-TYPE
  OBJECTS     {
                tptMiscNotifyDeviceID,
                tptAuditLogNotifyTime,
                tptAuditLogNotifyAccess,
                tptAuditLogNotifyType,
                tptAuditLogNotifyIpAddrType,
                tptAuditLogNotifyIpAddr,
                tptAuditLogNotifyCategory,
                tptAuditLogNotifyResult,
                tptAuditLogNotifyUser,
                tptAuditLogNotifyMessage
              }
  STATUS      current
  DESCRIPTION "Audit-log notification.
              "
::= { tpt-tpa-eventsV2 60 }

AuditLogResult ::= TEXTUAL-CONVENTION
  STATUS      current
  DESCRIPTION "The result of an audit check: success, or fail.
              "
  SYNTAX      INTEGER { success(1), failed(2) }

AuditLogCategory ::= TEXTUAL-CONVENTION
  STATUS      current
  DESCRIPTION "The functional location of where an audit check was made and generated
               a log entry.
              "
  SYNTAX      INTEGER { 
		          undefined(1),
		          general(2),
		          login(3),
		          logout(4),
		          user(5),
		          time(6),
		          policy(7),
		          update(8),
		          boot(9),
		          report(10),
		          host(11),
		          cfg(12),
		          device(13),
		          sms(14),
		          server(15),
		          segment(16),
		          license(17),
		          ha(18),
		          monitor(19),
		          ipFilter(20),
		          connTable(21),
		          hostComm(22),
		          tse(23),
		          cf(24)
              }
  
tptAuditLogNotifyTime OBJECT-TYPE
  SYNTAX      DateAndTime 
  MAX-ACCESS  accessible-for-notify
  STATUS      current 
  DESCRIPTION "The date and time when the entry was logged.
              "
::= { tpt-tpa-unkparams 170 }

tptAuditLogNotifyAccess OBJECT-TYPE
  SYNTAX      Unsigned32
  MAX-ACCESS  accessible-for-notify
  STATUS      current 
  DESCRIPTION "The access level of the user initiating the audit check and generating the log.
               This is a bit field with the following mapping:
               
                     0x0 - normal 
                     0x1 - operator
                     0x4 - administrator
                     0x8 - super-user
              "
::= { tpt-tpa-unkparams 171 }

tptAuditLogNotifyType OBJECT-TYPE
  SYNTAX      SnmpAdminString (SIZE(0..40))
  MAX-ACCESS  accessible-for-notify
  STATUS      current 
  DESCRIPTION "The interface source of the audit log action.
              "
::= { tpt-tpa-unkparams 172 }

tptAuditLogNotifyIpAddrType OBJECT-TYPE
  SYNTAX      InetAddressType
  MAX-ACCESS  accessible-for-notify
  STATUS      current 
  DESCRIPTION "The type of IP address from which the user connected.
              "
::= { tpt-tpa-unkparams 173 }

tptAuditLogNotifyIpAddr OBJECT-TYPE
  SYNTAX      InetAddress
  MAX-ACCESS  accessible-for-notify
  STATUS      current 
  DESCRIPTION "The IP address from which the user connected.
              "
::= { tpt-tpa-unkparams 174 }

tptAuditLogNotifyCategory OBJECT-TYPE
  SYNTAX      AuditLogCategory
  MAX-ACCESS  accessible-for-notify
  STATUS      current 
  DESCRIPTION "The functional area where the audit log was generated.
              "
::= { tpt-tpa-unkparams 175 }

tptAuditLogNotifyResult OBJECT-TYPE
  SYNTAX      AuditLogResult
  MAX-ACCESS  accessible-for-notify
  STATUS      current 
  DESCRIPTION "The result, pass or fail, of an audit check.
              "
::= { tpt-tpa-unkparams 176 }

tptAuditLogNotifyUser OBJECT-TYPE
  SYNTAX      SnmpAdminString (SIZE(0..80))
  MAX-ACCESS  accessible-for-notify
  STATUS      current 
  DESCRIPTION "The user initiating the audit check and generating the log.
              "
::= { tpt-tpa-unkparams 177 }

tptAuditLogNotifyMessage OBJECT-TYPE
  SYNTAX      OCTET STRING (SIZE(0..4096))
  --SYNTAX      SnmpAdminString (SIZE(0..4096))
  MAX-ACCESS  accessible-for-notify
  STATUS      current 
  DESCRIPTION "A description of what configuration change was attempted 
               (and possibly succeeded) by the user.
              "
::= { tpt-tpa-unkparams 178 }

tptAuditLogCapacityNotifyPercent OBJECT-TYPE
  SYNTAX      Unsigned32
  MAX-ACCESS  read-only
  STATUS      current
  DESCRIPTION
    "The time of this notification
     (in seconds since January 1, 1970)."
  ::= { tpt-tpa-unkparams 201 }

tptAuditLogCapacityOrFailureNotifyTime OBJECT-TYPE
  SYNTAX      Unsigned32
  MAX-ACCESS  read-only
  STATUS      current
  DESCRIPTION
    "The time of this notification
     (in seconds since January 1, 1970)."
  ::= { tpt-tpa-unkparams 202 }

tptAuditLogCapacityNotify NOTIFICATION-TYPE
  OBJECTS     { tptMiscNotifyDeviceID,     tptAuditLogCapacityNotifyPercent,
                tptRolloverNotifyTime }
  STATUS      current
  DESCRIPTION
    "Notification: Used to inform the management station that audit log file size
     has reached more than 75 percent."
  ::= { tpt-tpa-eventsV2 61 }

tptLoggingFailureNotify NOTIFICATION-TYPE
  OBJECTS     { tptMiscNotifyDeviceID,
                tptRolloverNotifyTime }
  STATUS      current
  DESCRIPTION
    "Notification: Used to inform the management station that logging has failed."
  ::= { tpt-tpa-eventsV2 62 }

END

