GB/T 17143.6-1997 Information technology Open Systems Interconnection System management Part 6: Log control function
Some standard content:
GB/T17143.6--1997
This standard is equivalent to ISO/IEC10164-6:1993 "Information Technology Open Systems Interconnection System Management: Log Control Function". GB/T17143, under the general title of "Information Technology Open Systems Interconnection System Management", currently includes the following 8 parts: Part 1 (i.e. GB/T17143.1): Object management function Part 2 (i.e. GB/T17143.2): State management function Part 3 (i.e. GB/T17143.3): Attributes representing relationships Part 4 (i.e. GB/T17143.4): Alarm reporting function Part 5 (i.e. GB/T17143.5): Event report management function Part 6 (i.e. GB/T17143.6): Log control function Part 7 (i.e. GB/T17143.7): Security alarm reporting function Part 8 (i.e. GB/T17143.8): Security audit tracking function Appendices A and B of this standard are prompt appendices. This standard was proposed by the Ministry of Electronics Industry of the People's Republic of China. This standard is under the jurisdiction of the Standardization Institute of the Ministry of Electronics Industry. Drafting unit of this standard: Standardization Institute of the Ministry of Electronics Industry. The main drafters of this standard are Zheng Hongren, Zhou Xiaohua and Ren Guoxian. 553
GB/T 17143.6—1997
ISO/IEC Foreword
ISO (International Organization for Standardization) and IEC (International Electrotechnical Commission) are specialized organizations for standardization worldwide. National member bodies (all of which are members of ISO or IEC) participate in the formulation of international standards for specific technical scopes through various technical committees established by international organizations. The technical committees of ISO and IEC cooperate in areas of common interest. Other official and non-official international organizations in contact with ISO and IEC may also participate in the formulation of international standards. For information technology, ISO and IEC have established a joint technical committee, namely ISO/IECJTC1. The draft international standards proposed by the joint technical committee are circulated to national member bodies for voting. At least 75% of the national member bodies participating in the voting must vote in favor of publishing an international standard.
ISO/IEC10164-6 was developed by SC21 "Open systems interconnection, data management and open distributed processing" of the ISO/IECJTC1\Information technology" joint technical committee in cooperation with CCITT. The equivalent text is CCITTX.735. ISO/IEC10164, under the general title of "Information technology open systems interconnection system management", currently includes the following 15 parts: Part 1: Object management function
Part 2, State management function
-Part 3: Attributes representing relations
Part 4: Alarm reporting function
-Part 5: Incident report management function
-Part 6: Log control function
Part 7: Security alarm reporting function
|—Part 8 Security Audit Trail Function
Part 9: Objects and attributes of access control Part 10: Accounting and metering function
Part 11: Workload monitoring function
Part 12: Test management function
Part 13: Summarization function
—Part 14: Credibility and diagnostic test classification Part 15: Scheduling function
Appendix A and Appendix B are for reference only. 554
GB/T17143.6—-1997
GB/T17143 is a standard consisting of multiple parts formulated in accordance with GB9387 and GB/T9387.4. GB/T17143 is related to the following standards:
GB/T16644
GB/T 17142
GB/T 17175
GB/T 16645
Information technology
Information technology
Information technology
Information technology
Open systems interconnection
Open systems interconnection
Open systems interconnection
Open systems interconnection
Public management information service definition
Systems management overview
Management information structure
Public management information protocol
1 Scope
National Standard of the People's Republic of China
Information technology Open systems interconnection
Systems management
Part 6:Log control function
Information technology--Open Systems Interconnection-Systems Management--Part 6:Log control function GB/T 17143. 6—1997
idt IS0/IEC 10164-6:1993
This standard defines a system management function that provides for application processes to interact in a centralized or decentralized management environment for system management as defined in GB/T9387.4. This standard defines the log control function, which consists of a service and two functional units. This function belongs to the application layer of GB9387 and is defined according to the model provided by GB/T17176. The role of the system management function is described by GB/T17142.
This standard
Establish user requirements for the log control function: establish a model that links the services provided by this function to user requirements; define the services provided by this function, and
specify the protocols necessary to provide the services; - define the relationship between the service and SMI operations and notifications; - define the relationship with other system management functions and specify consistency requirements.
This standard
does not define the characteristics of any implementation intended to provide a log control function: it does not specify the manner in which management is accomplished by the user of the log control function; it does not define any characteristics of the interaction that results in the use of the log control function; it does not specify the services necessary to establish, normally release, and abnormally release management contacts, nor does it specify the authorization required to use the log control function or any related activities; it does not define managed objects related to the management of specific protocol machines. 2 Referenced standards
The provisions contained in the following standards constitute the provisions of this standard through reference in this standard. At the time of publication of this standard, the versions shown are valid. All standards are subject to revision, and parties using this standard should explore the possibility of using the latest versions of the following standards. GB9387-88 Basic reference model for open systems interconnection of information processing systems (idtISO7498:1984,eqvCCITTX.200:1988)
GB/T9387.4--1996 Basic reference model for open systems interconnection of information processing systems Part 4: Management framework (idtISO/IEC7498-4:1989,eqvCCITTX.700:1992)GB/T 15129-94
Service conventions for open systems interconnection of information processing systems (idtISO/TR8509:1987eqvCCITTX.210:1988)
Approved by the State Administration of Technical Supervision on December 15, 1997 556
Implemented on August 1, 1998
GB/T 17143.6—1997
GB/T16263-1996 Information technology Open Systems Interconnection Abstract Syntax Notation—(ASN.1) Basic Encoding Rules Specification (idt ISO/IEC 8825:1990,eqv CCITT X.209:1988) Information technology Open Systems Interconnection Common Management Information Service Definition (idt ISO/IEC9595: GB/T 16644—1996
1991,eqv CCITT X.710:1991)
GB/T17142-1997 Information technology Open Systems Interconnection System Management Overview (idt ISO/IEC10040:1992) GB/T 17143.1—1997
Information technology Open Systems Interconnection System Management Part 1: Object Management Functions (idt ISO/IEC Information technology Open Systems Interconnection
GB/T 17143. 2—1997
IEC 10164-2:1993)
System management Part 2: Status management functions (idtISO/GB/T 17143.4—1997
Information technology Open Systems Interconnection
System management Part 4: Alarm reporting functions (idtISO/IEC10164-4:1992)
GB/T 17143.5—1997
Information technology Open Systems Interconnection
System management Part 5: Event reporting management function (idtISO/IEC10164-5:1993)
GB/T 17175. 2--1997
Information technology Open Systems Interconnection Management information structure Part 2: Management information definition (idt ISO/IEC 10165-2:1992)
GB/T17176—1997 Information technology Open Systems Interconnection Application layer structure (idtISO/IEC9545:1994) GB/T17178.1-1997 Information technology Open Systems Interconnection Conformance test methods and framework Part 1: Basic concepts (ISO/IEC 9646-1:1994)
3 Definitions
This standard adopts the following definitions.
3.1 Basic reference model definition
This standard adopts the following terms defined in GB9387: system management.
3.2 Service agreement definitionwwW.bzxz.Net
This standard adopts the following terms defined in GB/T15129: primitive.
3.3 Management framework definition
This standard adopts the following terms defined in GB/T9387.4: a) management information,
b) managed object;
c) system management application entity.
3.4 System Management Overview Definitions
This standard adopts the following terms defined in GB/T17142: a) Agent role;
b) Dependency consistency;
c) General consistency,
d) Management application protocol,
e) Management support object,
f) Manager role,
g) Notification,
h) System management functional unit,
i) System management operation.
3.5 Event reporting management function definitions
GB/T 17143.61997
This standard adopts the following terms defined in GB/T17143.5: Identifier input object.
3.6 Common management information service definitions
This standard adopts the following terms defined in GB/T16644: Attribute.
3.7 OSI-Conformance Test Definitions
This standard adopts the following terms defined in GB/T 17178.1: System--Conformance Statement.
3.8 Supplementary Definitions
This standard adopts the following definitions.
3.8.1 Log
A management support object class modeled on a resource used as a log record archive. 3.8.2 Log record
A management support object class modeled on a unit of information stored in a log. 3.8.3 Potential log record A discriminator input object defined to discriminate the information contained in a log. A potential log record consists of all the information required to contain a log record in the log.
4 Abbreviations
5 Conventions
Abstract Syntax Notation
Common Management Information Service
Common Management Information Service Elements
Identifiers
Management Application Protocol Data Unit
Protocol Data Unit
System Management Application Entity
System Management Functional Unit
Management Information Structure
This standard uses some descriptive conventions of the OSI service conventions in GB/T 15129. 6 Requirements
For the needs of various management functions, it is necessary to be able to retain information about events that may have occurred or operations that may have been performed by or on various objects. In a practical open system, various resources can be addressed to store this information. In OSI management, these resources are modeled as logs and the log records contained in the logs. Management requires that the type of information to be logged can change at any time. In addition, when retrieving such information from the log, the administrator must be able to determine whether any records are missing from the log or the characteristics of the records stored in the log at any time. The following requirements must be met to present the above needs: a) the definition of a flexible log control service that allows the management system to select the records to be recorded in a particular log, b) the ability of external systems to modify the criteria used when logging records; c) the ability of external systems to determine whether log logging characteristics have been modified or whether log records are missing, 558
GB/T17143.6-—1997
d) the provision of a mechanism to control when log logging occurs (e.g. pausing and resuming log logging); e) the ability of external systems to retrieve and delete log records, f) the ability of external systems to create and delete logs. 7 Log Control Functional Model
7.1 Introduction
The Log Control Functional Model describes the conceptual components that provide for logging information in an open system. The model also describes the messages that control these components. Figure 1 is a graphical illustration of the system log logging capabilities. Managed Objects
Log Preprocessing
Potential Log Reports
Figure 1 Log Management Model
Event Reports
Conceptually, the log stores incoming event reports and local system notifications. However, the log can be used to store information derived from notifications in the local open system, incoming event reports, and PDUs received or sent by the open system. These three sources of information are modeled in two basic ways, so that conceptually, the log only processes event reports and local system notifications. The conceptual log preprocessing function receives notifications from managed objects within the local system scope and forms potential log records. Conceptually, these potential log records are distributed across all logs contained within the local open system. For identification purposes, the potential log records are only seen by the log as discriminator input objects and are not visible outside the surrounding system. PDUs to be logged (other than system management event reports) are modeled as local system notifications processed in the above manner. Therefore, the resources that generate these PDUs must be represented by a managed object. This makes the processing of PDUs exactly the same as the processing of local system notifications.
Note: The definition of which PDUs generate notifications and their associated parameters is the responsibility of a specific layer group in the defined managed objects representing the protocol entity. In particular, it can be observed that system management application PDUs should generate notifications that may be logged. In order to allow the logging of incoming PDUs, a subclass of the logging managed object class must be defined that can contain internal notifications and associated parameters.
On the other hand, system management event reports are not modeled as generating notifications, but are directly represented as being logged for processing. Incoming event reports are conceptually distributed among all logs within the receiving open system. In addition to conceptually storing log information, logs also determine which information is to be logged. Each log contains a discriminator construct that specifies the characteristics that a potential log record or received event report must have in order to be selected for logging. The information selected for logging is supplemented with additional information that is part of the logging process (e.g., record identifier and logging time). Each record has an identifier attribute value that is assigned when the record is created. These values are locally assigned in ascending order. Therefore, the identifier attribute can be used to determine the order in which records are created in the 559
log.
7.2 Log Model
GB/T 17143.6—1997
A log is an archive of records and an OSI abstraction of a log registry resource in an open real system. A record contains information that is logged. The log managed object class is characterized by a mandatory package and several conditional packages that provide the following capabilities for the log: Mandatory Log Package
This package has the following features:
Log Identifier, which uniquely identifies a log instance in relation to its parent managed object, Administrative State and Operational State, which represent the state of the log; Description of the type of information to be logged. This feature is supported by the Discriminator Construction attribute, a feature of the log when its maximum capacity is reached. This feature is supported by the Log Full Action attribute: a notification is generated when a log is created, deleted, paused, resumed, and modified. This feature is defined by GB/T17143.1 and GB/T17143.2 object creation, object deletion, state change and attribute value change notifications. A Limited Log Length Condition Package
This package has the following characteristics:
The maximum log length (which may be indeterminate). This feature is supported by the Maximum Log Length attribute, the current log length, which is supported by the Current Log Length attribute, and the current number of records in the log. It can be used together with the Current Log Length to obtain an estimate of the average record length and therefore the number of records that can still be logged. This feature is supported by the Number of Records attribute. A Scheduling Condition Package
The log control function provides a multi-level technique for scheduling log activities using several condition packages. The characteristics of these packages are as follows: - The time at which the log is registered as active. This feature is supported by the time-related attributes of the condition package containing information about the schedule. A Log Alert Condition Package
This package has the following characteristics:
A Capacity Alert Threshold defined as a percentage of the maximum log length. The Capacity Alert Threshold is used to generate events that will indicate that various degrees of log full conditions have been reached. This feature is supported by the Capacity Alert Threshold attribute. 8 Generic Definitions
This International Standard provides generic definitions of managed objects, attributes, and notifications related to log and logging managed objects. 8.1 Managed Objects
8.1.1 Log Managed Objects
8.1.1.1 Mandatory Log Package
The following mandatory attributes are defined for the Log class.
8.1.1.1.1 Log Identifier
This attribute is used to uniquely identify a log instance. 8.1.1.1.2 Discriminator Constructs
This attribute specifies tests for information to be logged. The discriminator construct may operate on any parameter of the information to be logged.
8.1.1.1.3 Administrative Status
This attribute indicates the administrative ability of the log to perform its function. The following administrative statuses are defined: a) Unlocked: The use of the log has been approved by the management system. Information from the belonging records can be retrieved, and depending on the values of other state and status attributes, new records can be created. b) Locked: The use of the log has been prohibited by the management system. Information from the belonging records can be retrieved, but new records cannot be created. Records can be deleted.
8.1.1.1.4 Operational status
GB/T 17143.6-1997
This attribute indicates the operational capability of the log to perform its function. The following operational states are defined: a) Allowed: The log is operational and ready for use. Information from the belonging records can be retrieved, and depending on the values of other state and status attributes, new records can be created.
b) Prohibited: The log is unavailable. New records cannot be created. 8.1.1.1.5 Log full action
This attribute specifies the action to be taken when the maximum length of the log is reached. The options are: a) Wrap: the oldest record in the log identified by the log record identifier shall be deleted to free up resources for the creation of new records; b) Stop: no further records shall be entered, and records already in the log shall be retained. Both options shall be supported by any log. 8.1.1.1.6 Availability Status
This attribute reflects the availability status of the managed object. The attribute may indicate a "log full" condition, indicating that records can be retrieved but new records cannot be added.
8.1.1.2 Limited Log Length Packet
This packet provides additional information about the current status of a limited length log. It shall appear whenever supported by the following resource. 8.1.1.2.1 Maximum Log Length
This attribute specifies the length of the log measured in octets. A log may have an indefinite length. A maximum log length of zero is used to indicate that there is no predetermined limit on the length of the log. NOTE: Since the log length is specified in octets, the actual amount of information contained in the log shall be determined by the data representation used in the log. This data representation does not need to be standardized. The maximum log length does not include the overhead of establishing the log. Therefore, immediately after creation, the current log length shall read zero. 8.1.1.2.2 Current Log Length
This attribute specifies the current length of the log measured in octets. 8.1.1.2.3 Number of Records
This attribute specifies the current number of records contained in the log. 8.1.1.3 Log Alert Packet
This packet provides for the transmission of alerts when a log-full condition is approaching. This packet shall be present whenever the log is of finite length and logging is stopped when a log-full availability condition occurs. This packet contains the following attributes: Capacity Alert Value
This attribute specifies the points, as a percentage of the maximum log length, at which an event shall be generated indicating that a log-full or log-wrap condition is approaching. This attribute is group-valued. This attribute shall be supported for the Stop feature. When a log is created with the wrap option, the capacity threshold event is triggered as if it were connected to a meter, which counts from zero to the defined maximum capacity threshold and then resets to zero. 8.1.1.4 Scheduling Package
The scheduling package provides logs with the ability to automatically switch between their "on" and "off" conditions. To accommodate various levels of complexity during the scheduling of log entry activities, scheduling-related condition packages are defined for log entry. 8.1.1.4.1 Availability Status Package
This condition package shall be present if any other scheduling-related package is instantiated. This package contains the following attributes Availability Status
This attribute reflects the availability status of the managed object. Its value shall be "off" when the resource becomes unavailable according to a predetermined schedule. This attribute is read-only. The value at creation time is determined by the specified scheduling parameters and the resource status. In this package, the value that needs to be set for this attribute is "off".
No state change notification is generated when the value of this attribute changes. NOTE: The log uses the availability status to indicate the log full condition. The presence of this condition package makes the "off duty" value available for the object. 8.1.1.4.2 Duration Package
GB/T 17143.6—1997
The duration package provides the ability to automatically control the time when a managed object starts and stops activity by using the start time and stop time attributes.
a) Start time
This attribute defines a date and time when a managed object is unlocked and allowed to start activity. If the start time attribute value is not specified in the create request, its default value is the creation time of the managed object, making it active immediately. Changes to the start time attribute result in the generation of an attribute change notification. b) Stoptime
This attribute defines a date and time when a managed object stops activity. If the stop time attribute value is not specified in the create request, its default value is "continuous operation". For the stop time, a null value is used to indicate continuous operation. Changes to the stop time attribute result in the generation of an attribute change notification. 8.1.1.4.3 Day Schedule Package
The Day Schedule Condition Package provides the ability to schedule log entries on a 24h cycle. The schedule attributes and their associated default values are defined as follows:Intervals of day
This attribute defines a table of time intervals (times of day when intervals start and intervals end) at which the log should exhibit the "log entry on" condition. Outside these time intervals, the log exhibits the "log entry off" condition. If not specified in the creation request, the default value for this component value is a single interval covering the entire 24h period of a day.
8.1.1.4.4 Week Schedule Package
The Week Schedule Condition Package provides the ability to schedule log entries on a weekly cycle. The schedule attributes and their associated default values are defined as follows:Week mask
This structured attribute defines a set of mask components, corresponding to selected days of the week, each of which specifies a set of time intervals on a 24h clock. The Week Mask attribute defaults to the "always on" scheduling criteria at log creation time. The components of each screen are defined as follows: a) Days of week
This component defines the days of the week on which the log's scheduling mechanism should allow the log to have intervals where log entries can occur. If this component is not present at creation time, it defaults to all seven days of the week. b) Intervals of day This component defines a table of time intervals (times of day when the interval starts and the interval ends) at which the log should exhibit a "log entry on" condition if the current day is selected to fall within the DaysOfWeek range. Outside of these time intervals, the log exhibits a "log entry off" condition. If not specified in the creation request, this component defaults to a single interval covering the full 24h period of a day. 8.1.1.4.5 External Scheduler Scheduling Package
The External Scheduler Scheduling Condition Package provides the ability to schedule log entries based on a schedule defined in an External Scheduler Managed Object. The "log entry on" and "log entry off" conditions of a log shall change according to the scheduling characteristics specified by the Scheduler Managed Object. The Schedule attribute is defined as follows:
Schedulername
This attribute specifies the name of the Scheduler Managed Object associated with the log. This relationship implies that the "log entry on" and "log entry off" conditions of the log shall be scheduled by the External Scheduler. This attribute is read-only. 8.1.1.5 Normal Operation of the Log
The performance of a log is determined by its state attributes, availability status, discriminator constructs, limited log length packets, availability status packets, log alert packets, and scheduling packets (if any).
The performance of a particular instance of a log is affected by the conditional packages that are instantiated when it is created. Described below is the way in which the log operates when various conditional packages are instantiated.
Whether a particular record is logged depends on the following log characteristics:562
- Operational state;
Availability status;
- Administrative state;
Scheduling package (if any);
Discriminator construction.
GB/T17143.6-—1997
New log records are created only when: the discriminator input object meets the conditions specified in the log's discriminator construction, the log's administrative state is unlocked, the operational state is not prohibited, and the availability status is neither log full (for a log to be stopped) nor off duty. The off duty availability status is supported by the log only when a scheduling package and the associated availability status package are instantiated. The administrative state of the log affects the creation of new records. When the log is in the "locked" state, the log shall not create new records, however, records already contained in the log are available for retrieval. When a log is in the "unlocked" state, new records can be created unless the log is in the "disabled" operational state. As log records are contained in the log, the log's operational state affects the operations that can be performed on them. When the log's operational state is disabled, records cannot be retrieved. In addition, if the log has an off-duty availability state when it is instantiated with a conditional dispatch package, the log shall not create any new records.
The operational state and availability state of a log cannot be changed by direct administrative actions, but reflect the internal activity of the log and its dispatch packages (if any).
For log performance, when the maximum log length has been reached (called the log full availability condition), two options are defined: the log can stop logging, or wrap around. A log that stops after reaching a log full condition always generates a capacity notification indicating that this condition has been reached, and thus shall include a log warning package. Such log performance corresponds to a log that discards the most recent information and prefers older information.
A log that wraps after reaching a log full condition shall discard an integer number of records in favor of logging new records when this condition is reached. Logs with this log property should discard old information in favor of new information. 8.1.1.6 Management of logs
In general, all non-state attribute values can be modified, although restrictions may apply. For example, the value of the maximum log length attribute cannot be modified to be less than the value of the current log length attribute. In addition, attempts to increase or decrease the maximum log length attribute value after creation may fail in some systems. Log identifier attribute values are not settable. Values such as availability status, operational status, current log length, and number of records reflect the operation of the log and cannot be modified directly by administrators.
Whenever a settable non-state attribute is modified, an attribute change notification may be generated. All log attributes, except the number of records and current log length attributes, should generate such notifications. Changes to the latter attributes are not associated with notifications because they are expected to change frequently in response to normal operation of the log.
The administrative state of a log can be changed using a set of operations. Whenever the administrative state of a log changes, a state change notification is generated. A change in operational state should generate a state change notification. 8.1.2 Log Records
A log record is a managed object that represents information stored in a log. The Log Record managed object class serves as a superclass for other record classes. As part of the specialization of the Log Record class, additional attributes may be assigned to new subclasses. The Log Record class has the following properties:
Log record identifier;
—log entry time.
8.1.2.1 Logging Performance
Log records are created as a result of receiving an event report or notification; they are not created by explicit management operations. Log records can only be retrieved and deleted; log record attributes cannot be modified. The operations that can be performed on a log record depend on the state of the log containing the record and may also be subject to security restrictions. 563
8.1.2.2 Log Record Attributes
The following mandatory attributes are defined for the log record class:8.1.2.2.1 Log Record Identifier
GB/T 17143.6—1997
This attribute uniquely identifies each record in the log. The log record identifier is a number that is unique within the scope of the log and is assigned sequentially. The number of identifiers used can wrap around, but at any time, there cannot be more than one record in the log with the same identifier. The log record identifier has an integer syntax. 8.1.2.2.2 Log Registration Time
This attribute marks the time when a record was entered into the log. In the absence of time synchronization, this time may be greater than or less than the source time (if specified).
8.2 Generic definitions introduced
This standard uses the following generic definitions from GB/T17143.1, GB/T17143.2 and GB/T17143.4: - attribute value change notification,
state change notification,
processing error warning notification;
— object creation notification,
— object deletion notification.
Attribute value change notification and state change notification are used to report changes in non-state attribute values and log states, respectively. The log also generates events indicating that capacity thresholds have been reached or exceeded. For logs configured to stop when a log full condition is reached, an event indicating that the condition has occurred (i.e., 100% of the current log length has been reached) should always be generated. For logs configured to stop, an event indicating a log full condition should be generated at the latest when the first new record is discarded due to lack of storage capacity. If it is known that there are not enough resources to create additional records, the event may also be generated before this. For logs configured to wrap, all capacity threshold alarms are optional.
When reporting capacity threshold events, use the alarm report defined in GB/T17143.4. When used to report log capacity threshold alarms, only the following alarm report parameters may be used, and all parameters are mandatory. Managed Object Class
Managed Object Instance
Alarm Type
Event Time
This parameter shall identify the log class.
This parameter shall identify the log instance that generated the event. This parameter shall indicate that a processing error alarm has occurred. This parameter carries the time at which the capacity threshold event occurred. Perceived Severity
This parameter shall indicate the severity assigned to the capacity threshold event. When the 100% log full condition is reached, this event shall be assigned a critical severity value.
Monitored Attributes
Possible Causes
Threshold Information
9 Service Definition
This parameter shall carry the maximum log length attribute for the log. This parameter shall carry the storage capacity problem value. This parameter shall carry the capacity threshold (as a percentage of total capacity) that was reached or exceeded when this event was generated.
This specification does not define any services. The services defined in other functions are described below. 9.1 Introduction
The information and management control requirements required between systems may change over time and as the management or communication environment changes. It is therefore necessary to provide a mechanism for implementing OSI management services.
It is believed that managers should have the ability to modify the operation of logs in remote systems. In particular, the required operations that can be applied to each instance of a log are:
Create a log,5 Normal Operation of the Log
The performance of a log is determined by its state attributes, availability status, discriminator constructs, limited log length packets, availability status packets, log alert packets, and dispatch packets (if any).
The performance of a particular instance of a log is affected by the conditional packets that are instantiated when it is created. Described below is the way in which the log operates when various conditional packets are instantiated.
Whether a particular record is logged depends on the following log characteristics:562
--operational state;
availability status;
--administrative state;
dispatching packets (if any);
discriminator constructs.
GB/T17143.6-—1997
New log records are created only when the discriminator input object satisfies the conditions specified in the log's discriminator construction, the log's administrative state is unlocked, the operational state is not prohibited, and the availability status is neither log full (for a log to be stopped) nor off-duty. The off-duty availability status is supported by the log only when a scheduling package and associated availability status package are instantiated. The administrative state of the log affects the creation of new records. When the log is in the "locked" state, the log shall not create new records, however, records already contained in the log are available for retrieval. When the log is in the "unlocked" state, new records can be created unless the log is in the "prohibited" operational state. Since log records are contained in the log, the operational state of the log affects the operations that can be performed on the log records. When the log operational state is prohibited, records cannot be retrieved. In addition, if the log is instantiated with a conditional scheduling package, the log shall not create any new records if the log has the off-duty availability status.
The operational state and availability status of a log cannot be changed by direct management actions, but reflect the internal activity of the log and its scheduled packets (if any).
For log behavior, when the maximum log length has been reached (called the log-full availability condition), two options are defined: the log can stop logging, or it can wrap around. A log that stops after reaching a log-full condition always generates a capacity notification indicating that the condition has been reached, and thus should include a log-alert packet. Logs that behave this way should discard the most recent information in favor of older information.
A log that wraps after reaching a log-full condition should discard an integer number of records in favor of new records when the condition is reached. Logs that behave this way should discard old information in favor of new information. 8.1.1.6 Management of Logs
In general, all non-state attribute values can be modified, although restrictions may apply. For example, the value of the maximum log length attribute cannot be modified to be less than the value of the current log length attribute. In addition, attempts to increase or decrease the maximum log length attribute value after creation may fail on some systems. The value of the log identifier attribute is not settable. Values such as availability status, operational status, current log length and number of records reflect the operation of the log and cannot be modified directly by an administrator.
Whenever a settable non-state attribute is modified, an attribute change notification may be generated. All log attributes, except the number of records and current log length attributes, shall generate such notifications. Changes to the latter attributes are not associated with notifications, as they are expected to change frequently in response to normal operation of the log.
The administrative state of a log may be changed using a set of operations. Whenever the administrative state of a log changes, a state change notification is generated. A change in operational status shall generate a state change notification. 8.1.2 Log Records
A log record is a managed object that represents information stored in a log. The Log Record managed object class serves as a superclass for other record classes. As part of specialization of the Log Record class, additional attributes may be assigned to new subclasses. The Log Record class has the following properties:
The log record identifier;
—The time at which the log was entered.
8.1.2.1 Log Record Performance
Log records are created as a result of receiving an event report or notification; they are not created by explicit administrative actions. Log records can only be retrieved and deleted; log record attributes cannot be modified. The operations that can be performed on a log record depend on the state of the log containing the record and may also be subject to security restrictions. 563
8.1.2.2 Log Record Attributes
The following mandatory attributes are defined for the Log Record class:8.1.2.2.1 Log Record Identifier
GB/T 17143.6—1997
This attribute uniquely identifies each record in the log. The log record identifier is a number that is unique within the scope of the log and is assigned sequentially. The number of identifiers used can wrap around, but at any time, there cannot be more than one record in the log with the same identifier. The log record identifier has the syntax of an integer. 8.1.2.2.2 Log entry time
This attribute identifies the time at which a record was entered into the log. In the absence of time synchronization, this time may be greater than or less than the source time (if specified).
8.2 Generic definitions introduced
This standard uses the following generic definitions from GB/T 17143.1, GB/T 17143.2 and GB/T 17143.4: - Attribute value change notification,
State change notification,
Processing error alarm notification;
—Object creation notification,
—Object deletion notification.
Attribute value change notification and state change notification are used to report changes in non-state attribute values and log status, respectively. The log also generates events indicating that capacity thresholds have been reached or exceeded. For logs configured to stop when a log full condition is reached, an event shall always be generated indicating that this condition has occurred (i.e., 100% of the current log length has been reached). For logs configured to stop, an event indicating a log full condition shall be generated at the latest when the first new record is discarded due to lack of storage capacity. An event may also be generated before this if it is known that there are insufficient resources to create additional records. For logs configured to wrap, all capacity threshold alarms are optional.
When reporting capacity threshold events, the alarm reporting defined in ISO 9001-1:2005 shall be used. When used to report log capacity threshold alarms, only the following alarm reporting parameters shall be used, and all parameters are mandatory. Managed Object Class
Managed Object Instance
Alarm Type
Event Time
This parameter shall identify the log class.
This parameter shall identify the log instance that generated the event. This parameter shall indicate that a processing error alarm has occurred. This parameter shall carry the time at which the capacity threshold event occurred. Perceived Severity
This parameter shall indicate the severity assigned to the capacity threshold event. When the 100% log full condition is reached, a critical severity value shall be assigned to this event.
Monitored Attributes
Possible Causes
Threshold Information
9 Service Definition
This parameter shall carry the maximum log length attribute of the log. This parameter shall carry the storage capacity problem value. This parameter shall carry the capacity threshold (as a percentage of total capacity) that was reached or exceeded when this event was generated.
This specification does not define any services. The services defined in other functions are described below. 9.1 Introduction
The information and management control requirements required between systems may change over time and as the management or communication environment changes. It is therefore necessary to provide a mechanism for implementing OSI management services.
It is considered that managers should have the ability to modify the operation of logs in remote systems. In particular, the required operations that can be applied to each instance of a log are:
Create a log,5 Normal Operation of the Log
The performance of a log is determined by its state attributes, availability status, discriminator constructs, limited log length packets, availability status packets, log alert packets, and dispatch packets (if any).
The performance of a particular instance of a log is affected by the conditional packets that are instantiated when it is created. Described below is the way in which the log operates when various conditional packets are instantiated.
Whether a particular record is logged depends on the following log characteristics:562
--operational state;
availability status;
--administrative state;
dispatching packets (if any);
discriminator constructs.
GB/T17143.6-—1997
New log records are created only when the discriminator input object satisfies the conditions specified in the log's discriminator construction, the log's administrative state is unlocked, the operational state is not prohibited, and the availability status is neither log full (for a log to be stopped) nor off-duty. The off-duty availability status is supported by the log only when a scheduling package and associated availability status package are instantiated. The administrative state of the log affects the creation of new records. When the log is in the "locked" state, the log shall not create new records, however, records already contained in the log are available for retrieval. When the log is in the "unlocked" state, new records can be created unless the log is in the "prohibited" operational state. Since log records are contained in the log, the operational state of the log affects the operations that can be performed on the log records. When the log operational state is prohibited, records cannot be retrieved. In addition, if the log is instantiated with a conditional scheduling package, the log shall not create any new records if the log has the off-duty availability status.
The operational state and availability status of a log cannot be changed by direct management actions, but reflect the internal activity of the log and its scheduled packets (if any).
For log behavior, when the maximum log length has been reached (called the log-full availability condition), two options are defined: the log can stop logging, or it can wrap around. A log that stops after reaching a log-full condition always generates a capacity notification indicating that the condition has been reached, and thus should include a log-alert packet. Logs that behave this way should discard the most recent information in favor of older information.
A log that wraps after reaching a log-full condition should discard an integer number of records in favor of new records when the condition is reached. Logs that behave this way should discard old information in favor of new information. 8.1.1.6 Management of Logs
In general, all non-state attribute values can be modified, although restrictions may apply. For example, the value of the maximum log length attribute cannot be modified to be less than the value of the current log length attribute. In addition, attempts to increase or decrease the maximum log length attribute value after creation may fail on some systems. The value of the log identifier attribute is not settable. Values such as availability status, operational status, current log length and number of records reflect the operation of the log and cannot be modified directly by an administrator.
Whenever a settable non-state attribute is modified, an attribute change notification may be generated. All log attributes, except the number of records and current log length attributes, shall generate such notifications. Changes to the latter attributes are not associated with notifications, as they are expected to change frequently in response to normal operation of the log.
The administrative state of a log may be changed using a set of operations. Whenever the administrative state of a log changes, a state change notification is generated. A change in operational status shall generate a state change notification. 8.1.2 Log Records
A log record is a managed object that represents information stored in a log. The Log Record managed object class serves as a superclass for other record classes. As part of specialization of the Log Record class, additional attributes may be assigned to new subclasses. The Log Record class has the following properties:
The log record identifier;
—The time at which the log was entered.
8.1.2.1 Log Record Performance
Log records are created as a result of receiving an event report or notification; they are not created by explicit administrative actions. Log records can only be retrieved and deleted; log record attributes cannot be modified. The operations that can be performed on a log record depend on the state of the log containing the record and may also be subject to security restrictions. 563
8.1.2.2 Log Record Attributes
The following mandatory attributes are defined for the Log Record class:8.1.2.2.1 Log Record Identifier
GB/T 17143.6—1997
This attribute uniquely identifies each record in the log. The log record identifier is a number that is unique within the scope of the log and is assigned sequentially. The number of identifiers used can wrap around, but at any time, there cannot be more than one record in the log with the same identifier. The log record identifier has the syntax of an integer. 8.1.2.2.2 Log entry time
This attribute identifies the time at which a record was entered into the log. In the absence of time synchronization, this time may be greater than or less than the source time (if specified).
8.2 Generic definitions introduced
This standard uses the following generic definitions from GB/T 17143.1, GB/T 17143.2 and GB/T 17143.4: - Attribute value change notification,
State change notification,
Processing error alarm notification;
—Object creation notification,
—Object deletion notification.
Attribute value change notification and state change notification are used to report changes in non-state attribute values and log status, respectively. The log also generates events indicating that capacity thresholds have been reached or exceeded. For logs configured to stop when a log full condition is reached, an event shall always be generated indicating that this condition has occurred (i.e., 100% of the current log length has been reached). For logs configured to stop, an event indicating a log full condition shall be generated at the latest when the first new record is discarded due to lack of storage capacity. An event may also be generated before this if it is known that there are insufficient resources to create additional records. For logs configured to wrap, all capacity threshold alarms are optional.
When reporting capacity threshold events, the alarm reporting defined in ISO 9001-1:2005 shall be used. When used to report log capacity threshold alarms, only the following alarm reporting parameters shall be used, and all parameters are mandatory. Managed Object Class
Managed Object Instance
Alarm Type
Event Time
This parameter shall identify the log class.
This parameter shall identify the log instance that generated the event. This parameter shall indicate that a processing error alarm has occurred. This parameter shall carry the time at which the capacity threshold event occurred. Perceived Severity
This parameter shall indicate the severity assigned to the capacity threshold event. When the 100% log full condition is reached, a critical severity value shall be assigned to this event.
Monitored Attributes
Possible Causes
Threshold Information
9 Service Definition
This parameter shall carry the maximum log length attribute of the log. This parameter shall carry the storage capacity problem value. This parameter shall carry the capacity threshold (as a percentage of total capacity) that was reached or exceeded when this event was generated.
This specification does not define any services. The services defined in other functions are described below. 9.1 Introduction
The information and management control requirements required between systems may change over time and as the management or communication environment changes. It is therefore necessary to provide a mechanism for implementing OSI management services.
It is considered that managers should have the ability to modify the operation of logs in remote systems. In particular, the required operations that can be applied to each instance of a log are:
Create a log,6-—1997
New log records are created only if the discriminator input object satisfies the conditions specified in the log's discriminator construction, the log's administrative state is unlocked, the operational state is not prohibited, and the availability state is neither logfull (for a log to be stopped) nor out of duty. The out of duty availability state is supported by the log only when a schedule package and associated availability state package are instantiated. The administrative state of the log affects the creation of new records. When the log is in the "locked" state, the log shall not create new records, however, records already contained in the log are available for retrieval. When the log is in the "unlocked" state, new records can be created unless the log is in the "prohibited" operational state. Since log records are contained in the log, the operational state of the log affects the operations that can be performed on the log records. When the log operational state is prohibited, records cannot be retrieved. In addition, if the log is instantiated with a conditional schedule package, the log shall not create any new records if the log has an out of duty availability state.
The operational state and availability status of a log cannot be changed by direct management actions, but reflect the internal activity of the log and its scheduled packets (if any).
For log behavior, when the maximum log length has been reached (called the log-full availability condition), two options are defined: the log can stop logging, or it can wrap around. A log that stops after reaching a log-full condition always generates a capacity notification indicating that the condition has been reached, and thus should include a log-alert packet. Logs that behave this way should discard the most recent information in favor of older information.
A log that wraps after reaching a log-full condition should discard an integer number of records in favor of new records when the condition is reached. Logs that behave this way should discard old information in favor of new information. 8.1.1.6 Management of Logs
In general, all non-state attribute values can be modified, although restrictions may apply. For example, the value of the maximum log length attribute cannot be modified to be less than the value of the current log length attribute. In addition, attempts to increase or decrease the maximum log length attribute value after creation may fail on some systems. The value of the log identifier attribute is not settable. Values such as availability status, operational status, current log length and number of records reflect the operation of the log and cannot be modified directly by an administrator.
Whenever a settable non-state attribute is modified, an attribute change notification may be generated. All log attributes, except the number of records and current log length attributes, shall generate such notifications. Changes to the latter attributes are not associated with notifications, as they are expected to change frequently in response to normal operation of the log.
The administrative state of a log may be changed using a set of operations. Whenever the administrative state of a log changes, a state change notification is generated. A change in operational status shall generate a state change notification. 8.1.2 Log Records
A log record is a managed object that represents information stored in a log. The Log Record managed object class serves as a superclass for other record classes. As part of specialization of the Log Record class, additional attributes may be assigned to new subclasses. The Log Record class has the following properties:
The log record identifier;
—The time at which the log was entered.
8.1.2.1 Log Record Performance
Log records are created as a result of receiving an event report or notification; they are not created by explicit administrative actions. Log records can only be retrieved and deleted; log record attributes cannot be modified. The operations that can be performed on a log record depend on the state of the log containing the record and may also be subject to security restrictions. 563
8.1.2.2 Log Record Attributes
The following mandatory attributes are defined for the Log Record class:8.1.2.2.1 Log Record Identifier
GB/T 17143.6—1997
This attribute uniquely identifies each record in the log. The log record identifier is a number that is unique within the scope of the log and is assigned sequentially. The number of identifiers used can wrap around, but at any time, there cannot be more than one record in the log with the same identifier. The log record identifier has the syntax of an integer. 8.1.2.2.2 Log entry time
This attribute identifies the time at which a record was entered into the log. In the absence of time synchronization, this time may be greater than or less than the source time (if specified).
8.2 Generic definitions introduced
This standard uses the following generic definitions from GB/T 17143.1, GB/T 17143.2 and GB/T 17143.4: - Attribute value change notification,
State change notification,
Processing error alarm notification;
—Object creation notification,
—Object deletion notification.
Attribute value change notification and state change notification are used to report changes in non-state attribute values and log status, respectively. The log also generates events indicating that capacity thresholds have been reached or exceeded. For logs configured to stop when a log full condition is reached, an event shall always be generated indicating that this condition has occurred (i.e., 100% of the current log length has been reached). For logs configured to stop, an event indicating a log full condition shall be generated at the latest when the first new record is discarded due to lack of storage capacity. An event may also be generated before this if it is known that there are insufficient resources to create additional records. For logs configured to wrap, all capacity threshold alarms are optional.
When reporting capacity threshold events, the alarm reporting defined in ISO 9001-1:2005 shall be used. When used to report log capacity threshold alarms, only the following alarm reporting parameters shall be used, and all parameters are mandatory. Managed Object Class
Managed Object Instance
Alarm Type
Event Time
This parameter shall identify the log class.
This parameter shall identify the log instance that generated the event. This parameter shall indicate that a processing error alarm has occurred. This parameter shall carry the time at which the capacity threshold event occurred. Perceived Severity
This parameter shall indicate the severity assigned to the capacity threshold event. When the 100% log full condition is reached, a critical severity value shall be assigned to this event.
Monitored Attributes
Possible Causes
Threshold Information
9 Service Definition
This parameter shall carry the maximum log length attribute of the log. This parameter shall carry the storage capacity problem value. This parameter shall carry the capacity threshold (as a percentage of total capacity) that was reached or exceeded when this event was generated.
This specification does not define any services. The services defined in other functions are described below. 9.1 Introduction
The information and management control requirements required between systems may change over time and as the management or communication environment changes. It is therefore necessary to provide a mechanism for implementing OSI management services.
It is considered that managers should have the ability to modify the operation of logs in remote systems. In particular, the required operations that can be applied to each instance of a log are:
Create a log,6-—1997
New log records are created only if the discriminator input object satisfies the conditions specified in the log's discriminator construction, the log's administrative state is unlocked, the operational state is not prohibited, and the availability state is neither logfull (for a log to be stopped) nor out of duty. The out of duty availability state is supported by the log only when a schedule package and associated availability state package are instantiated. The administrative state of the log affects the creation of new records. When the log is in the "locked" state, the log shall not create new records, however, records already contained in the log are available for retrieval. When the log is in the "unlocked" state, new records can be created unless the log is in the "prohibited" operational state. Since log records are contained in the log, the operational state of the log affects the operations that can be performed on the log records. When the log operational state is prohibited, records cannot be retrieved. In addition, if the log is instantiated with a conditional schedule package, the log shall not create any new records if the log has an out of duty availability state.
The operational state and availability status of a log cannot be changed by direct management actions, but reflect the internal activity of the log and its scheduled packets (if any).
For log behavior, when the maximum log length has been reached (called the log-full availability condition), two options are defined: the log can stop logging, or it can wrap around. A log that stops after reaching a log-full condition always generates a capacity notification indicating that the condition has been reached, and thus should include a log-alert packet. Logs that behave this way should discard the most recent information in favor of older information.
A log that wraps after reaching a log-full condition should discard an integer number of records in favor of new records when the condition is reached. Logs that behave this way should discard old information in favor of new information. 8.1.1.6 Management of Logs
In general, all non-state attribute values can be modified, although restrictions may apply. For example, the value of the maximum log length attribute cannot be modified to be less than the value of the current log length attribute. In addition, attempts to increase or decrease the maximum log length attribute value after creation may fail on some systems. The value of the log identifier attribute is not settable. Values such as availability status, operational status, current log length and number of records reflect the operation of the log and cannot be modified directly by an administrator.
Whenever a settable non-state attribute is modified, an attribute change notification may be generated. All log attributes, except the number of records and current log length attributes, shall generate such notifications. Changes to the latter attributes are not associated with notifications, as they are expected to change frequently in response to normal operation of the log.
The administrative state of a log may be changed using a set of operations. Whenever the administrative state of a log changes, a state change notification is generated. A change in operational status shall generate a state change notification. 8.1.2 Log Records
A log record is a managed object that represents information stored in a log. The Log Record managed object class serves as a superclass for other record classes. As part of specialization of the Log Record class, additional attributes may be assigned to new subclasses. The Log Record class has the following properties:
The log record identifier;
—The time at which the log was entered.
8.1.2.1 Log Record Performance
Log records are created as a result of receiving an event report or notification; they are not created by explicit administrative actions. Log records can only be retrieved and deleted; log record attributes cannot be modified. The operations that can be performed on a log record depend on the state of the log containing the record and may also be subject to security restrictions. 563
8.1.2.2 Log Record Attributes
T
Tip: This standard content only shows part of the intercepted content of the complete standard. If you need the complete standard, please go to the top to download the complete standard document for free.