You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
ServiceNow event additional_info: Raw vs MIB-translated
This document shows additional_info from selected events in test_events_servicenow.xml, with OIDs translated to MIB names from ADVA-FSP3000ALM-MIB.txt. All events use the ALM subtree (2544.1.14 = fsp3000alm).
OID → MIB name mapping (used in translations)
| Raw OID suffix (2544.1.14.*) |
MIB name (fsp3000alm subtree) |
| .0.X |
**trap.**trapName (e.g. trap.alarmLinkBudgetExceeded for X=14) |
| .1.1.1.3.1.X |
alarm.alarmTable.alarmEntry.alarmSeverity.1.X (alarm type X) |
| .1.2.1.3.1.X |
alarm.alarmSeverityTable.alarmSeverityEntry.alarmSeverityValue.1.X |
| .1.4.1.2.X |
alarm.alarmDescriptionTable.alarmDescriptionEntry.alarmDescriptionName.X |
| .2.2.1.4.1 |
device.portTable.portEntry.portName.1 |
| .2.2.1.5.1 |
device.portTable.portEntry.portAidString.1 |
| .3.11.1.4.1.1 |
measurement.measurementAutoFaTable.measurementAutoFaEntry.measurementAutoFaFaultPos.1.1 |
| .4.2.1.2.X |
eventLogs.eventLogTable.eventLogEntry.eventLogTimeStamp.X |
| .4.2.1.4.X |
eventLogs.eventLogTable.eventLogEntry.eventLogIdentityTranslation.X |
| .5.8.1 |
system.advaSecurity.authTrapUserName |
| .5.8.2 |
system.advaSecurity.authTrapLctIp |
| .5.8.3 |
system.advaSecurity.authTrapStatus |
| .5.8.4 |
system.advaSecurity.authTrapSessionId |
| .5.8.5 |
system.advaSecurity.authTrapProtocol |
| sysUpTime |
sysUpTime (standard) |
| int_ev_type |
int_ev_type (probe/internal) |
| snmpTrapOID |
snmpTrapOID (trap PDU OID) |
Trap numbers (.0.X) map to names per ALM MIB, e.g. 9=alarmFaRunning, 14=alarmLinkBudgetExceeded, 41=transientFaStarted, 42=transientFaCompleted, 44=transientFaSaved, 62=authenticationNotification.
Event 1 — authenticationNotification (trap 62)
| Raw (additional_info keys) |
Translated (MIB names) |
| iso...2544.1.14.5.8.1 = "admin" |
system.advaSecurity.authTrapUserName = "admin" |
| iso...2544.1.14.4.2.1.4.194 = "SHMON-1" |
eventLogs.eventLogTable.eventLogEntry.eventLogIdentityTranslation.194 = "SHMON-1" |
| sysUpTime = "472 days, 20:30:46.82" |
sysUpTime = "472 days, 20:30:46.82" |
| iso...2544.1.14.5.8.4 = "web/0" |
system.advaSecurity.authTrapSessionId = "web/0" |
| iso...2544.1.14.5.8.5 = "8" |
system.advaSecurity.authTrapProtocol = "8" |
| iso...2544.1.14.5.8.2 = "10.24.11.251" |
system.advaSecurity.authTrapLctIp = "10.24.11.251" |
| iso...2544.1.14.5.8.3 = "5" |
system.advaSecurity.authTrapStatus = "5" |
| iso...2544.1.14.4.2.1.2.194 = "2026-02-23 10:57:03" |
eventLogs.eventLogTable.eventLogEntry.eventLogTimeStamp.194 = "2026-02-23 10:57:03" |
| int_ev_type = "SNMP" |
int_ev_type = "SNMP" |
| iso...2544.1.14.1.4.1.2.62 = "authenticationNotification" |
alarm.alarmDescriptionTable.alarmDescriptionEntry.alarmDescriptionName.62 = "authenticationNotification" |
| snmpTrapOID = "iso...2544.1.14.0.62" |
snmpTrapOID = fsp3000alm.trap.authenticationNotification |
Event 2 — transientFaCompleted (trap 42)
| Raw |
Translated |
| sysUpTime = "472 days, 20:08:12.36" |
sysUpTime = "472 days, 20:08:12.36" |
| iso...2544.1.14.2.2.1.4.1 = " Duct 1-miniduct 2 Grijs" |
device.portTable.portEntry.portName.1 = " Duct 1-miniduct 2 Grijs" |
| int_ev_type = "SNMP" |
int_ev_type = "SNMP" |
| iso...2544.1.14.4.2.1.2.192 = "2026-02-23 10:34:29" |
eventLogs.eventLogTable.eventLogEntry.eventLogTimeStamp.192 = "2026-02-23 10:34:29" |
| iso...2544.1.14.4.2.1.4.192 = "MCH-1-1" |
eventLogs.eventLogTable.eventLogEntry.eventLogIdentityTranslation.192 = "MCH-1-1" |
| snmpTrapOID = "iso...2544.1.14.0.42" |
snmpTrapOID = fsp3000alm.trap.transientFaCompleted |
| iso...2544.1.14.2.2.1.5.1 = "MCH-1-1" |
device.portTable.portEntry.portAidString.1 = "MCH-1-1" |
| iso...2544.1.14.1.4.1.2.42 = "transientFaCompleted" |
alarm.alarmDescriptionTable.alarmDescriptionEntry.alarmDescriptionName.42 = "transientFaCompleted" |
Event 3 — alarmFaRunning (trap 9) with severity
| Raw |
Translated |
| sysUpTime = "472 days, 20:08:12.34" |
sysUpTime = "472 days, 20:08:12.34" |
| iso...2544.1.14.2.2.1.4.1 = " Duct 1-miniduct 2 Grijs" |
device.portTable.portEntry.portName.1 = " Duct 1-miniduct 2 Grijs" |
| int_ev_type = "SNMP" |
int_ev_type = "SNMP" |
| iso...2544.1.14.1.1.1.3.1.9 = "6" |
alarm.alarmTable.alarmEntry.alarmSeverity.1.9 = "6" |
| iso...2544.1.14.1.4.1.2.9 = "alarmFaRunning" |
alarm.alarmDescriptionTable.alarmDescriptionEntry.alarmDescriptionName.9 = "alarmFaRunning" |
| iso...2544.1.14.1.2.1.3.1.9 = "5" |
alarm.alarmSeverityTable.alarmSeverityEntry.alarmSeverityValue.1.9 = "5" |
| iso...2544.1.14.4.2.1.2.191 = "2026-02-23 10:34:29" |
eventLogs.eventLogTable.eventLogEntry.eventLogTimeStamp.191 = "2026-02-23 10:34:29" |
| snmpTrapOID = "iso...2544.1.14.0.9" |
snmpTrapOID = fsp3000alm.trap.alarmFaRunning |
| iso...2544.1.14.2.2.1.5.1 = "MCH-1-1" |
device.portTable.portEntry.portAidString.1 = "MCH-1-1" |
| iso...2544.1.14.4.2.1.4.191 = "MCH-1-1" |
eventLogs.eventLogTable.eventLogEntry.eventLogIdentityTranslation.191 = "MCH-1-1" |
Event 4 — transientFaSaved (trap 44) with measurement varbind
| Raw |
Translated |
| sysUpTime = "472 days, 20:08:12.38" |
sysUpTime = "472 days, 20:08:12.38" |
| iso...2544.1.14.3.11.1.4.1.1 = "0" |
measurement.measurementAutoFaTable.measurementAutoFaEntry.measurementAutoFaFaultPos.1.1 = "0" |
| iso...2544.1.14.2.2.1.4.1 = " Duct 1-miniduct 2 Grijs" |
device.portTable.portEntry.portName.1 = " Duct 1-miniduct 2 Grijs" |
| int_ev_type = "SNMP" |
int_ev_type = "SNMP" |
| iso...2544.1.14.4.2.1.2.193 = "2026-02-23 10:34:29" |
eventLogs.eventLogTable.eventLogEntry.eventLogTimeStamp.193 = "2026-02-23 10:34:29" |
| iso...2544.1.14.1.4.1.2.44 = "transientFaSaved" |
alarm.alarmDescriptionTable.alarmDescriptionEntry.alarmDescriptionName.44 = "transientFaSaved" |
| iso...2544.1.14.4.2.1.4.193 = "MCH-1-1" |
eventLogs.eventLogTable.eventLogEntry.eventLogIdentityTranslation.193 = "MCH-1-1" |
| snmpTrapOID = "iso...2544.1.14.0.44" |
snmpTrapOID = fsp3000alm.trap.transientFaSaved |
| iso...2544.1.14.2.2.1.5.1 = "MCH-1-1" |
device.portTable.portEntry.portAidString.1 = "MCH-1-1" |
Event 5 — alarmLinkBudgetExceeded (trap 14)
| Raw |
Translated |
| iso...2544.1.14.1.4.1.2.14 = "alarmLinkBudgetExceeded" |
alarm.alarmDescriptionTable.alarmDescriptionEntry.alarmDescriptionName.14 = "alarmLinkBudgetExceeded" |
| iso...2544.1.14.1.1.1.3.1.14 = "6" |
alarm.alarmTable.alarmEntry.alarmSeverity.1.14 = "6" |
| sysUpTime = "472 days, 20:07:41.89" |
sysUpTime = "472 days, 20:07:41.89" |
| iso...2544.1.14.4.2.1.2.188 = "2026-02-23 10:33:58" |
eventLogs.eventLogTable.eventLogEntry.eventLogTimeStamp.188 = "2026-02-23 10:33:58" |
| iso...2544.1.14.4.2.1.4.188 = "MCH-1-1" |
eventLogs.eventLogTable.eventLogEntry.eventLogIdentityTranslation.188 = "MCH-1-1" |
| iso...2544.1.14.2.2.1.4.1 = " Duct 1-miniduct 2 Grijs" |
device.portTable.portEntry.portName.1 = " Duct 1-miniduct 2 Grijs" |
| int_ev_type = "SNMP" |
int_ev_type = "SNMP" |
| iso...2544.1.14.1.2.1.3.1.14 = "2" |
alarm.alarmSeverityTable.alarmSeverityEntry.alarmSeverityValue.1.14 = "2" |
| snmpTrapOID = "iso...2544.1.14.0.14" |
snmpTrapOID = fsp3000alm.trap.alarmLinkBudgetExceeded |
| iso...2544.1.14.2.2.1.5.1 = "MCH-1-1" |
device.portTable.portEntry.portAidString.1 = "MCH-1-1" |
Event 6 — transientFaStarted (trap 41)
| Raw |
Translated |
| sysUpTime = "472 days, 20:07:41.97" |
sysUpTime = "472 days, 20:07:41.97" |
| iso...2544.1.14.2.2.1.4.1 = " Duct 1-miniduct 2 Grijs" |
device.portTable.portEntry.portName.1 = " Duct 1-miniduct 2 Grijs" |
| int_ev_type = "SNMP" |
int_ev_type = "SNMP" |
| iso...2544.1.14.4.2.1.2.190 = "2026-02-23 10:33:58" |
eventLogs.eventLogTable.eventLogEntry.eventLogTimeStamp.190 = "2026-02-23 10:33:58" |
| iso...2544.1.14.1.4.1.2.41 = "transientFaStarted" |
alarm.alarmDescriptionTable.alarmDescriptionEntry.alarmDescriptionName.41 = "transientFaStarted" |
| iso...2544.1.14.4.2.1.4.190 = "MCH-1-1" |
eventLogs.eventLogTable.eventLogEntry.eventLogIdentityTranslation.190 = "MCH-1-1" |
| snmpTrapOID = "iso...2544.1.14.0.41" |
snmpTrapOID = fsp3000alm.trap.transientFaStarted |
| iso...2544.1.14.2.2.1.5.1 = "MCH-1-1" |
device.portTable.portEntry.portAidString.1 = "MCH-1-1" |
Event 7 — alarmFaRunning (trap 9), no alarmSeverityValue
| Raw |
Translated |
| iso...2544.1.14.4.2.1.2.189 = "2026-02-23 10:33:58" |
eventLogs.eventLogTable.eventLogEntry.eventLogTimeStamp.189 = "2026-02-23 10:33:58" |
| sysUpTime = "472 days, 20:07:41.93" |
sysUpTime = "472 days, 20:07:41.93" |
| iso...2544.1.14.4.2.1.4.189 = "MCH-1-1" |
eventLogs.eventLogTable.eventLogEntry.eventLogIdentityTranslation.189 = "MCH-1-1" |
| iso...2544.1.14.2.2.1.4.1 = " Duct 1-miniduct 2 Grijs" |
device.portTable.portEntry.portName.1 = " Duct 1-miniduct 2 Grijs" |
| int_ev_type = "SNMP" |
int_ev_type = "SNMP" |
| iso...2544.1.14.1.1.1.3.1.9 = "5" |
alarm.alarmTable.alarmEntry.alarmSeverity.1.9 = "5" |
| iso...2544.1.14.1.4.1.2.9 = "alarmFaRunning" |
alarm.alarmDescriptionTable.alarmDescriptionEntry.alarmDescriptionName.9 = "alarmFaRunning" |
| snmpTrapOID = "iso...2544.1.14.0.9" |
snmpTrapOID = fsp3000alm.trap.alarmFaRunning |
| iso...2544.1.14.2.2.1.5.1 = "MCH-1-1" |
device.portTable.portEntry.portAidString.1 = "MCH-1-1" |
Event 8 — alarmLinkBudgetExceeded (duplicate reception, same 188)
| Raw |
Translated |
| iso...2544.1.14.1.4.1.2.14 = "alarmLinkBudgetExceeded" |
alarm.alarmDescriptionTable.alarmDescriptionEntry.alarmDescriptionName.14 = "alarmLinkBudgetExceeded" |
| iso...2544.1.14.1.1.1.3.1.14 = "6" |
alarm.alarmTable.alarmEntry.alarmSeverity.1.14 = "6" |
| sysUpTime = "472 days, 20:07:41.90" |
sysUpTime = "472 days, 20:07:41.90" |
| iso...2544.1.14.4.2.1.2.188 = "2026-02-23 10:33:58" |
eventLogs.eventLogTable.eventLogEntry.eventLogTimeStamp.188 = "2026-02-23 10:33:58" |
| iso...2544.1.14.4.2.1.4.188 = "MCH-1-1" |
eventLogs.eventLogTable.eventLogEntry.eventLogIdentityTranslation.188 = "MCH-1-1" |
| iso...2544.1.14.2.2.1.4.1 = " Duct 1-miniduct 2 Grijs" |
device.portTable.portEntry.portName.1 = " Duct 1-miniduct 2 Grijs" |
| int_ev_type = "SNMP" |
int_ev_type = "SNMP" |
| iso...2544.1.14.1.2.1.3.1.14 = "2" |
alarm.alarmSeverityTable.alarmSeverityEntry.alarmSeverityValue.1.14 = "2" |
| snmpTrapOID = "iso...2544.1.14.0.14" |
snmpTrapOID = fsp3000alm.trap.alarmLinkBudgetExceeded |
| iso...2544.1.14.2.2.1.5.1 = "MCH-1-1" |
device.portTable.portEntry.portAidString.1 = "MCH-1-1" |
Event 9 — transientFaCompleted (event log index 186)
| Raw |
Translated |
| iso...2544.1.14.4.2.1.4.186 = "MCH-1-1" |
eventLogs.eventLogTable.eventLogEntry.eventLogIdentityTranslation.186 = "MCH-1-1" |
| sysUpTime = "472 days, 20:02:20.08" |
sysUpTime = "472 days, 20:02:20.08" |
| iso...2544.1.14.4.2.1.2.186 = "2026-02-23 10:28:36" |
eventLogs.eventLogTable.eventLogEntry.eventLogTimeStamp.186 = "2026-02-23 10:28:36" |
| iso...2544.1.14.2.2.1.4.1 = " Duct 1-miniduct 2 Grijs" |
device.portTable.portEntry.portName.1 = " Duct 1-miniduct 2 Grijs" |
| int_ev_type = "SNMP" |
int_ev_type = "SNMP" |
| snmpTrapOID = "iso...2544.1.14.0.42" |
snmpTrapOID = fsp3000alm.trap.transientFaCompleted |
| iso...2544.1.14.2.2.1.5.1 = "MCH-1-1" |
device.portTable.portEntry.portAidString.1 = "MCH-1-1" |
| iso...2544.1.14.1.4.1.2.42 = "transientFaCompleted" |
alarm.alarmDescriptionTable.alarmDescriptionEntry.alarmDescriptionName.42 = "transientFaCompleted" |
Event 10 — alarmFaRunning (event log index 183)
| Raw |
Translated |
| iso...2544.1.14.4.2.1.4.183 = "MCH-1-1" |
eventLogs.eventLogTable.eventLogEntry.eventLogIdentityTranslation.183 = "MCH-1-1" |
| sysUpTime = "472 days, 20:01:47.03" |
sysUpTime = "472 days, 20:01:47.03" |
| iso...2544.1.14.4.2.1.2.183 = "2026-02-23 10:28:04" |
eventLogs.eventLogTable.eventLogEntry.eventLogTimeStamp.183 = "2026-02-23 10:28:04" |
| iso...2544.1.14.2.2.1.4.1 = " Duct 1-miniduct 2 Grijs" |
device.portTable.portEntry.portName.1 = " Duct 1-miniduct 2 Grijs" |
| int_ev_type = "SNMP" |
int_ev_type = "SNMP" |
| iso...2544.1.14.1.1.1.3.1.9 = "5" |
alarm.alarmTable.alarmEntry.alarmSeverity.1.9 = "5" |
| iso...2544.1.14.1.4.1.2.9 = "alarmFaRunning" |
alarm.alarmDescriptionTable.alarmDescriptionEntry.alarmDescriptionName.9 = "alarmFaRunning" |
| snmpTrapOID = "iso...2544.1.14.0.9" |
snmpTrapOID = fsp3000alm.trap.alarmFaRunning |
| iso...2544.1.14.2.2.1.5.1 = "MCH-1-1" |
device.portTable.portEntry.portAidString.1 = "MCH-1-1" |
Summary
- Event log varbinds (.4.2.1.2.X, .4.2.1.4.X) give eventLogTimeStamp and eventLogIdentityTranslation (entity name) per log index X; use for message_key (entity|trapOID|index).
- Device varbinds (.2.2.1.4.1, .2.2.1.5.1) are portName and portAidString for port 1; use for resource/affected CI.
- Alarm varbinds (.1.1.1.3.1.X, .1.2.1.3.1.X, .1.4.1.2.X) carry alarm state/severity and trap type name; use for severity and event type.
- system.advaSecurity (.5.8.*) appears in authentication traps (user, IP, protocol, etc.).
- snmpTrapOID (.0.X) identifies the trap; in translated form it becomes **fsp3000alm.trap.trapName.
Source: test_events_servicenow.xml, MIB: mib files/ADVA-FSP3000ALM-MIB.txt.
