Home
Monitor and troubleshoot
Documents under this category provide information about monitoring, diagnosing, and troubleshooting router issues.
Log Events Guide
This guide provides information about log events.
LI

Monitor and troubleshoot
Documents under this category provide information about monitoring, diagnosing, and troubleshooting router issues.
- Log Events Guide
  This guide provides information about log events.
- OAM and Diagnostics Guide
  This guide describes how to configure features such as service mirroring and Lawful Intercept (LI), and how to use the Operations, Administration, and Maintenance (OAM) and diagnostics tools.
- 7450 and 7750 Troubleshooting Guide
- 7950 Troubleshooting Guide
- Log Events Search Tool
  A searchable HTML list of the SR OS events.

LI

cli_config_io

Table 1. cli_config_io properties
Property name	Value
Application name	LI
Event ID	2115
Event name	cli_config_io
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User from $srcAddr$: $prompt$ $message$
Cause	A valid CLI command was entered in the configuration node.
Effect	Configuration was changed by CLI command.
Recovery	No recovery is required.

cli_unauth_config_io

Table 2. cli_unauth_config_io properties
Property name	Value
Application name	LI
Event ID	2117
Event name	cli_unauth_config_io
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User from $srcAddr$. $message$: $prompt$ $command$
Cause	User has entered configuration command for which he is not authorized.
Effect	The CLI command was not processed.
Recovery	No recovery is required.

cli_unauth_user_io

Table 3. cli_unauth_user_io properties
Property name	Value
Application name	LI
Event ID	2116
Event name	cli_unauth_user_io
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User from $srcAddr$. $message$: $prompt$ $command$
Cause	User has entered command for which he is not authorized.
Effect	The CLI command was not processed.
Recovery	No recovery is required.

cli_user_io

Table 4. cli_user_io properties
Property name	Value
Application name	LI
Event ID	2113
Event name	cli_user_io
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User from $srcAddr$: $prompt$ $message$
Cause	A CLI command was entered.
Effect	A CLI command was processed.
Recovery	No recovery is required.

cli_user_login

Table 5. cli_user_login properties
Property name	Value
Application name	LI
Event ID	2101
Event name	cli_user_login
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User $userName$ from $srcAddr$ logged in
Cause	The user was successfully authenticated for login.
Effect	A user access session was started.
Recovery	No recovery is required.

cli_user_login_failed

Table 6. cli_user_login_failed properties
Property name	Value
Application name	LI
Event ID	2103
Event name	cli_user_login_failed
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User $userName$ from $srcAddr$ failed authentication
Cause	The user failed authentication.
Effect	The user access session was not started. The user is given another opportunity to authenticate himself.
Recovery	No recovery is required.

cli_user_login_max_attempts

Table 7. cli_user_login_max_attempts properties
Property name	Value
Application name	LI
Event ID	2104
Event name	cli_user_login_max_attempts
SNMP notification prefix and OID	TIMETRA-SECURITY-MIB.tmnxSecurityNotifications.51
Default severity	minor
Message format string	User $tmnxSecNotifyUserName$ from $tmnxSecNotifyAddr$ attempted more than $tmnxPasswordAttemptsCount$ times to log in, user locked out for $tmnxPasswordAttemptsLockoutPeriod$ min
Cause	A tmnxUserCliLoginMaxAttempts notification is generated when a user attempting to open a CLI session failed to authenticate for more than a maximum allowed number of times in a period of tmnxPasswordAttemptsTime minutes. The value of the object tmnxPasswordAttemptsCount indicates the maximum number of unsuccessful login attempts allowed. The value of the object tmnxPasswordAttemptsLockoutPeriod indicates the number of minutes the user is locked out if the threshold of unsuccessful login attempts has been exceeded. The value of the object tmnxSecNotifyUserName indicates the name of the user attempting to open a CLI session. The value of the object tmnxSecNotifyAddrType indicates the type of the IP address stored in the object tmnxSecNotifyAddr. The value of the object tmnxSecNotifyAddr indicates the IP address of the user attempting to open a CLI session.
Effect	The user is locked out for a period of tmnxPasswordAttemptsLockoutPeriod minutes. A remote access session is terminated.
Recovery	No recovery action is required.

cli_user_logout

Table 8. cli_user_logout properties
Property name	Value
Application name	LI
Event ID	2102
Event name	cli_user_logout
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User $userName$ from $srcAddr$ logged out
Cause	A user logged out.
Effect	A user access session was stopped.
Recovery	No recovery is required.

destinationDisabled

Table 9. destinationDisabled properties
Property name	Value
Application name	LI
Event ID	2014
Event name	destinationDisabled
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorNotifications.4
Default severity	minor
Message format string	Mirror destination $tMirrorDestinationIndex$ is administratively disabled ('shutdown')
Cause	The operator disabled the mirror destination.
Effect	No mirror traffic will egress. Applications using the mirror traffic will not receive any traffic from this destination.
Recovery	The operator intentionally disabled the mirror destination, so no recovery is necessary. Enable the mirror destination to restart mirroring.

destinationEnabled

Table 10. destinationEnabled properties
Property name	Value
Application name	LI
Event ID	2013
Event name	destinationEnabled
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorNotifications.3
Default severity	minor
Message format string	Mirror destination $tMirrorDestinationIndex$ is administratively enabled ('no shutdown')
Cause	The operator enabled the mirror destination.
Effect	The mirror traffic will egress. Applications using the mirror traffic will receive traffic from this destination.
Recovery	The operator intentionally enabled the mirror destination, so no recovery is necessary.

ftp_user_login

Table 11. ftp_user_login properties
Property name	Value
Application name	LI
Event ID	2105
Event name	ftp_user_login
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User $userName$ from $srcAddr$ logged in
Cause	The user was successfully authenticated for login.
Effect	A user access session begins.
Recovery	No recovery is required

ftp_user_login_failed

Table 12. ftp_user_login_failed properties
Property name	Value
Application name	LI
Event ID	2107
Event name	ftp_user_login_failed
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User $userName$ from $srcAddr$ failed authentication
Cause	A user failed authentication.
Effect	The user access session does not begin. The user is given another opportunity to authenticate himself.
Recovery	No recovery is required.

ftp_user_login_max_attempts

Table 13. ftp_user_login_max_attempts properties
Property name	Value
Application name	LI
Event ID	2108
Event name	ftp_user_login_max_attempts
SNMP notification prefix and OID	TIMETRA-SECURITY-MIB.tmnxSecurityNotifications.53
Default severity	minor
Message format string	User $tmnxSecNotifyUserName$ from $tmnxSecNotifyAddr$ attempted more than $tmnxPasswordAttemptsCount$ times to log in, user locked out for $tmnxPasswordAttemptsLockoutPeriod$ min
Cause	A tmnxLiUserFtpLoginMaxAttempts notification is generated when a Lawful Interception user attempting to connect via FTP failed to authenticate for more than a maximum allowed number of times in a period of tmnxPasswordAttemptsTime minutes. The value of the object tmnxPasswordAttemptsCount indicates the maximum number of unsuccessful login attempts allowed. The value of the object tmnxPasswordAttemptsLockoutPeriod indicates the number of minutes the user is locked out if the threshold of unsuccessful login attempts has been exceeded. The value of the object tmnxSecNotifyUserName indicates the name of the user attempting to connect via FTP. The value of the object tmnxSecNotifyAddrType indicates the type of the IP address stored in the object tmnxSecNotifyAddr. The value of the object tmnxSecNotifyAddr indicates the IP address of the user attempting to connect via FTP.
Effect	The user is locked out for a period of tmnxPasswordAttemptsLockoutPeriod minutes. An FTP session is terminated.
Recovery	No recovery action is required.

ftp_user_logout

Table 14. ftp_user_logout properties
Property name	Value
Application name	LI
Event ID	2106
Event name	ftp_user_logout
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User $userName$ from $srcAddr$ logged out
Cause	A user logged out.
Effect	The user access session ends.
Recovery	No recovery is required

grpc_auth

Table 15. grpc_auth properties
Property name	Value
Application name	LI
Event ID	2403
Event name	grpc_auth
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User $userName$ from $srcAddr$ port $srcPort$ to port $dstPort$ session $sessionId$: $rpcName$ RPC authorized
Cause	The user called a RPC in gRPC interface.
Effect	The RPC was processed.
Recovery	No recovery is required.

grpc_unauth

Table 16. grpc_unauth properties
Property name	Value
Application name	LI
Event ID	2404
Event name	grpc_unauth
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User $userName$ from $srcAddr$ port $srcPort$ to port $dstPort$ session $sessionId$: $rpcName$ RPC unauthorized
Cause	The user called a RPC in gRPC interface for which they are not authorized.
Effect	The RPC was not processed.
Recovery	No recovery is required.

grpc_user_login

Table 17. grpc_user_login properties
Property name	Value
Application name	LI
Event ID	2118
Event name	grpc_user_login
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User $userName$ from $srcAddr$ logged in
Cause	The user was successfully authenticated for login.
Effect	A user access session begins.
Recovery	No recovery is required

grpc_user_login_failed

Table 18. grpc_user_login_failed properties
Property name	Value
Application name	LI
Event ID	2120
Event name	grpc_user_login_failed
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User $userName$ from $srcAddr$ failed authentication
Cause	A user failed authentication.
Effect	The user access session does not begin. The user is given another opportunity to authenticate himself.
Recovery	No recovery is required.

grpc_user_login_max_attempts

Table 19. grpc_user_login_max_attempts properties
Property name	Value
Application name	LI
Event ID	2121
Event name	grpc_user_login_max_attempts
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User $tmnxSecNotifyUserName$ from $tmnxSecNotifyAddr$ attempted more than $tmnxPasswordAttemptsCount$ times to log in, user locked out for $tmnxPasswordAttemptsLockoutPeriod$ min
Cause	A Lawful Interception user attempting to connect via gRPC failed to authenticate for more than a maximum allowed number of times in a period of tmnxPasswordAttemptsTime minutes. The value of the object tmnxPasswordAttemptsCount indicates the maximum number of unsuccessful login attempts allowed. The value of the object tmnxPasswordAttemptsLockoutPeriod indicates the number of minutes the user is locked out if the threshold of unsuccessful login attempts has been exceeded. The value of the object tmnxSecNotifyUserName indicates the name of the user attempting to connect via gRPC. The value of the object tmnxSecNotifyAddrType indicates the type of the IP address stored in the object tmnxSecNotifyAddr. The value of the object tmnxSecNotifyAddr indicates the IP address of the user attempting to connect via gRPC.
Effect	The user is locked out for a period of tmnxPasswordAttemptsLockoutPeriod minutes. An gRPC session is terminated.
Recovery	No recovery action is required.

grpc_user_logout

Table 20. grpc_user_logout properties
Property name	Value
Application name	LI
Event ID	2119
Event name	grpc_user_logout
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User $userName$ from $srcAddr$ logged out
Cause	A user logged out.
Effect	The user access session ends.
Recovery	No recovery is required

host_snmp_attempts

Table 21. host_snmp_attempts properties
Property name	Value
Application name	LI
Event ID	2123
Event name	host_snmp_attempts
SNMP notification prefix and OID	N/A
Default severity	warning
Message format string	Host $hostAddress$ is locked out for $lockoutTime$ minutes since it exceeded the configured threshold of unsuccessful SNMP connection attempts.
Cause	A host (manager IP address) exceeded the configured number of access attempts.
Effect	The host is locked out and the router will not respond to the SNMP requests from the host.
Recovery	N/A

md_cli_io

Table 22. md_cli_io properties
Property name	Value
Application name	LI
Event ID	2223
Event name	md_cli_io
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User $userName$ from $srcAddr$ [session ID $sessionId$]: $prompt$ $command$
Cause	A CLI command was entered in the MD-CLI engine.
Effect	The CLI command was processed in the MD-CLI engine.
Recovery	No recovery is required.

md_cli_unauth_io

Table 23. md_cli_unauth_io properties
Property name	Value
Application name	LI
Event ID	2224
Event name	md_cli_unauth_io
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User $userName$ from $srcAddr$ [session ID $sessionId$]. Command not allowed for this user: $prompt$ $command$
Cause	The user entered a command in MD-CLI for which they are not authorized.
Effect	The MD-CLI command was not processed.
Recovery	No recovery is required.

mdLiConfigChange

Table 24. mdLiConfigChange properties
Property name	Value
Application name	LI
Event ID	2210
Event name	mdLiConfigChange
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	target='target' operation='operation' value='value'
Cause	Database commit executed
Effect	Database running config was changed
Recovery	No recovery is required.

mdSaveCommitHistoryFailed

Table 25. mdSaveCommitHistoryFailed properties
Property name	Value
Application name	LI
Event ID	2129
Event name	mdSaveCommitHistoryFailed
SNMP notification prefix and OID	TIMETRA-SYSTEM-MIB.tmnxSysNotifications.91
Default severity	major
Message format string	Lawful Intercept commit history file write failed: $fileName$
Cause	Saving the Lawful Intercept commit history file failed because of an error.
Effect	The LI commit history file was not saved.
Recovery	Identify the cause of the failure and save the LI configuration to save the commit history.

netconf_auth

Table 26. netconf_auth properties
Property name	Value
Application name	LI
Event ID	2401
Event name	netconf_auth
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User $userName$ from $srcAddr$ port $srcPort$ to port $dstPort$ session $sessionId$: $rpcName$ RPC authorized
Cause	The user called a RPC in Netconf interface.
Effect	The RPC was processed.
Recovery	No recovery is required.

netconf_unauth

Table 27. netconf_unauth properties
Property name	Value
Application name	LI
Event ID	2402
Event name	netconf_unauth
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User $userName$ from $srcAddr$ port $srcPort$ to port $dstPort$ session $sessionId$: $rpcName$ RPC unauthorized
Cause	The user called a RPC in Netconf interface for which they are not authorized.
Effect	The RPC was not processed.
Recovery	No recovery is required.

netconf_user_login

Table 28. netconf_user_login properties
Property name	Value
Application name	LI
Event ID	2125
Event name	netconf_user_login
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User $userName$ from $srcAddr$ logged in
Cause	A user successfully authenticated for login.
Effect	A user access session was started.
Recovery	No recovery is required

netconf_user_login_failed

Table 29. netconf_user_login_failed properties
Property name	Value
Application name	LI
Event ID	2127
Event name	netconf_user_login_failed
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User $userName$ from $srcAddr$ failed authentication
Cause	A user failed authentication.
Effect	The user access session does not begin. The user will be given another opportunity to authenticate himself.
Recovery	No recovery is required

netconf_user_login_max_attempts

Table 30. netconf_user_login_max_attempts properties
Property name	Value
Application name	LI
Event ID	2128
Event name	netconf_user_login_max_attempts
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User $tmnxSecNotifyUserName$ from $tmnxSecNotifyAddr$ attempted more than $tmnxPasswordAttemptsCount$ times to log in, user locked out for $tmnxPasswordAttemptsLockoutPeriod$ min
Cause	A tmnxUserNetconfLoginMaxAttempts notification is generated when a user attempting to open a netconf session failed to authenticate for more than a maximum allowed number of times in a period of tmnxPasswordAttemptsTime minutes. The value of the object tmnxPasswordAttemptsCount indicates the maximum number of unsuccessful login attempts allowed. The value of the object tmnxPasswordAttemptsLockoutPeriod indicates the number of minutes the user is locked out if the threshold of unsuccessful login attempts has been exceeded. The value of the object tmnxSecNotifyUserName indicates the name of the user attempting to open a netconf session. The value of the object tmnxSecNotifyAddrType indicates the type of the IP address stored in the object tmnxSecNotifyAddr. The value of the object tmnxSecNotifyAddr indicates the IP address of the user attempting to open a netconf session.
Effect	The user is locked out for a period of tmnxPasswordAttemptsLockoutPeriod minutes. A remote access session is terminated.
Recovery	No recovery action is required.

netconf_user_logout

Table 31. netconf_user_logout properties
Property name	Value
Application name	LI
Event ID	2126
Event name	netconf_user_logout
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User $userName$ from $srcAddr$ logged out
Cause	A user logged out.
Effect	A user access session ended.
Recovery	No recovery is required

radiusFailed

Table 32. radiusFailed properties
Property name	Value
Application name	LI
Event ID	2124
Event name	radiusFailed
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorNotifications.28
Default severity	minor
Message format string	LI for host failed: $tMirrorNotifyLiDescription$
Cause	The system sends a radiusFailed notification when it fails to invoke a mirror destination service requested by a Radius server. More details about the failure are indicated in the tMirrorNotifyLiDescription object.
Effect	The mirror destination service could not be created.
Recovery	Recovery, if required, depends on the alarm cause.

sbiBootLiConfig

Table 33. sbiBootLiConfig properties
Property name	Value
Application name	LI
Event ID	2001
Event name	sbiBootLiConfig
SNMP notification prefix and OID	TIMETRA-SYSTEM-MIB.tmnxSysNotifications.40
Default severity	major
Message format string	Lawful Intercept (LI) bootup configuration status: $sliConfigStatus$. LI separate: $sbiLiSeparate$. LI local save: $sbiLiLocalSave$. System last booted time: $sysUpTime$.
Cause	The bootup LI configuration phase is finished.
Effect	LI configuration will be missing or incomplete if LI configuration phase was not completed successfully.
Recovery	Determine failure cause and restore LI configuration manually or reboot.

sbiBootMdReadCommitHistoryFailed

Table 34. sbiBootMdReadCommitHistoryFailed properties
Property name	Value
Application name	LI
Event ID	2130
Event name	sbiBootMdReadCommitHistoryFailed
SNMP notification prefix and OID	TIMETRA-SYSTEM-MIB.tmnxSysNotifications.92
Default severity	major
Message format string	Lawful Intercept commit history file read failed: $fileName$
Cause	Reading the Lawful Intercept commit history file failed because of an error.
Effect	The LI commit history file was not read.
Recovery	Identify the cause of the failure and reboot the system.

snmp_user_set

Table 35. snmp_user_set properties
Property name	Value
Application name	LI
Event ID	2114
Event name	snmp_user_set
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	SNMP user from $srcAddr$> $vbList$
Cause	A valid SNMP SET request was received.
Effect	The configuration was changed by an SNMP SET operation.
Recovery	No recovery is required.

sourceDisabled

Table 36. sourceDisabled properties
Property name	Value
Application name	LI
Event ID	2012
Event name	sourceDisabled
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorNotifications.2
Default severity	minor
Message format string	LI Mirror source $tMirrorSourceIndex$ is administratively disabled ('shutdown')
Cause	The operator disabled the LI mirror source
Effect	No traffic from this source will be mirrored. Applications using the mirror traffic will not receive any traffic from this source.
Recovery	The operator intentionally disabled the LI mirror source, so no recovery is required. Enable the LI mirror source to restart mirroring.

sourceEnabled

Table 37. sourceEnabled properties
Property name	Value
Application name	LI
Event ID	2011
Event name	sourceEnabled
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorNotifications.1
Default severity	minor
Message format string	LI Mirror source $tMirrorSourceIndex$ is administratively enabled ('no shutdown')
Cause	Operator enabled the LI mirror source
Effect	Traffic from this source will be mirrored. Applications using the mirror traffic will receive traffic from this source.
Recovery	The Operator intentionally enabled the LI mirror source, so no recovery is required. Disable the LI mirror source to stop LI mirroring.

sourceSapChange

Table 38. sourceSapChange properties
Property name	Value
Application name	LI
Event ID	2018
Event name	sourceSapChange
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorNotifications.8
Default severity	minor
Message format string	Lawful Intercept Mirror source $tMirrorSourceIndex$ associated SAP $tMirrorSourceSapEncapValue$ has been $tMirrorSourceChangeType$
Cause	A SAP associated with the LI mirror source has been modified or deleted.
Effect	Mirrored traffic from this source may be affected in an undesired manner.
Recovery	Modify the configuration of the associated SAP to restore the desired mirrored traffic.

sourceSubscriberChange

Table 39. sourceSubscriberChange properties
Property name	Value
Application name	LI
Event ID	2019
Event name	sourceSubscriberChange
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorNotifications.9
Default severity	minor
Message format string	Mirroring for Lawful Intercept mirror source $tMirrorSourceIndex$ subscriber "$tMirrorSourceSubIdent$" has been $tMirrorSourceChangeType$
Cause	A subscriber associated with the LI mirror source has been activated, deactivated, modified, or deleted.
Effect	Mirrored traffic from this source may be affected in an undesired manner.
Recovery	Modify the configuration of the associated subscriber to restore the desired mirrored traffic.

ssh_user_login

Table 40. ssh_user_login properties
Property name	Value
Application name	LI
Event ID	2109
Event name	ssh_user_login
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User $userName$ from $srcAddr$ logged in
Cause	The user was successfully authenticated for login.
Effect	A user access session begins.
Recovery	No recovery is required

ssh_user_login_failed

Table 41. ssh_user_login_failed properties
Property name	Value
Application name	LI
Event ID	2111
Event name	ssh_user_login_failed
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User $userName$ from $srcAddr$ failed authentication
Cause	A user failed authentication.
Effect	The user access session does not begin. The user is given another opportunity to authenticate himself.
Recovery	No recovery is required.

ssh_user_login_max_attempts

Table 42. ssh_user_login_max_attempts properties
Property name	Value
Application name	LI
Event ID	2112
Event name	ssh_user_login_max_attempts
SNMP notification prefix and OID	TIMETRA-SECURITY-MIB.tmnxSecurityNotifications.52
Default severity	minor
Message format string	User $tmnxSecNotifyUserName$ from $tmnxSecNotifyAddr$ attempted more than $tmnxPasswordAttemptsCount$ times to log in, user locked out for $tmnxPasswordAttemptsLockoutPeriod$ min
Cause	A tmnxLiUserSshLoginMaxAttempts notification is generated when a Lawful Interception user attempting to connect via SSH failed to authenticate for more than a maximum allowed number of times in a period of tmnxPasswordAttemptsTime minutes. The value of the object tmnxPasswordAttemptsCount indicates the maximum number of unsuccessful login attempts allowed. The value of the object tmnxPasswordAttemptsLockoutPeriod indicates the number of minutes the user is locked out if the threshold of unsuccessful login attempts has been exceeded. The value of the object tmnxSecNotifyUserName indicates the name of the user attempting to connect via SSH. The value of the object tmnxSecNotifyAddrType indicates the type of the IP address stored in the object tmnxSecNotifyAddr. The value of the object tmnxSecNotifyAddr indicates the IP address of the user attempting to connect via SSH.
Effect	The user is locked out for a period of tmnxPasswordAttemptsLockoutPeriod minutes. An SSH session is terminated.
Recovery	No recovery action is required.

ssh_user_logout

Table 43. ssh_user_logout properties
Property name	Value
Application name	LI
Event ID	2110
Event name	ssh_user_logout
SNMP notification prefix and OID	N/A
Default severity	minor
Message format string	User $userName$ from $srcAddr$ logged out
Cause	A user logged out.
Effect	The user access session ends.
Recovery	No recovery is required

ssiSaveConfigFailed

Table 44. ssiSaveConfigFailed properties
Property name	Value
Application name	LI
Event ID	2203
Event name	ssiSaveConfigFailed
SNMP notification prefix and OID	TIMETRA-SYSTEM-MIB.tmnxSysNotifications.3
Default severity	major
Message format string	Lawful Intercept configuration file write failed: $fileName$ $reason$
Cause	Saving the LI configuration failed because of an error.
Effect	The LI configuration was not saved.
Recovery	Identify the cause of the failure and save the LI configuration.

ssiSaveConfigSucceeded

Table 45. ssiSaveConfigSucceeded properties
Property name	Value
Application name	LI
Event ID	2202
Event name	ssiSaveConfigSucceeded
SNMP notification prefix and OID	TIMETRA-SYSTEM-MIB.tmnxSysNotifications.2
Default severity	warning
Message format string	Lawful Intercept Configuration file saved to: $fileName$
Cause	Saving the LI configuration succeeded.
Effect	The LI configuration was saved.
Recovery	No recovery is necessary.

ssiSyncConfigFailed

Table 46. ssiSyncConfigFailed properties
Property name	Value
Application name	LI
Event ID	2213
Event name	ssiSyncConfigFailed
SNMP notification prefix and OID	TIMETRA-SYSTEM-MIB.tmnxSysNotifications.15
Default severity	major
Message format string	Synchronization of Lawful Intercept configuration files failed
Cause	The sync config failed event is generated when the synchronization of configuration files is stopped due to errors.
Effect	Configuration files are not synchronized.
Recovery	No recovery is necessary.

ssiSyncConfigOK

Table 47. ssiSyncConfigOK properties
Property name	Value
Application name	LI
Event ID	2212
Event name	ssiSyncConfigOK
SNMP notification prefix and OID	TIMETRA-SYSTEM-MIB.tmnxSysNotifications.14
Default severity	warning
Message format string	Lawful Intercept configuration files have been successfully synchronized
Cause	The synchronize config succeeded event is generated when the synchronization of configuration files finishes without errors.
Effect	Configuration files synchronized.
Recovery	No recovery is necessary.

tFltrLiRsvdBlockRangeChangeEvent

Table 48. tFltrLiRsvdBlockRangeChangeEvent properties
Property name	Value
Application name	LI
Event ID	2038
Event name	tFltrLiRsvdBlockRangeChangeEvent
SNMP notification prefix and OID	TIMETRA-FILTER-MIB.tFilterNotifications.17
Default severity	minor
Message format string	LI Reserved Block $tLiReservedBlockName$ range has changed (start-entry $tLiReservedBlockStart$ size $tLiReservedBlockSize$). This change may rearrange filters entries and may temporarily disrupt current interception.
Cause	This notification was triggered because LI reserved block range has changed.
Effect	LI entries within the LI reserved block may be moved to a new position. Interception of the moved LI filter entries will be temporarily interrupted.
Recovery	No recovery action is required.

tMirrorDestinationChangeReject

Table 49. tMirrorDestinationChangeReject properties
Property name	Value
Application name	LI
Event ID	2023
Event name	tMirrorDestinationChangeReject
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorNotifications.14
Default severity	minor
Message format string	An attempt was blocked to modify mirror destination $tMirrorDestinationIndex$ that is being referenced by Lawful Intercept
Cause	An operator is trying to modify mirror destination that cannot currently be changed because the destination is being used for mirroring.
Effect	The change is not allowed.
Recovery	The mirror destination can only be modified after LI actions are cleared.

tMirrorFilterAssignToItfWarn

Table 50. tMirrorFilterAssignToItfWarn properties
Property name	Value
Application name	LI
Event ID	2030
Event name	tMirrorFilterAssignToItfWarn
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorNotifications.19
Default severity	minor
Message format string	$tMirrorFilterType$ filter $tMirrorFilterId$ , which is referred to by Lawful Intercept has been applied on $tMirrorFilterDirection$ to interface $tMirrorFilterIfName$ (IfIndex $tMirrorFilterIfIndex$)
Cause	A filter that is being used for mirroring has been applied to a SDP. This assignment was allowed, but might cause traffic from this SDP to show up in the mirror destination.
Effect	N/A
Recovery	No recovery required.

tMirrorFilterAssignToSapWarn

Table 51. tMirrorFilterAssignToSapWarn properties
Property name	Value
Application name	LI
Event ID	2028
Event name	tMirrorFilterAssignToSapWarn
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorNotifications.17
Default severity	minor
Message format string	$tMirrorFilterType$ filter $tMirrorFilterId$ , which is referred to by Lawful Intercept has been applied on $tMirrorFilterDirection$ to SAP $tMirrorFilterSapEncapValue$ in service $tMirrorFilterSvcId$
Cause	A filter that is being used for mirroring has been applied to a SAP. This assignment was allowed, but might cause traffic from this SAP to show up in the mirror destination.
Effect	N/A
Recovery	No recovery required.

tMirrorFilterAssignToSdpWarn

Table 52. tMirrorFilterAssignToSdpWarn properties
Property name	Value
Application name	LI
Event ID	2029
Event name	tMirrorFilterAssignToSdpWarn
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorNotifications.18
Default severity	minor
Message format string	$tMirrorFilterType$ filter $tMirrorFilterId$ , which is referred to by Lawful Intercept has been applied on $tMirrorFilterDirection$ to SDP $tMirrorFilterSdpBindId$ in service $tMirrorFilterSvcId$
Cause	A filter that is being used for mirroring has been applied to a SDP. This assignment was allowed, but might cause traffic from this SDP to show up in the mirror destination.
Effect	N/A
Recovery	No recovery required.

tMirrorLiNat64SubOperStateCh

Table 53. tMirrorLiNat64SubOperStateCh properties
Property name	Value
Application name	LI
Event ID	2036
Event name	tMirrorLiNat64SubOperStateCh
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorNotifications.26
Default severity	minor
Message format string	The state of LI mirror source $tMirrorSourceIndex$ LSN NAT64 subscriber ($vRtrID$, $tMirrorLiNatLsnSubAddr$/ $tMirrorLiNatLsnSubPrefixLength$) changed to $tMirrorLiNat64SubOperState$
Cause	The tMirrorLiNatLsnSubOperStateCh notification is sent when the value of the object tMirrorLiNat64SubOperState changes. This is related to the state of the ISA MDA where the forwarding entry is located, or the availability of resources on that MDA.
Effect	The corresponding inward bound packets are dropped while the operational status is 'down'.
Recovery	If the ISA MDA reboots successfully, or another ISA MDA takes over, no recovery is required. If more resources become available on the ISA MDA, no recovery is required.

tMirrorLiNatL2awSubOperStateCh

Table 54. tMirrorLiNatL2awSubOperStateCh properties
Property name	Value
Application name	LI
Event ID	2035
Event name	tMirrorLiNatL2awSubOperStateCh
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorNotifications.25
Default severity	minor
Message format string	The state of LI mirror source $tMirrorSourceIndex$ l2-aware subscriber $tMirrorLiNatL2awSubIdent$ changed to $tMirrorLiNatL2awSubOperState$
Cause	The tMirrorLiNatL2awSubOperStateCh notification is sent when the value of the object tMirrorLiNatL2awSubOperState changes. This is related to the state of the ISA MDA where the forwarding entry is located, the availability of resources on that MDA, or the instantiation of the subscriber.
Effect	The corresponding inward bound packets are dropped while the operational status is 'down'.
Recovery	If the ISA MDA reboots successfully, or another ISA MDA takes over, no recovery is required. If more resources become available on the ISA MDA, no recovery is required.

tMirrorLiNatLsnSubOperStateCh

Table 55. tMirrorLiNatLsnSubOperStateCh properties
Property name	Value
Application name	LI
Event ID	2034
Event name	tMirrorLiNatLsnSubOperStateCh
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorNotifications.24
Default severity	minor
Message format string	The state of LI mirror source $tMirrorSourceIndex$ LSN subscriber ($vRtrID$, $tMirrorLiNatLsnSubAddr$/ $tMirrorLiNatLsnSubPrefixLength$) changed to $tMirrorLiNatLsnSubOperState$
Cause	The tMirrorLiNatLsnSubOperStateCh notification is sent when the value of the object tMirrorLiNatLsnSubOperState changes. This is related to the state of the ISA MDA where the forwarding entry is located, or the availability of resources on that MDA.
Effect	The corresponding inward bound packets are dropped while the operational status is 'down'.
Recovery	If the ISA MDA reboots successfully, or another ISA MDA takes over, no recovery is required. If more resources become available on the ISA MDA, no recovery is required.

tMirrorLiSrcPortLicInvalid

Table 56. tMirrorLiSrcPortLicInvalid properties
Property name	Value
Application name	LI
Event ID	2039
Event name	tMirrorLiSrcPortLicInvalid
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorNotifications.29
Default severity	major
Message format string	LI Source Port mirroring license is invalid. License failure state is: $tMirrorSourcePortLicenseState$
Cause	The system sends a tMirrorLiSrcPortLicExpired notification when the system license no longer supports the use of port mirroring on LI Source elements.
Effect	The LI Source port mirroring capability will be disabled. Existing LI Source configuration including ports will not be deconfigured.
Recovery	An up-to-date SROS license supporting LI Source port mirroring must be applied to restore operation of LI port mirroring.

tMirrorLiUpIeInvalid

Table 57. tMirrorLiUpIeInvalid properties
Property name	Value
Application name	LI
Event ID	2043
Event name	tMirrorLiUpIeInvalid
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorCupsUpNotifications.3
Default severity	warning
Message format string	Invalid LI IE received on SCI - $tMirrorLiNotifyLongDescription$
Cause	Inconsistent configuration of li-encryption-key on UP and CP system, or insufficient resources for decryption; the details are available in the object tMirrorLiNotifyLongDescription.
Effect	The creation, deletion or modification of intercept resources for a subscriber failed.
Recovery	Ensure consistent configuration of li-encryption-key on UP and CP.

tMirrorLiUpSubFailed

Table 58. tMirrorLiUpSubFailed properties
Property name	Value
Application name	LI
Event ID	2041
Event name	tMirrorLiUpSubFailed
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorCupsUpNotifications.1
Default severity	warning
Message format string	LI set up for UP subscriber $tMirrorNotifyLiIdentifier$ intercept-id=$tMirrorNotifyLiInterceptionId$ session-id= $tMirrorNotifyLiSessionId$ failed - $tMirrorLiNotifyLongDescription$
Cause	Detailed information about the exact cause of the notification is available in the object tMirrorLiNotifyLongDescription.
Effect	Any traffic of a CUPS subscriber subject to Lawful Intercept is not intercepted.
Recovery	N/A

tMirrorLiUpSubSuccess

Table 59. tMirrorLiUpSubSuccess properties
Property name	Value
Application name	LI
Event ID	2042
Event name	tMirrorLiUpSubSuccess
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorCupsUpNotifications.2
Default severity	warning
Message format string	LI for UP subscriber $tMirrorNotifyLiIdentifier$ intercept-id=$tMirrorNotifyLiInterceptionId$ session-id= $tMirrorNotifyLiSessionId$ is set up
Cause	Not applicable.
Effect	The system is set up to intercept traffic of a CUPS subscriber subject to Lawful Intercept.
Recovery	N/A

tMirrorLiX2Alarm

Table 60. tMirrorLiX2Alarm properties
Property name	Value
Application name	LI
Event ID	2037
Event name	tMirrorLiX2Alarm
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorNotifications.27
Default severity	minor
Message format string	INE $tMirrorLiNotifyIneIdentifier$ $tMirrorLiNotifyX2AlarmRank$ X2 alarm $tMirrorLiNotifyX2AlarmFlag$ at $tMirrorLiNotifyDateAndTime$: $tMirrorLiNotifyLongDescription$
Cause	The system sends a tMirrorLiX2Alarm notification every time it sends an 'X2Alarm' message on the X2 interface. It signals an event or a condition that affects the operation of the X1, X2 or X3 interface.
Effect	The effect depends on the alarm cause.
Recovery	Recovery, if required, depends on the alarm cause.

tMirrorLiXIfLicenseInvalid

Table 61. tMirrorLiXIfLicenseInvalid properties
Property name	Value
Application name	LI
Event ID	2040
Event name	tMirrorLiXIfLicenseInvalid
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorNotifications.30
Default severity	minor
Message format string	TCP LI license invalid; please remove x-interface configuration $tMirrorLiNotifyLongDescription$
Cause	The system sends a tMirrorLiXIfLicenseInvalid notification when x-interfaces configuration is made while the system license does not support such configuration.
Effect	The values of the objects tMirrorLiX1OperState, tMirrorLiX1OperState and tMirrorLiX1OperState remain 'outOfService'.
Recovery	Remove any X-interfaces configuration.

tMirrorSourceFilterAssignReject

Table 62. tMirrorSourceFilterAssignReject properties
Property name	Value
Application name	LI
Event ID	2022
Event name	tMirrorSourceFilterAssignReject
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorNotifications.13
Default severity	minor
Message format string	An attempt was blocked to modify a filter-assignment of a filter that is being referred by Lawful Intercept. $tMirrorSourceFilterDescr$
Cause	An operator is trying to modify a filter assignment of a filter that cannot currently be changed because the filter is being used for mirroring.
Effect	The change is disallowed
Recovery	The filter can only be replaced after LI actions are cleared.

tMirrorSourceFilterAssignWarn

Table 63. tMirrorSourceFilterAssignWarn properties
Property name	Value
Application name	LI
Event ID	2027
Event name	tMirrorSourceFilterAssignWarn
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorNotifications.16
Default severity	minor
Message format string	A filter referred to by Lawful Intercept has been assigned in a context where it may be overruled. $tMirrorSourceFilterDescr$
Cause	A filter that is being used for mirroring was assigned in a context where it maybe overruled. Filter assignments scheduled by a Time-Of-Day (TOD) Suite take precedence over statically configured filter assignments. There is currently no such overruling filter assignment scheduled, but it may be created in the future.
Effect	None, as long as no overruling filter assignment is created, and is activated.
Recovery	No recovery required. The risk can be eliminated either by creating an identical assignment in the TOD Suite, with the highest priority, or by removing the TOD Suite assignment from the SAP altogether.

tMirrorSourceFilterOverruled

Table 64. tMirrorSourceFilterOverruled properties
Property name	Value
Application name	LI
Event ID	2026
Event name	tMirrorSourceFilterOverruled
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorNotifications.15
Default severity	minor
Message format string	A filter-assignment of a filter that is being referred by Lawful Intercept was overruled. $tMirrorSourceFilterDescr$
Cause	An assignment of a filter that is being used for mirroring was overruled. Filter assignments scheduled by a Time-Of-Day (TOD) Suite take precedence over statically configured filter assignments.
Effect	If the overruling filter assignment refers to a filter that is not used for mirroring, mirror data will be lost.
Recovery	Either the overruling filter assignments can be changed to participate in the intended mirroring, or the TOD suite or the SAP configuration can be modified to prevent this situation.

tMirrorSourceIPFltrChangeReject

Table 65. tMirrorSourceIPFltrChangeReject properties
Property name	Value
Application name	LI
Event ID	2020
Event name	tMirrorSourceIPFltrChangeReject
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorNotifications.10
Default severity	minor
Message format string	An attempt was blocked to modify filter-entry $tMirrorSourceFilterEntryId$ of IP filter $tMirrorSourceFilterId$ which is being referred to by Lawful Intercept (mirror-source $tMirrorSourceIndex$)
Cause	An operator tried to modify a filter or a filter-entry of a filter that cannot currently be changed because the filter is being used for mirroring.
Effect	The change was blocked.
Recovery	Modifying the filter is only allowed when it is not being referred by any LI action.

tMirrorSourceIPv6FltrChangeRej

Table 66. tMirrorSourceIPv6FltrChangeRej properties
Property name	Value
Application name	LI
Event ID	2033
Event name	tMirrorSourceIPv6FltrChangeRej
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorNotifications.23
Default severity	minor
Message format string	An attempt was blocked to modify filter-entry $tMirrorSourceFilterEntryId$ of IPv6 filter $tMirrorSourceFilterId$ which is being referred to by Lawful Intercept (mirror-source $tMirrorSourceIndex$)
Cause	The tMirrorSourceIPv6FltrChangeRej event is generated when an operator is trying to modify a filter or a filter-entry of a filter that cannot currently be changed because the filter is being used for mirroring.
Effect	The change was blocked.
Recovery	Modifying the filter is only allowed when it is not being referred by any LI action.

tMirrorSourceLiFilterChanged

Table 67. tMirrorSourceLiFilterChanged properties
Property name	Value
Application name	LI
Event ID	2031
Event name	tMirrorSourceLiFilterChanged
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorNotifications.20
Default severity	minor
Message format string	A filter which is being referenced by Lawful Intercept has been modified. $tMirrorSourceFilterDescr$
Cause	This notification may be triggered only if LI filter lock has been overruled, and one of the following actions has been done: 1) a filter referenced by LI has been deleted. 2) one of the parameters (default-action, scope) of a filter which is referenced by LI has been changed. 3) a filter which is referenced by LI has been overwritten. 4) new entry has been created for a filter which is referenced by LI. 5) an entry of a filter which is referenced by LI has been activated. 6) an entry has been removed from a filter which is referenced by LI. 7) an entry of a filter which is referenced by LI has been renumbered. 8) one of the parameters of an entry in a filter which is referenced by LI has been changed.
Effect	Since a filter which is referenced by LI (or its parameter) has been modified, the mirrored traffic may be changed.
Recovery	N/A

tMirrorSourceLiSubProblem

Table 68. tMirrorSourceLiSubProblem properties
Property name	Value
Application name	LI
Event ID	2032
Event name	tMirrorSourceLiSubProblem
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorNotifications.21
Default severity	minor
Message format string	Traffic for Lawful Intercept mirror source $tMirrorSourceIndex$ subscriber $tMirrorSourceSubIdent$ on SAP $tMirrorNotifyLiSapEncapValue$ in service $tMirrorNotifyLiSvcId$ could not be intercepted -- $tMirrorNotifyLiDescription$
Cause	Detailed information about the exact cause of the notification is available in the object tMirrorNotifyLiDescription.
Effect	Traffic of a subscriber subject to Lawful Intercept is not intercepted.
Recovery	N/A

tMirrorSourceMacFltrChangeReject

Table 69. tMirrorSourceMacFltrChangeReject properties
Property name	Value
Application name	LI
Event ID	2021
Event name	tMirrorSourceMacFltrChangeReject
SNMP notification prefix and OID	TIMETRA-MIRROR-MIB.tMirrorNotifications.12
Default severity	minor
Message format string	An attempt was blocked to modify filter-entry $tMirrorSourceFilterEntryId$ of Mac filter $tMirrorSourceFilterId$ which is being referred to by Lawful Intercept (mirror-source $tMirrorSourceIndex$)
Cause	An operator tried to modify a filter or a filter-entry of a filter that cannot currently be changed because the filter is being used for mirroring.
Effect	The change was blocked.
Recovery	Modifying the filter is only allowed when it is not being referred by any LI action.

tmnxClear

Table 70. tmnxClear properties
Property name	Value
Application name	LI
Event ID	2300
Event name	tmnxClear
SNMP notification prefix and OID	TIMETRA-CLEAR-MIB.tmnxClearNotifications.1
Default severity	indeterminate
Message format string	Clear function $tmnxClearName$ has been run with parameters: $tmnxClearParams$. The completion result is: $tmnxClearResult$. Additional error text, if any, is: $tmnxClearErrorText$
Cause	The tmnxClear notification is generated to report the results of the clear function that was run as a result of setting tmnxClearAction to 'doAction'.
Effect	If successful, a managed object has been cleared.
Recovery	If the clear action was not successful, make sure the object to be cleared exists and the clear function parameters are correct.

tmnxConfigCreate

Table 71. tmnxConfigCreate properties
Property name	Value
Application name	LI
Event ID	2207
Event name	tmnxConfigCreate
SNMP notification prefix and OID	TIMETRA-SYSTEM-MIB.tmnxSysNotifications.9
Default severity	warning
Message format string	$tmnxNotifyObjectName$ managed object created
Cause	A tmnxConfigCreate notification is generated when a new row entry is created in one of the MIB tables. It can be used by the NMS to trigger maintenance polls of the configuration information.
Effect	N/A
Recovery	No recovery is necessary.

tmnxConfigDelete

Table 72. tmnxConfigDelete properties
Property name	Value
Application name	LI
Event ID	2208
Event name	tmnxConfigDelete
SNMP notification prefix and OID	TIMETRA-SYSTEM-MIB.tmnxSysNotifications.10
Default severity	warning
Message format string	$tmnxNotifyObjectName$ managed object deleted
Cause	A tmnxConfigDelete notification is generated when an existing row entry in one of the MIB tables is deleted. It can be used by the NMS to trigger maintenance polls of the configuration information.
Effect	N/A
Recovery	No recovery is necessary.

tmnxConfigModify

Table 73. tmnxConfigModify properties
Property name	Value
Application name	LI
Event ID	2206
Event name	tmnxConfigModify
SNMP notification prefix and OID	TIMETRA-SYSTEM-MIB.tmnxSysNotifications.8
Default severity	warning
Message format string	$tmnxNotifyObjectName$ configuration modified
Cause	A tmnxConfigModify notification is generated when a configuration attribute associated with a row entry in a MIB table is modified. It can be used by the NMS to trigger maintenance polls of the configuration information.
Effect	N/A
Recovery	No recovery is necessary.

tmnxStateChange

Table 74. tmnxStateChange properties
Property name	Value
Application name	LI
Event ID	2209
Event name	tmnxStateChange
SNMP notification prefix and OID	TIMETRA-SYSTEM-MIB.tmnxSysNotifications.11
Default severity	warning
Message format string	Status of $tmnxNotifyObjectName$ changed administrative state: $tmnxNotifyRowAdminState$, operational state: $tmnxNotifyRowOperState$
Cause	A tmnxStateChange notification is generated when there is a change in either the administrative or operational state of a MIB table entry.
Effect	N/A
Recovery	No recovery is necessary.

August 3, 2023