Network devices (SNMP)

An SNMP rule names an address range. An agent scans the range for devices that answer SNMP, then polls the ones that do, and writes what it reads to infrastructure_monitoring_metrics. Create rules on Data Collection → SNMP Rules.

---

How a rule runs

1. One agent runs it. A new rule is distributed with Set a replica count, 1 agent, with failover to another agent with the same tag. With All agents, every agent with the tag would poll every device and store every point once per agent.
2. It finds the devices. The agent sends one SNMP GET (for sysObjectID) to each address in the range, with the rule’s version and credentials. A device that answers is polled; one that does not answer, or that rejects the community or user, is left out. The range is scanned again every 10 minutes, so devices that come and go are picked up.
3. It polls them. Every probe frequency (5 minutes by default) the agent reads the rule’s metrics from each device it found.

The address range is one or more CIDRs or single addresses, separated by commas (10.20.0.0/24, 10.20.1.5). One rule covers at most 4,096 addresses; split a larger network into several rules. In an IPv4 range of /30 or wider, the network and broadcast addresses are not scanned.

Versions and credentials

• v1 and v2c: a community string.
• v3: a security name, a security level (noAuthNoPriv, authNoPriv, authPriv), an authentication protocol (MD5, SHA, SHA-224/256/384/512) and password, and a privacy protocol (DES, AES, AES-192/256) and password.

The community and the v3 passwords are write-only: once saved, the rule reads back with them hidden, in the SNMP Rules page and in every other place that shows the rule. Editing a rule without retyping them keeps the stored ones.

What is collected

Unless you change Metric configuration, a rule polls what every switch and router exposes:

measurement	fields	tags
snmp	snmp_sysUpTime	agent_host (the device’s address), sysName
interface	interface_ifOperStatus, interface_ifHighSpeed, interface_ifHCInOctets, interface_ifHCOutOctets, interface_ifInErrors, interface_ifOutErrors, interface_ifInDiscards, interface_ifOutDiscards	agent_host, sysName, ifName

Every point has origin=snmp_ntel. host is the agent that polled, not the device: find a device by sysName or agent_host.

search2 repo="infrastructure_monitoring_metrics" origin="snmp_ntel" name="interface"
| stats max(interface_ifHCInOctets) as in_octets by sysName, ifName

The metric configuration is YAML in the form of Telegraf’s snmp input: a field list of single values and a table list of tables, each entry an oid and a name, with is_tag: true for a value that labels the others. A rule must define at least one field or table.

field:
  - oid: ".1.3.6.1.2.1.1.5.0"
    name: "sysName"
    is_tag: true
table:
  - name: "interface"
    inherit_tags: ["sysName"]
    field:
      - oid: ".1.3.6.1.2.1.31.1.1.1.1"
        name: "ifName"
        is_tag: true
      - oid: ".1.3.6.1.2.1.31.1.1.1.6"
        name: "ifHCInOctets"

Write OIDs as numbers, each with a name. A numeric OID with a name needs no MIB files on the agent. A textual OID (IF-MIB::ifName) has to be translated, which needs the net-snmp tools installed on the agent’s host.

When nothing arrives

• The agent’s log says snmp: no device in <range> answered on port <port>: no address answered the scan. Check that the agent can reach the devices on UDP 161 (or the rule’s port), and the community or v3 user.
• A rule is refused at save: it names no address, more than 4,096 addresses, an address that is not one, no metric, or v3 with no security name.
• snmp: polling N device(s) in <range> every <interval>: <addresses> in the agent’s log lists exactly which devices it found.