SNMPD

If you like this project, consider supporting me on Buy Me a Coffee ☕️

tags:

• monitoring
• sysadmin

• linux

  SNMPD (Net-SNMP Agent) Sysadmin Cheatsheet

SNMPD (Net-SNMP Agent) is the SNMP daemon from the Net-SNMP suite. SNMP (Simple Network Management Protocol) was first defined in RFC 1157 (1990) and has been a foundational protocol for network monitoring ever since. The snmpd agent exposes system metrics via a standardized MIB tree, allowing remote monitoring by NMS platforms.

Common use cases / Типичные сценарии: Network device monitoring (routers, switches, firewalls), server system metrics collection (CPU, memory, disk, interfaces), integration with NMS platforms (Zabbix, Nagios, LibreNMS, Checkmk, Cacti), hardware monitoring (IPMI via SNMP), printer/UPS monitoring.

Status / Статус: SNMP is a mature, well-established standard. Net-SNMP is actively maintained. While SNMP remains essential for network devices, modern server monitoring often uses agent-based solutions (Zabbix Agent, node_exporter, Telegraf) for richer metrics. SNMP is still the primary protocol for monitoring network infrastructure.

Default ports / Порты по умолчанию: 161/udp (agent queries), 162/udp (trap receiver)

📚 Table of Contents

• 1. Installation & Configuration
• 2. Core Management
• 3. Sysadmin Operations
• 4. Security
• 5. Troubleshooting & Tools
• 6. Logrotate Configuration
• Documentation Links

1. Installation & Configuration

Install SNMPD

# RHEL/CentOS/AlmaLinux
dnf install net-snmp net-snmp-utils net-snmp-libs

# Debian/Ubuntu
apt install snmpd snmp libsnmp-dev snmp-mibs-downloader

# openSUSE
zypper install net-snmp

Main Configuration

/etc/snmp/snmpd.conf

# System information
sysLocation    "Server Room, <LOCATION>"
sysContact     "<USER> <[email protected]>"
sysName        <HOST>

# SNMPv2c community string (read-only)
rocommunity  <COMMUNITY_STRING>  <ALLOWED_NETWORK>/24
# Example: rocommunity public 10.0.0.0/24

# SNMPv2c community string (read-write)
# rwcommunity <COMMUNITY_STRING> <ALLOWED_NETWORK>/24

# Listen address
agentAddress  udp:<IP>:161,udp6:[::1]:161

# Disk monitoring
disk / 10%
disk /var 10%
disk /tmp 10%

# Load average thresholds
load 12 10 5

# Process monitoring
proc sshd
proc nginx
proc mysqld

# Extend with custom script
extend custom_metric /usr/local/bin/custom_snmp_check.sh

SNMP Protocol Versions Comparison

[!WARNING] SNMPv1/v2c community strings are sent in plaintext. Always use SNMPv3 in production environments. / Строки сообщества SNMPv1/v2c передаются в открытом виде. Всегда используйте SNMPv3 в продакшн.

SNMPv3 User Setup

# Stop the agent first
systemctl stop snmpd

# Create SNMPv3 user
net-snmp-create-v3-user -ro -a SHA -A <AUTH_PASSWORD> -x AES -X <PRIV_PASSWORD> <USER>

# Start the agent
systemctl start snmpd

/etc/snmp/snmpd.conf (SNMPv3 config):

# SNMPv3 read-only user
rouser <USER> priv

2. Core Management

SNMP Query Commands

# Walk entire OID tree (SNMPv2c)
snmpwalk -v2c -c <COMMUNITY_STRING> <HOST> .1

# Get specific OID
snmpget -v2c -c <COMMUNITY_STRING> <HOST> sysDescr.0

# Walk system subtree
snmpwalk -v2c -c <COMMUNITY_STRING> <HOST> system

# Walk interfaces
snmpwalk -v2c -c <COMMUNITY_STRING> <HOST> ifDescr

# Get uptime
snmpget -v2c -c <COMMUNITY_STRING> <HOST> sysUpTime.0

# Walk disk usage
snmpwalk -v2c -c <COMMUNITY_STRING> <HOST> hrStorageDescr
snmpwalk -v2c -c <COMMUNITY_STRING> <HOST> hrStorageUsed

# Walk CPU load
snmpwalk -v2c -c <COMMUNITY_STRING> <HOST> laLoad

# SNMPv3 query
snmpwalk -v3 -u <USER> -l authPriv -a SHA -A <AUTH_PASSWORD> -x AES -X <PRIV_PASSWORD> <HOST> system

Common OIDs

3. Sysadmin Operations

Service Management

systemctl start snmpd      # Start / Запустить
systemctl stop snmpd       # Stop / Остановить
systemctl restart snmpd    # Restart / Перезапустить
systemctl enable snmpd     # Enable on boot / Автозапуск
systemctl status snmpd     # Check status / Проверить статус

SNMP Trap Receiver

# Install and enable trap daemon
systemctl enable --now snmptrapd

/etc/snmp/snmptrapd.conf

# Accept traps from community
authCommunity log,execute,net <COMMUNITY_STRING>

# Log traps to file
[snmptrapd]
doNotLogTraps no

Important Paths

Firewall Configuration

# Allow SNMP agent
firewall-cmd --permanent --add-port=161/udp   # SNMP queries / Запросы SNMP
firewall-cmd --permanent --add-port=162/udp   # SNMP traps / Трапы SNMP
firewall-cmd --reload

Custom Extensions

# Example: custom script extension
cat > /usr/local/bin/snmp_custom_check.sh << 'EOF'
#!/bin/bash
# Returns number of active connections
ss -tn state established | wc -l
EOF
chmod +x /usr/local/bin/snmp_custom_check.sh

Add to /etc/snmp/snmpd.conf:

extend active_connections /usr/local/bin/snmp_custom_check.sh

# Query the custom extension
snmpwalk -v2c -c <COMMUNITY_STRING> <HOST> NET-SNMP-EXTEND-MIB::nsExtendOutputFull

4. Security

Restrict Access

/etc/snmp/snmpd.conf

# Restrict to specific networks only
rocommunity <COMMUNITY_STRING> 10.0.0.0/24
rocommunity <COMMUNITY_STRING> 192.168.1.0/24

# Restrict OID view
view systemonly included .1.3.6.1.2.1.1
view systemonly included .1.3.6.1.2.1.25.1
rocommunity <COMMUNITY_STRING> default -V systemonly

[!TIP] Always change default community strings from public/private. Use SNMPv3 with authPriv for encrypted monitoring. / Всегда меняйте стандартные community strings. Используйте SNMPv3 с authPriv для шифрованного мониторинга.

5. Troubleshooting & Tools

Common Issues

1. Agent Not Responding

# Check if snmpd is running
systemctl status snmpd
ss -ulnp | grep 161

# Test locally
snmpwalk -v2c -c <COMMUNITY_STRING> localhost system

# Check config syntax
snmpd -C -c /etc/snmp/snmpd.conf -Le  # Check for errors / Проверить ошибки

2. Timeout

# Check firewall
firewall-cmd --list-all | grep 161

# Check bind address
grep agentAddress /etc/snmp/snmpd.conf

# Check from remote
snmpwalk -v2c -c <COMMUNITY_STRING> -t 10 <HOST> sysDescr.0

Debug Mode

# Run snmpd in foreground with debug
systemctl stop snmpd
snmpd -f -Le -Dread_config,snmp_agent  # Debug specific subsystems / Отладка конкретных подсистем

# Debug specific query
snmpwalk -v2c -c <COMMUNITY_STRING> -d <HOST> sysDescr.0

6. Logrotate Configuration

/etc/logrotate.d/snmpd

/var/log/snmpd.log {
    weekly
    rotate 8
    compress
    delaycompress
    missingok
    notifempty
    create 640 root root
    postrotate
        systemctl kill --signal=HUP snmpd 2>/dev/null || true
    endscript
}

/var/log/snmptrapd.log {
    weekly
    rotate 8
    compress
    delaycompress
    missingok
    notifempty
    create 640 root root
}

Documentation Links

• Net-SNMP Official Site: http://www.net-snmp.org/
• Net-SNMP Documentation: http://www.net-snmp.org/docs/man/
• SNMPv3 Configuration: http://www.net-snmp.org/wiki/index.php/TUT:snmpv3
• snmpd.conf Manual: http://www.net-snmp.org/docs/man/snmpd.conf.html
• OID Repository: http://www.oid-info.com/
• GitHub: https://github.com/net-snmp/net-snmp