SNMP devices

Plugin: go.d.plugin Module: snmp

Overview

This collector discovers and monitors any SNMP-enabled network device.

• Built-in vendor profiles: Netdata ships with a large library of profiles for major vendors, enabling automatic, out-of-the-box monitoring—no manual OID configuration needed for common hardware.
• Custom profiles supported: Users can extend or override stock profiles to add new devices, modify charts, or collect additional OIDs.
• Automatic vendor/model detection: Devices are matched to the right profile using selectors such as sysObjectID and sysDescr.
• ICMP ping: Optional round-trip latency monitoring alongside SNMP, with a ping_only mode available.
• SNMP v1, v2c, and v3 support: Fully implemented via the gosnmp library.
• Shared device-level licensing metrics for supported profiles: When a profile exposes license telemetry, Netdata emits compact per-device licensing charts for earliest expiry, license-state counts (healthy, informational, degraded, broken, ignored), and highest usage pressure. Supported profile coverage includes Check Point licensing state and per-blade expiry, Fortinet FortiGate contract/service/account expirations, Cisco traditional licensing end-date/remaining-time/state/usage telemetry, Cisco Smart Licensing authorization, certificate, evaluation, and state telemetry, Sophos Firewall subscription state and per-license expiry telemetry, Blue Coat ProxySG application/feature/component expiry, expire-type, and state telemetry, and basic MikroTik RouterOS upgrade-entitlement telemetry. For MikroTik, epoch-like placeholder mtxrLicUpgrUntil values are ignored instead of treated as real expired licenses.
• Interactive licensing drill-down: The snmp:licenses function follows the existing SNMP function pattern and shows normalized licensing rows for the selected SNMP job/device using cached collector data.

Built-in profiles for major vendors:

This table highlights common vendors—the full library includes many more.

SNMP BGP monitoring

Netdata ships BGP monitoring profiles for generic BGP4-MIB devices and vendor MIBs including Cisco, Juniper, Nokia SR OS, Huawei, Arista, and Dell.

The operator-facing BGP charts are normalized under:

• snmp.bgp.peers.*
• snmp.bgp.peer_families.*
• snmp.bgp.devices.peer_counts
• snmp.bgp.devices.peer_states

Rich per-peer diagnostics such as previous state, last error, graceful-restart state, and vendor unavailability reasons are exposed through the Live function snmp:bgp-peers instead of being charted as regular time-series.

This SNMP BGP surface is designed for:

• peer/session availability and FSM state
• established uptime
• BGP UPDATE and message traffic
• route-count monitoring where the vendor MIB exposes truthful counts
• stock alerts for peer down, update churn, transition anomalies, and accepted-prefix drift

Important limits

• Standard BGP4-MIB gives peer health and message counters, but not full route-count coverage.
• Some route counters are current gauges, while others are cumulative totals. Netdata keeps them separate instead of flattening unlike semantics into one fake chart.
• Huawei contributes to device-level peer/session counts, but not device-level peer state counts in this SNMP batch.
• SNMP does not provide live per-route inventory. If you need “all routes to and from a peer in real time”, that belongs to BMP, not this integration page.

:::info

See: SNMP Profile Format to learn how to write your own or extend stock ones.

:::

Profile locations

Depending on installation, paths may be prefixed with /opt/netdata.

A profile defines:

• Device selectors for auto-matching (e.g. sysObjectID, sysDescr)
• The exact OIDs to collect (scalars and tables)
• How to label table rows (metric tags)
• Chart/metric metadata (units, families, types), including optional virtual metrics

At runtime, the collector:

1. Reads standard system OIDs (e.g. sysObjectID, sysDescr) to identify the device
2. Picks the best matching vendor/model profile(s)
3. Collects exactly the metrics those profiles define

This collector is supported on all platforms.

This collector supports collecting metrics from multiple instances of this integration, including remote instances.

Default Behavior

Auto-Detection

SNMP service discovery can automatically scan configured networks and feed the SNMP collector with discovered devices.

• Disabled by default; enable and configure explicitly.
• Supports single IPs, ranges, and CIDR blocks (up to 512 IPs per subnet).
• Uses the provided SNMP credentials (v1/v2c/v3) to probe devices.
• Caches discovery results (configurable) to reduce network load.
• At collection time, each discovered device is matched to the appropriate profile based on its sysObjectID, sysDescr, and the profile’s selector rules.

The configuration file name is go.d/sd/snmp.conf.

You can edit the configuration file using the edit-config script from the Netdata config directory.

cd /etc/netdata 2>/dev/null || cd /opt/netdata/etc/netdata
sudo ./edit-config go.d/sd/snmp.conf

Limits

The default configuration for this integration does not impose any limits on data collection.

Performance Impact

Device constraints: Many SNMP devices (e.g., access switches) have limited CPU/ASIC time for management. If you see timeouts or gaps, reduce update_every or max_repetitions, or stagger polling across devices.

Concurrent polling: Parallel access by multiple tools may cause missed counters on some devices. Increase the collection interval (update_every) to reduce request pressure.

Setup

You can configure the snmp collector in two ways:

:::important

UI configuration requires paid Netdata Cloud plan.

:::

Prerequisites

Prepare the SNMP device

Before configuring the collector:

• Enable the SNMP service on the target device (via its management interface).
• Ensure the device is reachable from the Netdata node on UDP/161.
• Gather connection details: IP/DNS, SNMP version, and either a community (v1/v2c) or v3 credentials (user, auth/priv).

Configuration

Options

The following options can be defined globally: update_every, autodetection_retry.

<a id="option-snmpv3-user-level"></a>

user.level

The security of an SNMPv3 message as per RFC 3414 (user.level):

<a id="option-snmpv3-user-auth-proto"></a>

user.auth_proto

The digest algorithm for SNMPv3 messages that require authentication (user.auth_proto):

<a id="option-snmpv3-user-priv-proto"></a>

user.priv_proto

The encryption algorithm for SNMPv3 messages that require privacy (user.priv_proto):

via UI

Configure the snmp collector from the Netdata web interface:

1. Go to Nodes.
2. Select the node where you want the snmp data-collection job to run and click the :gear: (Configure this node). That node will run the data collection.
3. The Collectors → Jobs view opens by default.
4. In the Search box, type snmp (or scroll the list) to locate the snmp collector.
5. Click the + next to the snmp collector to add a new job.
6. Fill in the job fields, then click Test to verify the configuration and Submit to save.
   • Test runs the job with the provided settings and shows whether data can be collected.
   • If it fails, an error message appears with details (for example, connection refused, timeout, or command execution errors), so you can adjust and retest.

via File

The configuration file name for this integration is go.d/snmp.conf.

The file format is YAML. Generally, the structure is:

update_every: 1
autodetection_retry: 0
jobs:
  - name: some_name1
  - name: some_name2

You can edit the configuration file using the edit-config script from the Netdata config directory.

cd /etc/netdata 2>/dev/null || cd /opt/netdata/etc/netdata
sudo ./edit-config go.d/snmp.conf

Examples

SNMPv1/2

In this example:

• the SNMP device is 192.0.2.1.
• the SNMP version is 2.
• the SNMP community is public.
• we will update the values every 10 seconds.

Profiles are auto-selected at runtime

jobs:
  - name: switch
    update_every: 10
    hostname: 192.0.2.1
    community: public
    options:
      version: 2

SNMPv3

To use SNMPv3:

• use user instead of community.
• set options.version to 3.

jobs:
  - name: switch
    update_every: 10
    hostname: 192.0.2.1
    options:
      version: 3
    user:
      name: username
      level: authPriv
      auth_proto: sha256
      auth_key: auth_protocol_passphrase
      priv_proto: aes256
      priv_key: priv_protocol_passphrase

SNMPv3 with multiple devices

This example monitors multiple SNMP devices that share the same SNMPv3 credentials.

It uses YAML anchors to define the full job once (&snmp_v3_job) and then reuse it with <<: *snmp_v3_job, overriding only name and hostname for each additional device.

jobs:
  - &snmp_v3_job
    name: switch1
    update_every: 10
    hostname: 192.0.2.1
    options:
      version: 3
    user:
      name: username
      level: authPriv
      auth_proto: sha256
      auth_key: auth_protocol_passphrase
      priv_proto: aes256
      priv_key: priv_protocol_passphrase

  - <<: *snmp_v3_job
    name: switch2
    hostname: 192.0.2.2

  - <<: *snmp_v3_job
    name: switch3
    hostname: 192.0.2.3

BGP router with forced profile

Use manual_profiles when auto-detection cannot safely distinguish the device, or when you want to force a specific vendor BGP profile during testing.

This example targets a Cisco ASR router and keeps the optional ICMP latency charts enabled.

jobs:
  - name: edge-router
    update_every: 10
    hostname: 192.0.2.10
    community: public
    manual_profiles:
      - cisco-asr
    options:
      version: 2

Additional node labels

Because create_vnode defaults to true, each SNMP job automatically creates a Virtual Node for its device — no separate vnode definition file is needed. Use vnode.labels to attach your own labels, for example to group devices by site or rack. These are merged with the labels SNMP detects automatically from the device (such as vendor and sys_object_id). If a key you set matches an auto-detected label, your value takes precedence.

jobs:
  - name: core-switch
    update_every: 10
    hostname: 192.0.2.20
    community: public
    options:
      version: 2
    vnode:
      labels:
        site: dc1
        rack: a12

Alerts

The following alerts are available:

Metrics

Metrics grouped by scope.

The scope defines the instance that the metric belongs to. An instance is uniquely identified by a set of labels.

Metrics and charts are defined by the matched SNMP profile(s) at runtime. They differ by vendor/model/OS and may include, for example, interface counters, optics, CPU/memory, temperature, VLANs, and more. Use the Metrics tab on the device’s dashboard to see exactly what is collected for that device.

Supported licensing profiles also emit a small set of shared device-level licensing contexts:

• snmp.license.remaining_time: earliest remaining time to expiry across monitored licenses and subscriptions on the device
• snmp.license.authorization_remaining_time: earliest remaining time for license authorization timers
• snmp.license.certificate_remaining_time: earliest remaining time for licensing certificate timers
• snmp.license.grace_remaining_time: earliest remaining time for grace or evaluation timers
• snmp.license.usage_percent: highest license pool pressure across finite usage pools on the device
• snmp.license.state: count of licensing rows on the device by normalized state bucket (healthy, informational, degraded, broken, ignored)

The licensing charts are intentionally aggregated to keep one clean device view:

• Netdata reports the earliest expiry-related deadline on the device.
• Netdata reports how many licensing rows are healthy, informational, degraded, broken, and ignored on the device.
• Netdata reports the highest usage pressure across finite license pools on the device.

Licensing support is intentionally conditional:

• licensing charts appear only for devices whose matched SNMP profile exposes licensing telemetry
• not every supported device exposes all licensing dimensions
• remaining_time and related time charts appear only when the device exposes expiry-like timers
• usage_percent appears only when the device exposes finite usage and capacity data
• snmp.license.state appears only when the device exposes enough state/compliance/validity data to normalize rows

Default alerts from src/health/health.d/snmp.conf use 30d/7d for expiry-related timers, 7d/0d for grace timers, and 80/95 for usage pressure. You can override them like any other Netdata health configuration.

:::tip

To understand the structure of these profiles (metrics, tags, virtual metrics, etc.), see SNMP Profile Format.

:::

If ping.enabled is true, ICMP latency/packet-loss charts are also provided (or exclusively, when ping_only: true).

For BGP-capable profiles, the public chart contract is:

• snmp.bgp.peers.* for one BGP peer/session per chart instance
• snmp.bgp.peer_families.* for one peer plus AFI/SAFI per chart instance
• snmp.bgp.devices.peer_counts for device-level peer/session counts
• snmp.bgp.devices.peer_states for device-level peer-state summaries where the source MIB exposes canonical peer rows
• Rich peer diagnostics live in the Live function snmp:bgp-peers, not in charted time-series

BGP capability notes

Interpretation guidance

• route_counts.current contains current gauges such as received, accepted, advertised, active, suppressed, or withdrawn prefixes when the vendor MIB exposes them.
• route_totals contains cumulative counters where the vendor MIB only exposes totals.
• When the source model is peer-family scoped, alerts and chart labels include AFI/SAFI so operators can distinguish otherwise similar peers.

Per device licensing

Shared device-level licensing health metrics emitted when the matched SNMP profile provides licensing telemetry. Supported profile coverage includes Check Point licensing state and per-blade expiry, Fortinet FortiGate contract/service/account expirations, Cisco traditional licensing end-date/remaining-time/state/usage telemetry, Cisco Smart Licensing authorization, certificate, evaluation, and state telemetry, Sophos Firewall subscription state and per-license expiry telemetry, Blue Coat ProxySG application/feature/component expiry, expire-type, and state telemetry, and basic MikroTik RouterOS upgrade-entitlement telemetry. MikroTik support is intentionally limited to the RouterOS upgrade-entitlement fields exposed by SNMP, and epoch-like placeholder mtxrLicUpgrUntil values are ignored.

Labels:

Metrics:

Live Data

This collector exposes real-time functions for interactive troubleshooting in the Live tab.

Network Interfaces

Provides detailed network interface traffic and status metrics from SNMP-enabled devices.

This function queries cached SNMP interface data collected during regular polling cycles and presents it in a sortable, filterable table. Each row represents a network interface on the monitored SNMP device, with comprehensive metrics for traffic analysis, error monitoring, and operational status tracking.

Use cases:

• Identify top bandwidth-consuming interfaces on routers, switches, and access points
• Monitor interface operational and administrative status for network health
• Investigate packet errors, discards, and unusual traffic patterns

Data is sourced from the IF-MIB (RFC 2863) interface counters and is cached from the last successful SNMP collection. No additional SNMP requests are triggered when calling this function.

Prerequisites

No additional configuration is required.

Parameters

Returns

Network interface metrics from cached SNMP data, including traffic rates, packet statistics, operational status, and error counters. Each row represents one physical or virtual interface.

BGP Peers

Provides detailed current BGP peer and peer-family state from cached SNMP data.

This function uses the normalized BGP surface produced during regular SNMP polling and presents it as a sortable, filterable troubleshooting table. It is designed for details that are useful operationally but should not be charted as regular time-series, such as previous state, last error, last down reason, graceful restart state, and vendor-specific unavailability reasons.

Use cases:

• Identify exactly which peer or peer-family is unhealthy right now
• See the most recent BGP NOTIFICATION error as human-readable text
• Inspect peer identity, AFI/SAFI scope, prefix gauges, and current troubleshooting context in one view

Data is sourced from the last successful SNMP collection cycle. No additional SNMP requests are triggered when calling this function.

Prerequisites

No additional configuration is required.

Parameters

Returns

Current BGP peer and peer-family details from cached normalized SNMP data. Each row represents either one peer or one peer plus AFI/SAFI, depending on the selected view. Additional hidden columns provide raw codes, message totals, and threshold fields for deeper inspection in the UI.

Network Topology

Provides the agent-wide SNMP topology view built from all currently running topology-enabled SNMP jobs.

This function reads cached LLDP/CDP, bridge, FDB, ARP, and STP data collected by the independent topology refresh loop and returns a netdata.topology.v1 payload with compact actor, link, evidence, and detail tables. No additional SNMP requests are triggered when calling this function.

Use cases:

• Discover Layer 2 neighbors and link mapping
• Validate cabling and port connections
• Identify adjacent devices that are discovered but not monitored

Prerequisites

No additional configuration is required.

Parameters

Returns

Agent-wide SNMP topology data using the netdata.topology.v1 schema, suitable for cross-agent aggregation.

Licenses

Provides normalized licensing rows for the selected SNMP device.

This function reads the collector's cached licensing rows and shows one row per normalized license entry. It is the drill-down view behind the device-level licensing charts: expiry timers, authorization/certificate/grace timers, usage/capacity, raw vendor state, normalized state bucket, and operational impact.

It follows the same pattern as the SNMP interfaces function:

• the function itself is global for the SNMP collector
• the Live tab targets the selected SNMP job/device automatically using the standard SNMP function context
• the returned rows belong only to that selected device

Use cases:

• See which exact license rows make the device show degraded or broken counts
• Inspect expiry and grace timers for subscriptions, support, and smart-licensing signals
• Review usage/capacity for finite license pools on the selected device

Data is sourced from the last successful SNMP collection. No extra SNMP requests are triggered when calling this function.

Prerequisites

No additional configuration is required.

Parameters

This function has no parameters.

Returns

Normalized licensing rows for the selected SNMP device. Each row represents one cached normalized licensing entry from the collector.

Troubleshooting

Debug Mode

Important: Debug mode is not supported for data collection jobs created via the UI using the Dyncfg feature.

To troubleshoot issues with the snmp collector, run the go.d.plugin with the debug option enabled. The output should give you clues as to why the collector isn't working.

• Navigate to the plugins.d directory, usually at /usr/libexec/netdata/plugins.d/. If that's not the case on your system, open netdata.conf and look for the plugins setting under [directories].

  bashCopy

  cd /usr/libexec/netdata/plugins.d/
  

• Switch to the netdata user.

  bashCopy

  sudo -u netdata -s
  

• Run the go.d.plugin to debug the collector:

  bashCopy

  ./go.d.plugin -d -m snmp
  

  To debug a specific job:

  bashCopy

  ./go.d.plugin -d -m snmp -j jobName
  

Getting Logs

If you're encountering problems with the snmp collector, follow these steps to retrieve logs and identify potential issues:

• Run the command specific to your system (systemd, non-systemd, or Docker container).
• Examine the output for any warnings or error messages that might indicate issues. These messages should provide clues about the root cause of the problem.

System with systemd

Use the following command to view logs generated since the last Netdata service restart:

journalctl _SYSTEMD_INVOCATION_ID="$(systemctl show --value --property=InvocationID netdata)" --namespace=netdata --grep snmp

System without systemd

Locate the collector log file, typically at /var/log/netdata/collector.log, and use grep to filter for collector's name:

grep snmp /var/log/netdata/collector.log

Note: This method shows logs from all restarts. Focus on the latest entries for troubleshooting current issues.

Docker Container

If your Netdata runs in a Docker container named "netdata" (replace if different), use this command:

docker logs netdata 2>&1 | grep snmp

Debugging Gaps on Charts

If your SNMP charts show gaps, it means the collector could not finish metric collection before the next scheduled run. This usually happens when SNMP tables take longer to collect than your configured update_every.

These gaps do not mean the device stopped exporting SNMP metrics — only that the collector had to skip cycles.

Step 1: Check the Logs

Look for messages like:

level=warn msg="skipping data collection: previous run is still in progress for 4s (skipped 4 times in a row, interval 1s)" collector=snmp job=your_device
level=info msg="data collection resumed after 4.36s (skipped 4 times)" collector=snmp job=your_device

The “resumed after” message shows how long the previous collection actually took.
For example, if a run needs ~4.4 seconds and update_every is 1 second, 4 cycles will be skipped.

Step 2: Check Collection Timings

Open SNMP → Internal → Stats in the dashboard.
The SNMP profile collection timings chart shows how long each part of the SNMP polling takes.
Table metrics are usually the slowest and often determine the total collection time.

Step 3: Increase the data collection interval

Set update_every to a value higher than your slowest collection time, with some extra buffer for network variability.

:::info

• Rule of thumb: update_every should be at least 2× your slowest table collection time.
• The default update_every: 10 works well in most environments.
• Only reduce it if your device consistently responds fast enough.

:::

Quick Checklist

1. Do logs show “skipping data collection”?
2. Does Internal → Stats show collection time > update_every?
3. Increase update_every until skips disappear.