SNMP Datasets
SNMP datasets define what an SNMP device reads from its agent (dataset type snmp). They attach to devices of type snmp only, and in
Collector Types
Each dataset type has its own definition id, which every record it writes carries. Its kind decides the default interval: an inventory is read every 3,600 seconds, and a metric or a custom OID table every 60.
| Dataset (console title) | Definition | Definition id | Kind |
|---|---|---|---|
| SNMP System | snmp_system_collector | 300 | inventory |
| SNMP Interfaces | snmp_interface_collector | 301 | inventory |
| SNMP Interface Traffic | snmp_interface_stats_collector | 302 | metric |
| SNMP Interface Totals | snmp_interface_totals_collector | 303 | metric |
| SNMP CPU | snmp_cpu_collector | 304 | metric |
| SNMP Memory | snmp_memory_collector | 305 | metric |
| SNMP Fans | snmp_fan_collector | 306 | metric |
| SNMP Power Supplies | snmp_power_supply_collector | 307 | metric |
| SNMP TCP/IP | snmp_tcpip_collector | 308 | metric |
| SNMP VLANs | snmp_vlan_collector | 309 | inventory |
| SNMP Hardware Inventory | snmp_entity_collector | 310 | inventory |
| SNMP Neighbors | snmp_neighbor_collector | 311 | inventory |
| F5 Virtual Servers | snmp_f5_virtual_server_collector | 320 | inventory |
| F5 Virtual Server Statistics | snmp_f5_virtual_server_stats_collector | 321 | metric |
| F5 Pools | snmp_f5_pool_collector | 322 | inventory |
| F5 Pool Statistics | snmp_f5_pool_stats_collector | 323 | metric |
| F5 Pool Members | snmp_f5_pool_member_collector | 324 | inventory |
| F5 Pool Member Statistics | snmp_f5_pool_member_stats_collector | 325 | metric |
| F5 Nodes | snmp_f5_node_collector | 326 | inventory |
| FortiGate HA Nodes | snmp_fortigate_ha_node_collector | 330 | inventory |
| FortiGate HA Node Statistics | snmp_fortigate_ha_node_stats_collector | 331 | metric |
| FortiGate VPN Tunnels | snmp_fortigate_vpn_tunnel_collector | 332 | inventory |
| FortiGate VPN Tunnel Statistics | snmp_fortigate_vpn_tunnel_stats_collector | 333 | metric |
| FortiGate SSL VPN Tunnels | snmp_fortigate_sslvpn_tunnel_collector | 334 | inventory |
| FortiGate SSL VPN Tunnel Statistics | snmp_fortigate_sslvpn_tunnel_stats_collector | 335 | metric |
| FortiGate VDOM Statistics | snmp_fortigate_vdom_stats_collector | 336 | metric |
| FortiGate Users | snmp_fortigate_user_collector | 337 | inventory |
| FortiGate Interface Bandwidth | snmp_fortigate_interface_bandwidth_collector | 338 | inventory |
| Cisco IKE Tunnels | snmp_cisco_ike_tunnel_collector | 340 | inventory |
| Cisco IKE Tunnel Statistics | snmp_cisco_ike_tunnel_stats_collector | 341 | metric |
| Cisco Wireless Access Points | snmp_cisco_wireless_ap_collector | 342 | inventory |
| Cisco Wireless Access Point Statistics | snmp_cisco_wireless_ap_stats_collector | 343 | metric |
| SNMP Custom OIDs | snmp_custom_oid_collector | 852 | custom |
Every dataset takes these properties:
| Field | Required | Type | Default | Description |
|---|---|---|---|---|
interval | N | int | per kind | Seconds between readings. At least 10. |
pipeline_name | N | string | the device's | The preprocessing pipeline the dataset's records enter. |
Wizard fields
Every SNMP dataset's 10. SNMP Custom OIDs asks for more; see Custom OIDs.
Rules
- One of each. A dataset type is read once per device, however many datasets of it are assigned. The first decides its interval; the others are left out with a warning in the device's log. Custom OID datasets are the exception: each is a table of its own.
- Pipelines. A dataset's records enter the pipeline the dataset selects, otherwise the device's. Two datasets on one device can reach two pipelines.
- Manufacturer tables assigned to a device of another manufacturer are logged once and are not an error.
- Inventory records carry
event.actionfrom the dataset's second reading on:added,changed,unchanged, orremoved. - Metric records of counters report the increase since the dataset's previous reading, so the first reading after a start reports none.
Standard Datasets
Every record carries the fields the SNMP device page lists under observer.*, with event.dataset set to snmp.<dataset>. The fields of each dataset are:
| Dataset | Fields |
|---|---|
system | snmp.system.description, object_id, contact, location, services, device_class, profile, identified_by (object_id, description, or manual), uptime (seconds), boot_time. A reboot is an event with event.action: reboot. |
interface | snmp.interface.index, name, description, alias, type, type_name, mtu, speed (b/s), mac, admin_status, oper_status, last_change, ip |
interface_stats | snmp.interface.index, name, alias, admin_status, oper_status, speed; in.* and out.*: bytes, bits_per_sec, utilization.pct, packets, packets_per_sec, errors, discards; snmp.interval (seconds). A link change is an event, event.action: interface-down or interface-up, with previous_status. |
interface_totals | snmp.interfaces.count, up, down (enabled but down), admin_down, in.bits_per_sec, out.bits_per_sec, and the sums of the packet, error, and discard counts; snmp.interval |
cpu | snmp.cpu.pct, processors |
memory | snmp.memory.index, name, total.bytes, used.bytes, free.bytes, used.pct |
fan | snmp.fan.index, name, status (ok, failed, unknown), status_code. A status change is an event, event.action: fan-status-changed, with previous_status. |
power_supply | snmp.power_supply.*, as for fans; the event is power-supply-status-changed. |
tcpip | snmp.tcpip.ip.in.discards, ip.out.discards, tcp.established_resets, tcp.out_resets, tcp.retransmitted_segments (increases), tcp.current_established, tcp.max_connections, tcp.rto.algorithm, tcp.rto.min, tcp.rto.max; snmp.interval |
vlan | snmp.vlan.id, name, ports (names), port_indexes, port_count |
entity | snmp.entity.index, class, name, description, model, serial_number, manufacturer, hardware_version, firmware_version, software_version, contained_in, parent_rel_pos, fru, manufacture_date, alias, asset_id, vendor_type, uris |
neighbor | snmp.neighbor.protocol (cdp or lldp), local.port, local.if_index / local.port_number, remote.name, remote.port, remote.port_description, remote.chassis_id, remote.platform, remote.version, remote.address, remote.description |
Interface statistics cover ports, LAGs, VLAN and virtual interfaces, tunnels, and radios. A VLAN's ports are the ports that carry it untagged, as their access or native VLAN.
Manufacturer Tables
The manufacturers' own tables are datasets of their own, read when the device is one of theirs:
| Manufacturer | Inventory datasets | Metric datasets |
|---|---|---|
| F5 BIG-IP | f5_virtual_server (320), f5_pool (322), f5_pool_member (324), f5_node (326) | f5_virtual_server_stats (321), f5_pool_stats (323), f5_pool_member_stats (325) |
| FortiGate | fortigate_ha_node (330), fortigate_vpn_tunnel (332), fortigate_sslvpn_tunnel (334), fortigate_user (337), fortigate_interface_bandwidth (338) | fortigate_ha_node_stats (331), fortigate_vpn_tunnel_stats (333), fortigate_sslvpn_tunnel_stats (335), fortigate_vdom_stats (336) |
| Cisco | cisco_ike_tunnel (340), cisco_wireless_ap (342) | cisco_ike_tunnel_stats (341), cisco_wireless_ap_stats (343) |
Their fields sit under snmp.<manufacturer>.<thing>, which a table and its statistics share: f5_pool and f5_pool_stats both write snmp.f5.pool.*. A field read as a rate says so in its name, as in snmp.f5.pool.bytes_in_per_sec.
Custom OIDs
A custom OID dataset is a table of your own: its OIDs are walked together, and the values that share an instance index become one record. A single value, an OID ending in .0, comes back as index 0. A device may read several custom OID tables.
Each record carries snmp.custom.table, snmp.custom.index, and one field per OID under the table's name, snmp.custom.<table>.<column>, so two tables may use one column name with different types.
Wizard fields
| Field | Behavior |
|---|---|
Leave empty to read every 60 seconds. At least 10. | |
Letters, digits, and underscores, but not table or index. Records carry it as snmp.custom.table. | |
| At most 64. Each has the fields below. | |
| The field name: letters, digits, and underscores, unique within the table. | |
| Numeric, with or without the leading dot. | |
string, the default) or integer). | |
RE2. For a text value, each match is replaced by its first group, so ^(\w+) temp=.*$ turns Inlet temp=41C into Inlet. | |
| Whether the OID is read. |
A table that cannot be read — a bad OID, a name used twice — is left out with a warning in the device's log, and the rest of the device runs.
Examples
Reading a switch's identity and interfaces hourly, its traffic every minute, and a temperature table of its own... | |