Comprehensive SNMP Exporter Guide for Prometheus

Introduction

The SNMP Exporter is a Prometheus exporter that allows you to monitor network devices and infrastructure using the Simple Network Management Protocol (SNMP). This guide provides complete instructions for installing, configuring, and using the SNMP Exporter to monitor routers, switches, firewalls, and other SNMP-enabled devices.

Official Documentation: SNMP Exporter GitHub

---

What is SNMP?

SNMP (Simple Network Management Protocol) is an Internet Standard protocol for collecting and organizing information about managed devices on IP networks. It’s widely used for monitoring network equipment like:

• Routers and switches
• Firewalls
• Load balancers
• Servers
• Printers
• UPS devices
• Environmental sensors

---

Prerequisites

Before installing SNMP Exporter, ensure you have:

• A working Prometheus installation (see our Prometheus guide)
• SNMP-enabled devices to monitor
• SNMP credentials (community strings or SNMPv3 credentials)
• Basic understanding of SNMP concepts (OIDs, MIBs)
• Root or sudo access (for Linux installations)

---

Architecture Overview

[SNMP Devices] <--SNMP--> [SNMP Exporter] <--HTTP--> [Prometheus]

The SNMP Exporter:

1. Receives scrape requests from Prometheus with target information
2. Queries SNMP devices using configured modules
3. Translates SNMP responses into Prometheus metrics
4. Returns metrics to Prometheus in the expected format

---

Installation Methods

Method 1: Binary Installation (Recommended)

Step 1: Download the Latest Release

Visit the SNMP Exporter releases page to get the latest version.

For Linux (amd64):

VERSION="0.26.0"  # Check for the latest version
cd /tmp
wget https://github.com/prometheus/snmp_exporter/releases/download/v${VERSION}/snmp_exporter-${VERSION}.linux-amd64.tar.gz

For macOS (amd64):

VERSION="0.26.0"
cd /tmp
wget https://github.com/prometheus/snmp_exporter/releases/download/v${VERSION}/snmp_exporter-${VERSION}.darwin-amd64.tar.gz

Step 2: Extract the Archive

# For Linux
tar xvfz snmp_exporter-${VERSION}.linux-amd64.tar.gz
cd snmp_exporter-${VERSION}.linux-amd64

# For macOS
tar xvfz snmp_exporter-${VERSION}.darwin-amd64.tar.gz
cd snmp_exporter-${VERSION}.darwin-amd64

Step 3: Create User and Directories (Linux)

# Create snmp_exporter user
sudo useradd --no-create-home --shell /bin/false snmp_exporter

# Create configuration directory
sudo mkdir -p /etc/snmp_exporter

# Set ownership
sudo chown snmp_exporter:snmp_exporter /etc/snmp_exporter

Step 4: Install Binaries and Configuration

# Copy binary
sudo cp snmp_exporter /usr/local/bin/
sudo chown snmp_exporter:snmp_exporter /usr/local/bin/snmp_exporter

# Copy default configuration
sudo cp snmp.yml /etc/snmp_exporter/
sudo chown snmp_exporter:snmp_exporter /etc/snmp_exporter/snmp.yml

Step 5: Create Systemd Service (Linux)

sudo nano /etc/systemd/system/snmp_exporter.service

Add the following content:

[Unit]
Description=SNMP Exporter
Wants=network-online.target
After=network-online.target

[Service]
User=snmp_exporter
Group=snmp_exporter
Type=simple
ExecStart=/usr/local/bin/snmp_exporter \
    --config.file=/etc/snmp_exporter/snmp.yml

[Install]
WantedBy=multi-user.target

Step 6: Start the Service

# Reload systemd
sudo systemctl daemon-reload

# Start SNMP Exporter
sudo systemctl start snmp_exporter

# Enable on boot
sudo systemctl enable snmp_exporter

# Check status
sudo systemctl status snmp_exporter

Method 2: Docker Installation

Step 1: Create Configuration Directory

mkdir -p ~/snmp_exporter
cd ~/snmp_exporter

Step 2: Download Default Configuration

wget https://raw.githubusercontent.com/prometheus/snmp_exporter/main/snmp.yml

Step 3: Run Docker Container

docker run -d \
  --name snmp-exporter \
  -p 9116:9116 \
  -v ~/snmp_exporter/snmp.yml:/etc/snmp_exporter/snmp.yml \
  prom/snmp-exporter:latest \
  --config.file=/etc/snmp_exporter/snmp.yml

Step 4: Verify Container

docker ps | grep snmp-exporter
docker logs snmp-exporter

Method 3: Using Docker Compose

Create a docker-compose.yml file:

version: '3.8'

services:
  snmp-exporter:
    image: prom/snmp-exporter:latest
    container_name: snmp-exporter
    ports:
      - "9116:9116"
    volumes:
      - ./snmp.yml:/etc/snmp_exporter/snmp.yml:ro
    command:
      - '--config.file=/etc/snmp_exporter/snmp.yml'
    restart: unless-stopped

Start the service:

docker-compose up -d

---

Understanding the Configuration File

The snmp.yml file contains modules that define how to query different types of devices. Each module specifies:

• Walk parameters: Which OIDs to query
• Lookups: How to translate SNMP responses
• Overrides: Custom metric transformations
• Auth settings: SNMP version and credentials

Basic Configuration Structure

# Example module for generic device
if_mib:
  walk:
    - 1.3.6.1.2.1.2.2.1.2   # ifDescr
    - 1.3.6.1.2.1.2.2.1.5   # ifSpeed
    - 1.3.6.1.2.1.2.2.1.8   # ifOperStatus
  metrics:
    - name: ifOperStatus
      oid: 1.3.6.1.2.1.2.2.1.8
      type: gauge
      help: The current operational state of the interface
      indexes:
        - labelname: ifIndex
          type: gauge
      lookups:
        - labels:
            - ifIndex
          labelname: ifDescr
          oid: 1.3.6.1.2.1.2.2.1.2
          type: DisplayString

Common Pre-built Modules

The default snmp.yml includes modules for:

• if_mib – Standard interface statistics
• cisco_ios – Cisco IOS devices
• paloalto_fw – Palo Alto firewalls
• apc_ups – APC UPS devices
• synology – Synology NAS devices
• ddwrt – DD-WRT routers
• mikrotik – MikroTik routers

---

Configuring Authentication

SNMPv2c (Community String)

Most common for older devices:

auths:
  public_v2:
    community: public
    security_level: noAuthNoPriv
    auth_protocol: MD5
    priv_protocol: DES
    version: 2

SNMPv3 (Recommended for Security)

More secure with authentication and encryption:

auths:
  secure_v3:
    security_level: authPriv
    username: snmpuser
    password: authpassword
    auth_protocol: SHA
    priv_protocol: AES
    priv_password: privpassword
    version: 3

Security levels:

• noAuthNoPriv – No authentication, no encryption
• authNoPriv – Authentication only
• authPriv – Authentication and encryption (recommended)

---

Generating Custom Configuration

For specific devices or custom OIDs, you’ll need to generate a custom configuration using the SNMP Exporter Generator.

Step 1: Install Generator Dependencies

# Install Go (required)
# For Ubuntu/Debian
sudo apt-get update
sudo apt-get install golang-go build-essential libsnmp-dev

# For macOS
brew install go net-snmp

Step 2: Clone Generator Repository

git clone https://github.com/prometheus/snmp_exporter.git
cd snmp_exporter/generator

Step 3: Install Generator Dependencies

go build
make mibs

Step 4: Create Generator Configuration

Create a generator.yml file:

modules:
  custom_module:
    walk:
      - sysUpTime
      - interfaces
      - ifXTable
    lookups:
      - source_indexes: [ifIndex]
        lookup: ifAlias
      - source_indexes: [ifIndex]
        lookup: ifDescr
    overrides:
      ifAlias:
        ignore: true
      ifDescr:
        ignore: true
      ifName:
        ignore: true
      ifType:
        type: EnumAsInfo

Step 5: Generate snmp.yml

export MIBDIRS=mibs
./generator generate

This creates a new snmp.yml file with your custom module.

---

Configuring Prometheus

Basic Configuration

Add SNMP Exporter targets to your prometheus.yml:

scrape_configs:
  - job_name: 'snmp'
    static_configs:
      - targets:
        - 192.168.1.1  # Router
        - 192.168.1.2  # Switch
        - 192.168.1.3  # Firewall
    metrics_path: /snmp
    params:
      module: [if_mib]  # Use the if_mib module
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target
      - source_labels: [__param_target]
        target_label: instance
      - target_label: __address__
        replacement: localhost:9116  # SNMP Exporter address

Advanced Configuration with Multiple Modules

scrape_configs:
  # Cisco devices
  - job_name: 'snmp-cisco'
    static_configs:
      - targets:
        - 192.168.1.10  # Core Router
        - 192.168.1.11  # Distribution Switch
    metrics_path: /snmp
    params:
      module: [cisco_ios]
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target
      - source_labels: [__param_target]
        target_label: instance
      - target_label: __address__
        replacement: snmp-exporter:9116

  # UPS devices
  - job_name: 'snmp-ups'
    static_configs:
      - targets:
        - 192.168.1.20
    metrics_path: /snmp
    params:
      module: [apc_ups]
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target
      - source_labels: [__param_target]
        target_label: instance
      - target_label: __address__
        replacement: snmp-exporter:9116

Using File-based Service Discovery

Create a snmp_targets.yml file:

- targets:
    - 192.168.1.1
    - 192.168.1.2
  labels:
    module: cisco_ios
    location: datacenter1
    
- targets:
    - 192.168.2.1
  labels:
    module: if_mib
    location: office

Update prometheus.yml:

scrape_configs:
  - job_name: 'snmp'
    file_sd_configs:
      - files:
        - /etc/prometheus/snmp_targets.yml
    metrics_path: /snmp
    params:
      module: [if_mib]
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target
      - source_labels: [__param_target]
        target_label: instance
      - source_labels: [module]
        target_label: __param_module
      - target_label: __address__
        replacement: localhost:9116

Reload Prometheus Configuration

# Binary installation
sudo systemctl reload prometheus

# Docker installation
docker exec prometheus kill -HUP 1

---

Testing and Verification

Test SNMP Connectivity

Before configuring the exporter, verify SNMP access to your devices:

# Install snmpwalk
sudo apt-get install snmp snmp-mibs-downloader  # Ubuntu/Debian
brew install net-snmp  # macOS

# Test SNMPv2c
snmpwalk -v2c -c public 192.168.1.1 system

# Test SNMPv3
snmpwalk -v3 -l authPriv -u snmpuser -a SHA -A authpassword -x AES -X privpassword 192.168.1.1 system

Test SNMP Exporter

Query the exporter directly:

# Test with default module
curl 'http://localhost:9116/snmp?target=192.168.1.1&module=if_mib'

# Test with authentication
curl 'http://localhost:9116/snmp?target=192.168.1.1&module=if_mib&auth=public_v2'

Verify Metrics in Prometheus

1. Open Prometheus web UI: http://localhost:9090
2. Go to Status > Targets
3. Check that SNMP targets show as “UP”
4. Run test queries:

# Check interface status
ifOperStatus

# Interface traffic
rate(ifHCInOctets[5m]) * 8

# CPU usage (Cisco)
cpmCPUTotal5minRev

Check SNMP Exporter Logs

# Binary installation
sudo journalctl -u snmp_exporter -f

# Docker installation
docker logs -f snmp-exporter

---

Common Use Cases and Queries

Interface Monitoring

Interface status:

ifOperStatus{job="snmp"}

Inbound traffic rate (bits per second):

rate(ifHCInOctets{job="snmp"}[5m]) * 8

Outbound traffic rate:

rate(ifHCOutOctets{job="snmp"}[5m]) * 8

Interface errors:

rate(ifInErrors{job="snmp"}[5m])

Interface utilization percentage:

(rate(ifHCInOctets{job="snmp"}[5m]) * 8 / ifHighSpeed * 100)

Device Health

System uptime:

sysUpTime{job="snmp"} / 100 / 60 / 60 / 24

CPU usage (Cisco):

cpmCPUTotal5minRev{job="snmp"}

Memory usage (Cisco):

(ciscoMemoryPoolUsed / (ciscoMemoryPoolUsed + ciscoMemoryPoolFree)) * 100

Environmental Monitoring

Temperature sensors:

entSensorValue{entSensorType="8"}

Fan status:

entSensorValue{entSensorType="9"}

Power supply status:

entSensorValue{entSensorType="11"}

---

Alerting Rules

Create an snmp_alerts.yml file:

groups:
  - name: snmp_alerts
    interval: 30s
    rules:
      # Interface Down Alert
      - alert: InterfaceDown
        expr: ifOperStatus{ifAdminStatus="1"} == 2
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "Interface {{ $labels.ifDescr }} is down"
          description: "Interface {{ $labels.ifDescr }} on {{ $labels.instance }} has been down for more than 5 minutes"

      # High Interface Utilization
      - alert: HighInterfaceUtilization
        expr: (rate(ifHCInOctets[5m]) * 8 / ifHighSpeed * 100) > 80
        for: 10m
        labels:
          severity: warning
        annotations:
          summary: "High bandwidth usage on {{ $labels.ifDescr }}"
          description: "Interface {{ $labels.ifDescr }} on {{ $labels.instance }} is using {{ $value }}% bandwidth"

      # High CPU Usage
      - alert: HighCPUUsage
        expr: cpmCPUTotal5minRev > 80
        for: 15m
        labels:
          severity: warning
        annotations:
          summary: "High CPU usage on {{ $labels.instance }}"
          description: "CPU usage on {{ $labels.instance }} is {{ $value }}%"

      # High Memory Usage
      - alert: HighMemoryUsage
        expr: (ciscoMemoryPoolUsed / (ciscoMemoryPoolUsed + ciscoMemoryPoolFree)) * 100 > 90
        for: 10m
        labels:
          severity: critical
        annotations:
          summary: "High memory usage on {{ $labels.instance }}"
          description: "Memory usage on {{ $labels.instance }} is {{ $value }}%"

      # Device Unreachable
      - alert: SNMPDeviceDown
        expr: up{job="snmp"} == 0
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "SNMP device {{ $labels.instance }} is unreachable"
          description: "Unable to scrape SNMP metrics from {{ $labels.instance }}"

      # High Interface Errors
      - alert: HighInterfaceErrors
        expr: rate(ifInErrors[5m]) > 10
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "High error rate on {{ $labels.ifDescr }}"
          description: "Interface {{ $labels.ifDescr }} on {{ $labels.instance }} has {{ $value }} errors/sec"

Add the rules file to your prometheus.yml:

rule_files:
  - "snmp_alerts.yml"

---

Grafana Dashboards

Install Grafana

Follow the official Grafana installation guide.

Add Prometheus Data Source

1. Open Grafana (default: http://localhost:3000)
2. Go to Configuration > Data Sources
3. Click Add data source
4. Select Prometheus
5. Set URL: http://localhost:9090
6. Click Save & Test

Import Pre-built Dashboards

Popular SNMP dashboards from Grafana.com:

• Dashboard ID 11169 – SNMP Interface Stats
• Dashboard ID 11566 – SNMP Device Details
• Dashboard ID 11169 – Network Interfaces

To import:

1. Go to Dashboards > Import
2. Enter dashboard ID
3. Select Prometheus data source
4. Click Import

Create Custom Dashboard

Example panel for interface traffic:

Panel Title: Interface Traffic

Query A (Inbound):

rate(ifHCInOctets{job="snmp"}[5m]) * 8

Query B (Outbound):

rate(ifHCOutOctets{job="snmp"}[5m]) * 8 * -1

Visualization: Time series graph Unit: bits/sec (bps)

---

Advanced Configuration

Custom OID Monitoring

To monitor specific OIDs not in standard modules:

custom_oids:
  walk:
    - 1.3.6.1.4.1.9.9.109.1.1.1.1.7  # Custom Cisco OID
  metrics:
    - name: customMetric
      oid: 1.3.6.1.4.1.9.9.109.1.1.1.1.7
      type: gauge
      help: Custom metric description

Using Multiple Auth Profiles

# In Prometheus configuration
scrape_configs:
  - job_name: 'snmp-public'
    static_configs:
      - targets: ['192.168.1.1']
    params:
      module: [if_mib]
      auth: [public_v2]
    # ... relabel configs ...

  - job_name: 'snmp-secure'
    static_configs:
      - targets: ['192.168.1.10']
    params:
      module: [cisco_ios]
      auth: [secure_v3]
    # ... relabel configs ...

Performance Tuning

Adjust timeout and concurrency in SNMP Exporter startup:

/usr/local/bin/snmp_exporter \
    --config.file=/etc/snmp_exporter/snmp.yml \
    --web.listen-address=:9116 \
    --log.level=info

For high-volume monitoring, consider:

• Increasing scrape interval in Prometheus
• Using multiple SNMP Exporter instances
• Optimizing modules to walk only necessary OIDs

---

Troubleshooting

Issue 1: SNMP Exporter Returns No Metrics

Check SNMP connectivity:

snmpwalk -v2c -c public 192.168.1.1 system

Verify firewall rules:

# Allow SNMP (UDP 161)
sudo ufw allow 161/udp

Check community string/credentials:

• Verify the community string is correct
• Ensure SNMPv3 credentials match device configuration

Test directly:

curl 'http://localhost:9116/snmp?target=192.168.1.1&module=if_mib'

Issue 2: Timeout Errors

Increase timeout in Prometheus:

scrape_configs:
  - job_name: 'snmp'
    scrape_interval: 60s
    scrape_timeout: 30s  # Increased from default 10s

Optimize SNMP module:

• Remove unnecessary OIDs from walk
• Use more specific OIDs instead of walking entire trees

Issue 3: High Memory Usage

Reduce module complexity:

• Limit the number of OIDs walked
• Use specific OID queries instead of bulk walks

Increase scrape interval:

scrape_configs:
  - job_name: 'snmp'
    scrape_interval: 120s  # Scrape every 2 minutes

Issue 4: Authentication Failures (SNMPv3)

Verify credentials on device:

# On Cisco devices
show snmp user

Test with snmpwalk:

snmpwalk -v3 -l authPriv -u username -a SHA -A authpass -x AES -X privpass 192.168.1.1

Check security level:

• Ensure security_level matches device configuration
• Verify auth and priv protocols are supported by device

Issue 5: Missing Metrics

Check if OID exists on device:

snmpwalk -v2c -c public 192.168.1.1 1.3.6.1.2.1.2.2.1.2

Verify module configuration:

• Ensure the module includes the desired OIDs
• Check for overrides that might ignore metrics

Enable debug logging:

# Binary installation - edit service file
ExecStart=/usr/local/bin/snmp_exporter \
    --config.file=/etc/snmp_exporter/snmp.yml \
    --log.level=debug

# Docker installation
docker run -d \
  --name snmp-exporter \
  -p 9116:9116 \
  -v ~/snmp_exporter/snmp.yml:/etc/snmp_exporter/snmp.yml \
  prom/snmp-exporter:latest \
  --config.file=/etc/snmp_exporter/snmp.yml \
  --log.level=debug

Issue 6: Incorrect Metric Values

Check metric type:

• Counters should use rate() or irate()
• Gauges can be used directly

Verify index lookups:

• Ensure ifIndex correctly maps to ifDescr
• Check that lookups reference valid OIDs

---

Best Practices

Security

1. Use SNMPv3 whenever possible for encryption and authentication
2. Restrict SNMP access on devices using ACLs
3. Use strong community strings if SNMPv2c is required
4. Limit SNMP Exporter exposure – don’t expose port 9116 publicly
5. Rotate credentials regularly
6. Enable authentication in Prometheus if accessible remotely

Performance

1. Optimize modules – only walk necessary OIDs
2. Use appropriate scrape intervals – network devices don’t change rapidly
3. Monitor exporter performance – watch for timeout errors
4. Use multiple exporters for large-scale deployments
5. Implement proper indexing in queries for better performance

Monitoring

1. Set up alerts for critical metrics (interface down, high CPU, etc.)
2. Monitor the exporter itself – track scrape duration and errors
3. Document your modules – maintain clear documentation of custom configs
4. Test configuration changes before deploying to production
5. Keep modules updated with vendor MIB updates

Organization

1. Use consistent labeling across all devices
2. Group devices by type in Prometheus jobs
3. Maintain separate modules for different device types
4. Version control your configurations in Git
5. Document device-specific quirks and workarounds

---

Device-Specific Guides

Cisco Devices

Enable SNMP on Cisco IOS:

configure terminal
snmp-server community public RO
snmp-server location Datacenter-1
snmp-server contact [email protected]
exit
write memory

SNMPv3 configuration:

configure terminal
snmp-server group snmpv3group v3 priv
snmp-server user snmpv3user snmpv3group v3 auth sha authpass priv aes 128 privpass
exit
write memory

Recommended module: cisco_ios

Palo Alto Firewalls

Enable SNMP:

Device > Setup > Operations > SNMP Setup
- Enable SNMP
- Add community string
- Add allowed hosts

Recommended module: paloalto_fw

Key metrics:

• panSessionActive – Active sessions
• panSessionThroughput – Throughput
• panGPGWUtilizationPct – Gateway utilization

MikroTik Routers

Enable SNMP:

/snmp set enabled=yes [email protected] location=Office
/snmp community set public addresses=192.168.1.0/24

Recommended module: mikrotik

Synology NAS

Enable SNMP:

1. Control Panel > Terminal & SNMP
2. Enable SNMP service
3. Set community string

Recommended module: synology

Key metrics:

• Disk health and status
• System temperature
• RAID status
• Volume space

---

Migration and Scaling

Migrating from SNMP to SNMP Exporter

If you’re currently using native SNMP in Prometheus:

1. Audit current SNMP targets and document OIDs being monitored
2. Create or identify appropriate SNMP Exporter modules
3. Test SNMP Exporter with a small subset of devices
4. Update Prometheus configuration to use SNMP Exporter
5. Verify metrics match previous values
6. Migrate remaining devices in batches

Scaling SNMP Monitoring

For large deployments (100+ devices):

1. Deploy multiple SNMP Exporters
   • Distribute devices across exporters by location or type
   • Use load balancing if needed
2. Implement hierarchical monitoring
   • Regional Prometheus servers for initial scraping
   • Federation to central Prometheus for long-term storage
3. Optimize scrape intervals
   • Less critical devices: 2-5 minutes
   • Critical infrastructure: 30-60 seconds
   • Adjust based on device capabilities
4. Use service discovery
   • DNS-SD, Consul, or Kubernetes for dynamic environments
   • File-based SD for static environments

Example multi-exporter setup:

scrape_configs:
  # SNMP Exporter for datacenter 1
  - job_name: 'snmp-dc1'
    static_configs:
      - targets: ['dc1-device1', 'dc1-device2']
    relabel_configs:
      - target_label: __address__
        replacement: snmp-exporter-dc1:9116

  # SNMP Exporter for datacenter 2
  - job_name: 'snmp-dc2'
    static_configs:
      - targets: ['dc2-device1', 'dc2-device2']
    relabel_configs:
      - target_label: __address__
        replacement: snmp-exporter-dc2:9116

---

Additional Resources

• SNMP Exporter GitHub Repository
• SNMP Exporter Configuration Generator
• Prometheus SNMP Exporter Documentation
• Grafana SNMP Dashboards
• SNMP MIB Database
• Net-SNMP Documentation
• Prometheus Best Practices

---

Conclusion

The SNMP Exporter is a powerful tool for monitoring network infrastructure with Prometheus. By following this guide, you should now have:

• A working SNMP Exporter installation
• Configured modules for your devices
• Integrated monitoring in Prometheus
• Alerting rules for critical events
• Grafana dashboards for visualization

Remember to:

• Keep your configurations version-controlled
• Document device-specific customizations
• Regularly update the SNMP Exporter and modules
• Monitor the health of the exporter itself
• Follow security best practices for SNMP access

Happy Monitoring! 📊🔌