#SNMP devices

Plugin: go.d.plugin Module: snmp

#Overview

This collector discovers and monitors any SNMP-enabled network device.

• Built-in vendor profiles: Netdata ships with a large library of profiles for major vendors, enabling automatic, out-of-the-box monitoring—no manual OID configuration needed for common hardware.
• Custom profiles supported: Users can extend or override stock profiles to add new devices, modify charts, or collect additional OIDs.
• Automatic vendor/model detection: Devices are matched to the right profile using selectors such as sysObjectID and sysDescr.
• ICMP ping: Optional round-trip latency monitoring alongside SNMP, with a ping_only mode available.
• SNMP v1, v2c, and v3 support: Fully implemented via the gosnmp library.
• Shared device-level licensing metrics for supported profiles: When a profile exposes license telemetry, Netdata emits compact per-device licensing charts for earliest expiry, license-state counts (healthy, informational, degraded, broken, ignored), and highest usage pressure. Supported profile coverage includes Check Point licensing state and per-blade expiry, Fortinet FortiGate contract/service/account expirations, Cisco traditional licensing end-date/remaining-time/state/usage telemetry, Cisco Smart Licensing authorization, certificate, evaluation, and state telemetry, Sophos Firewall subscription state and per-license expiry telemetry, Blue Coat ProxySG application/feature/component expiry, expire-type, and state telemetry, and basic MikroTik RouterOS upgrade-entitlement telemetry. For MikroTik, epoch-like placeholder mtxrLicUpgrUntil values are ignored instead of treated as real expired licenses.
• Interactive licensing drill-down: The snmp:licenses function follows the existing SNMP function pattern and shows normalized licensing rows for the selected SNMP job/device using cached collector data.

Built-in profiles for major vendors:

Category	Vendors
Switches & Routers	Cisco (Catalyst, Nexus, ASR, ISR), Arista, Juniper, HP/HPE, Dell, Extreme
Firewalls	Palo Alto, Fortinet FortiGate, Cisco ASA, Checkpoint, SonicWall, Sophos
Wireless	Aruba, Cisco WLC, Ubiquiti, Alcatel-Lucent
Load Balancers	F5 BIG-IP, Citrix NetScaler, A10 Thunder
Infrastructure	APC UPS/PDU, Dell servers, plus standard MIBs (BGP, OSPF, TCP/UDP)

This table highlights common vendors—the full library includes many more.

SNMP BGP monitoring

Netdata ships BGP monitoring profiles for generic BGP4-MIB devices and vendor MIBs including Cisco, Juniper, Nokia SR OS, Huawei, Arista, and Dell.

The operator-facing BGP charts are normalized under:

• snmp.bgp.peers.*
• snmp.bgp.peer_families.*
• snmp.bgp.devices.peer_counts
• snmp.bgp.devices.peer_states

Rich per-peer diagnostics such as previous state, last error, graceful-restart state, and vendor unavailability reasons are exposed through the Live function snmp:bgp-peers instead of being charted as regular time-series.

This SNMP BGP surface is designed for:

• peer/session availability and FSM state
• established uptime
• BGP UPDATE and message traffic
• route-count monitoring where the vendor MIB exposes truthful counts
• stock alerts for peer down, update churn, transition anomalies, and accepted-prefix drift

Important limits

• Standard BGP4-MIB gives peer health and message counters, but not full route-count coverage.
• Some route counters are current gauges, while others are cumulative totals. Netdata keeps them separate instead of flattening unlike semantics into one fake chart.
• Huawei contributes to device-level peer/session counts, but not device-level peer state counts in this SNMP batch.
• SNMP does not provide live per-route inventory. If you need “all routes to and from a peer in real time”, that belongs to BMP, not this integration page.

:::info

See: SNMP Profile Format to learn how to write your own or extend stock ones.

:::

Profile locations

Type	Default path	Notes
Stock profiles	/usr/lib/netdata/conf.d/go.d/snmp.profiles/default/	Shipped with Netdata
User profiles	/etc/netdata/go.d/snmp.profiles/	Place custom or modified profiles here

Depending on installation, paths may be prefixed with /opt/netdata.

A profile defines:

• Device selectors for auto-matching (e.g. sysObjectID, sysDescr)
• The exact OIDs to collect (scalars and tables)
• How to label table rows (metric tags)
• Chart/metric metadata (units, families, types), including optional virtual metrics

At runtime, the collector:

1. Reads standard system OIDs (e.g. sysObjectID, sysDescr) to identify the device
2. Picks the best matching vendor/model profile(s)
3. Collects exactly the metrics those profiles define

This collector is supported on all platforms.

This collector supports collecting metrics from multiple instances of this integration, including remote instances.

#Default Behavior

#Auto-Detection

SNMP service discovery can automatically scan configured networks and feed the SNMP collector with discovered devices.

• Disabled by default; enable and configure explicitly.
• Supports single IPs, ranges, and CIDR blocks (up to 512 IPs per subnet).
• Uses the provided SNMP credentials (v1/v2c/v3) to probe devices.
• Caches discovery results (configurable) to reduce network load.
• At collection time, each discovered device is matched to the appropriate profile based on its sysObjectID, sysDescr, and the profile’s selector rules.

The configuration file name is go.d/sd/snmp.conf.

You can edit the configuration file using the edit-config script from the Netdata config directory.

cd /etc/netdata 2>/dev/null || cd /opt/netdata/etc/netdata
sudo ./edit-config go.d/sd/snmp.conf

#Limits

The default configuration for this integration does not impose any limits on data collection.

#Performance Impact

Device constraints: Many SNMP devices (e.g., access switches) have limited CPU/ASIC time for management. If you see timeouts or gaps, reduce update_every or max_repetitions, or stagger polling across devices.

Concurrent polling: Parallel access by multiple tools may cause missed counters on some devices. Increase the collection interval (update_every) to reduce request pressure.

#Setup

You can configure the snmp collector in two ways:

Method	Best for	How to
UI	Fast setup without editing files	Go to Nodes → Configure this node → Collectors → Jobs, search for snmp, then click + to add a job.
File	If you prefer configuring via file, or need to automate deployments (e.g., with Ansible)	Edit go.d/snmp.conf and add a job.

:::important

UI configuration requires paid Netdata Cloud plan.

:::

#Prerequisites

#Prepare the SNMP device

Before configuring the collector: - Enable the SNMP service on the target device (via its management interface). - Ensure the device is reachable from the Netdata node on UDP/161. - Gather connection details: IP/DNS, SNMP version, and either a community (v1/v2c) or v3 credentials (user, auth/priv).

#Configuration

#Options

The following options can be defined globally: update_every, autodetection_retry.

Config options

| Group | Option | Description | Default | Required | |:------|:-----|:------------|:--------|:---------:| | **Collection** | update_every | Data collection frequency. | 10 | no | | | autodetection_retry | Recheck interval in seconds. Zero means no recheck will be scheduled. | 0 | no | | **Target** | hostname | Target host (IP or DNS name, IPv4/IPv6). | | yes | | **SNMPv1/2** | community | SNMPv1/2 community string. | public | no | | **SNMPv3** | user.name | SNMPv3 user name. | | no | | | [user.level](#option-snmpv3-user-level) | Security level of SNMPv3 messages. | | no | | | [user.auth_proto](#option-snmpv3-user-auth-proto) | Authentication protocol for SNMPv3 messages. | | no | | | user.auth_key | Authentication protocol pass phrase for SNMPv3 messages. | | no | | | [user.priv_proto](#option-snmpv3-user-priv-proto) | Privacy protocol for SNMPv3 messages. | | no | | | user.priv_key | Privacy protocol pass phrase for SNMPv3 messages. | | no | | | user.context_name | SNMPv3 context name used to address a specific MIB view on multi-context agents (e.g. virtual routers, logical partitions, snmpsim-simulated devices). Leave empty to use the default context. | | no | | **SNMP transport** | options.version | SNMP version. Available versions: 1, 2, 3. | 2 | no | | | options.port | Target port. | 161 | no | | | options.retries | Retries to attempt. | 1 | no | | | options.timeout | SNMP request/response timeout. | 5 | no | | | options.max_repetitions | Controls how many SNMP variables to retrieve in a single GETBULK request. | 25 | no | | | options.max_request_size | Maximum number of OIDs allowed in a single GET request. | 60 | no | | **Ping** | ping_only | Collect only ICMP round-trip metrics and skip periodic SNMP polling. Implies ping is enabled regardless of the `ping.enabled` setting. A minimal SNMP sysInfo probe still runs at setup for naming/labels/metadata. | no | no | | | ping.enabled | Enable ICMP round-trip measurements (runs alongside SNMP). When disabled, no ping metrics are collected. | yes | no | | | ping.privileged | Use raw ICMP (privileged). If false, unprivileged mode is used. | yes | no | | | ping.packets | Number of ping packets to send per iteration. | 3 | no | | | ping.interval | Interval between sending ping packets. | 100ms | no | | **Profiles** | manual_profiles | A list of profiles to force-apply when auto-detection cannot be used. | [] | no | | **Virtual node** | create_vnode | If set, the collector will create a Netdata Virtual Node for this SNMP device, which will appear as a separate Node in Netdata. | true | no | | | vnode_device_down_threshold | Number of consecutive failed data collections before marking the device as down. | 3 | no | | | vnode.guid | A unique identifier for the Virtual Node. If not set, a GUID will be automatically generated from the device's IP address. | | no | | | vnode.hostname | The hostname that will be used for the Virtual Node. If not set, the device's hostname will be used. | | no | | | vnode.labels | Additional key-value pairs to associate with the Virtual Node. | | no | ##### user.level The security of an SNMPv3 message as per RFC 3414 (`user.level`): | String value | Int value | Description | |:------------:|:---------:|------------------------------------------| | none | 1 | no message authentication or encryption | | authNoPriv | 2 | message authentication and no encryption | | authPriv | 3 | message authentication and encryption | ##### user.auth_proto The digest algorithm for SNMPv3 messages that require authentication (`user.auth_proto`): | String value | Int value | Description | |:------------:|:---------:|-------------------------------------------| | none | 1 | no message authentication | | md5 | 2 | MD5 message authentication (HMAC-MD5-96) | | sha | 3 | SHA message authentication (HMAC-SHA-96) | | sha224 | 4 | SHA message authentication (HMAC-SHA-224) | | sha256 | 5 | SHA message authentication (HMAC-SHA-256) | | sha384 | 6 | SHA message authentication (HMAC-SHA-384) | | sha512 | 7 | SHA message authentication (HMAC-SHA-512) | ##### user.priv_proto The encryption algorithm for SNMPv3 messages that require privacy (`user.priv_proto`): | String value | Int value | Description | |:------------:|:---------:|-------------------------------------------------------------------------| | none | 1 | no message encryption | | des | 2 | ES encryption (CBC-DES) | | aes | 3 | 128-bit AES encryption (CFB-AES-128) | | aes192 | 4 | 192-bit AES encryption (CFB-AES-192) with "Blumenthal" key localization | | aes256 | 5 | 256-bit AES encryption (CFB-AES-256) with "Blumenthal" key localization | | aes192c | 6 | 192-bit AES encryption (CFB-AES-192) with "Reeder" key localization | | aes256c | 7 | 256-bit AES encryption (CFB-AES-256) with "Reeder" key localization |

#via UI

Configure the snmp collector from the Netdata web interface:

1. Go to Nodes.
2. Select the node where you want the snmp data-collection job to run and click the :gear: (Configure this node). That node will run the data collection.
3. The Collectors → Jobs view opens by default.
4. In the Search box, type snmp (or scroll the list) to locate the snmp collector.
5. Click the + next to the snmp collector to add a new job.
6. Fill in the job fields, then click Test to verify the configuration and Submit to save.
   • Test runs the job with the provided settings and shows whether data can be collected.
   • If it fails, an error message appears with details (for example, connection refused, timeout, or command execution errors), so you can adjust and retest.

#via File

The configuration file name for this integration is go.d/snmp.conf.

The file format is YAML. Generally, the structure is:

update_every: 1
autodetection_retry: 0
jobs:
  - name: some_name1
  - name: some_name2

You can edit the configuration file using the edit-config script from the Netdata config directory.

cd /etc/netdata 2>/dev/null || cd /opt/netdata/etc/netdata
sudo ./edit-config go.d/snmp.conf

#Examples

#SNMPv1/2

In this example:

• the SNMP device is 192.0.2.1.
• the SNMP version is 2.
• the SNMP community is public.
• we will update the values every 10 seconds.

Profiles are auto-selected at runtime

Config

```yaml jobs: - name: switch update_every: 10 hostname: 192.0.2.1 community: public options: version: 2 ```

#SNMPv3

To use SNMPv3:

• use user instead of community.
• set options.version to 3.

Config

```yaml jobs: - name: switch update_every: 10 hostname: 192.0.2.1 options: version: 3 user: name: username level: authPriv auth_proto: sha256 auth_key: auth_protocol_passphrase priv_proto: aes256 priv_key: priv_protocol_passphrase ```

#SNMPv3 with multiple devices

This example monitors multiple SNMP devices that share the same SNMPv3 credentials.

It uses YAML anchors to define the full job once (&snmp_v3_job) and then reuse it with <<: *snmp_v3_job, overriding only name and hostname for each additional device.

Config

```yaml jobs: - &snmp_v3_job name: switch1 update_every: 10 hostname: 192.0.2.1 options: version: 3 user: name: username level: authPriv auth_proto: sha256 auth_key: auth_protocol_passphrase priv_proto: aes256 priv_key: priv_protocol_passphrase - <<: *snmp_v3_job name: switch2 hostname: 192.0.2.2 - <<: *snmp_v3_job name: switch3 hostname: 192.0.2.3 ```

#BGP router with forced profile

Use manual_profiles when auto-detection cannot safely distinguish the device, or when you want to force a specific vendor BGP profile during testing.

This example targets a Cisco ASR router and keeps the optional ICMP latency charts enabled.

Config

```yaml jobs: - name: edge-router update_every: 10 hostname: 192.0.2.10 community: public manual_profiles: - cisco-asr options: version: 2 ```

#Alerts

The following alerts are available:

Alert name	On metric	Description
snmp_license_expiring	snmp.license.remaining_time	The earliest monitored SNMP license or subscription on this device is close to expiration.
snmp_license_authorization_expiring	snmp.license.authorization_remaining_time	The license authorization timer on this device is close to expiration.
snmp_license_certificate_expiring	snmp.license.certificate_remaining_time	The license certificate timer on this device is close to expiration.
snmp_license_grace_period_ending	snmp.license.grace_remaining_time	The licensing grace or evaluation period on this device is ending or already expired.
snmp_license_state_warning	snmp.license.state	One or more monitored licenses on this device are degraded, in grace, or otherwise in warning state.
snmp_license_state_critical	snmp.license.state	One or more monitored licenses on this device are expired, invalid, unauthorized, or otherwise in critical state.
snmp_license_usage_high	snmp.license.usage_percent	The most constrained monitored license pool on this device is nearing exhaustion.
snmp_bgp_peer_down	snmp.bgp.peers.availability	BGP peer is administratively enabled but remains out of Established
snmp_bgp_peer_family_down	snmp.bgp.peer_families.availability	BGP peer-family is administratively enabled but remains out of Established
snmp_bgp_peer_transitions_anomaly	snmp.bgp.peers.established_transitions	ML anomaly detection on per-peer established transition activity
snmp_bgp_peer_family_transitions_anomaly	snmp.bgp.peer_families.established_transitions	ML anomaly detection on per-peer-family established transition activity
snmp_bgp_peer_updates_anomaly	snmp.bgp.peers.update_traffic	ML anomaly detection on per-peer BGP UPDATE traffic
snmp_bgp_peer_family_updates_anomaly	snmp.bgp.peer_families.update_traffic	ML anomaly detection on per-peer-family BGP UPDATE traffic
snmp_bgp_peer_family_prefixes_accepted_anomaly	snmp.bgp.peer_families.route_counts.current	ML anomaly detection on accepted-prefix gauges where the vendor MIB exposes them

#Metrics

Metrics grouped by scope.

The scope defines the instance that the metric belongs to. An instance is uniquely identified by a set of labels.

Metrics and charts are defined by the matched SNMP profile(s) at runtime. They differ by vendor/model/OS and may include, for example, interface counters, optics, CPU/memory, temperature, VLANs, and more. Use the Metrics tab on the device’s dashboard to see exactly what is collected for that device.

Supported licensing profiles also emit a small set of shared device-level licensing contexts:

• snmp.license.remaining_time: earliest remaining time to expiry across monitored licenses and subscriptions on the device
• snmp.license.authorization_remaining_time: earliest remaining time for license authorization timers
• snmp.license.certificate_remaining_time: earliest remaining time for licensing certificate timers
• snmp.license.grace_remaining_time: earliest remaining time for grace or evaluation timers
• snmp.license.usage_percent: highest license pool pressure across finite usage pools on the device
• snmp.license.state: count of licensing rows on the device by normalized state bucket (healthy, informational, degraded, broken, ignored)

The licensing charts are intentionally aggregated to keep one clean device view:

• Netdata reports the earliest expiry-related deadline on the device.
• Netdata reports how many licensing rows are healthy, informational, degraded, broken, and ignored on the device.
• Netdata reports the highest usage pressure across finite license pools on the device.

Licensing support is intentionally conditional:

• licensing charts appear only for devices whose matched SNMP profile exposes licensing telemetry
• not every supported device exposes all licensing dimensions
• remaining_time and related time charts appear only when the device exposes expiry-like timers
• usage_percent appears only when the device exposes finite usage and capacity data
• snmp.license.state appears only when the device exposes enough state/compliance/validity data to normalize rows

Default alerts from src/health/health.d/snmp.conf use 30d/7d for expiry-related timers, 7d/0d for grace timers, and 80/95 for usage pressure. You can override them like any other Netdata health configuration.

:::tip

To understand the structure of these profiles (metrics, tags, virtual metrics, etc.), see SNMP Profile Format.

:::

If ping.enabled is true, ICMP latency/packet-loss charts are also provided (or exclusively, when ping_only: true).

For BGP-capable profiles, the public chart contract is:

• snmp.bgp.peers.* for one BGP peer/session per chart instance
• snmp.bgp.peer_families.* for one peer plus AFI/SAFI per chart instance
• snmp.bgp.devices.peer_counts for device-level peer/session counts
• snmp.bgp.devices.peer_states for device-level peer-state summaries where the source MIB exposes canonical peer rows
• Rich peer diagnostics live in the Live function snmp:bgp-peers, not in charted time-series

BGP capability notes

Vendor / MIB surface	Peer charts	Peer-family charts	Device peer counts	Device peer states	Route counts
Standard BGP4-MIB	Yes	No	Yes	Yes	No
Cisco ASR	Yes	Yes	Yes	Yes	Yes
Juniper MX	Yes	Yes	Yes	Yes	Yes
Nokia SR OS	Yes	Yes	Yes	Yes	Yes
Arista	Yes	Yes	Yes	Yes	Yes
Dell OS10	Yes	Yes	Yes	Yes	Yes
Huawei	Partial	Yes	Yes	No	Totals only

Interpretation guidance

• route_counts.current contains current gauges such as received, accepted, advertised, active, suppressed, or withdrawn prefixes when the vendor MIB exposes them.
• route_totals contains cumulative counters where the vendor MIB only exposes totals.
• When the source model is peer-family scoped, alerts and chart labels include AFI/SAFI so operators can distinguish otherwise similar peers.

#Per device licensing

Shared device-level licensing health metrics emitted when the matched SNMP profile provides licensing telemetry. Supported profile coverage includes Check Point licensing state and per-blade expiry, Fortinet FortiGate contract/service/account expirations, Cisco traditional licensing end-date/remaining-time/state/usage telemetry, Cisco Smart Licensing authorization, certificate, evaluation, and state telemetry, Sophos Firewall subscription state and per-license expiry telemetry, Blue Coat ProxySG application/feature/component expiry, expire-type, and state telemetry, and basic MikroTik RouterOS upgrade-entitlement telemetry. MikroTik support is intentionally limited to the RouterOS upgrade-entitlement fields exposed by SNMP, and epoch-like placeholder mtxrLicUpgrUntil values are ignored.

Labels:

Label	Description
component	Always licensing for the shared SNMP licensing charts.

Metrics:

Metric	Dimensions	Unit
snmp.license.remaining_time	remaining_time	seconds
snmp.license.authorization_remaining_time	remaining_time	seconds
snmp.license.certificate_remaining_time	remaining_time	seconds
snmp.license.grace_remaining_time	remaining_time	seconds
snmp.license.usage_percent	usage_percent	percentage
snmp.license.state	healthy, informational, degraded, broken, ignored	licenses

#Live Data

This collector exposes real-time functions for interactive troubleshooting in the Live tab.

#Network Interfaces

Provides detailed network interface traffic and status metrics from SNMP-enabled devices.

This function queries cached SNMP interface data collected during regular polling cycles and presents it in a sortable, filterable table. Each row represents a network interface on the monitored SNMP device, with comprehensive metrics for traffic analysis, error monitoring, and operational status tracking.

Use cases: - Identify top bandwidth-consuming interfaces on routers, switches, and access points - Monitor interface operational and administrative status for network health - Investigate packet errors, discards, and unusual traffic patterns

Data is sourced from the IF-MIB (RFC 2863) interface counters and is cached from the last successful SNMP collection. No additional SNMP requests are triggered when calling this function.

Aspect	Description
Name	Snmp:interfaces
Require Cloud	no
Performance	Uses cached SNMP data only, no additional SNMP requests are triggered: • Responses are instantaneous from memory cache • Large devices with many interfaces may return many rows
Security	Exposes interface names, operational status, and traffic counters only: • No packet payloads or authentication credentials are exposed • No device configuration details are exposed
Availability	Available when: • The collector has completed at least one data collection cycle • Interface data is cached from the last successful SNMP collection • Returns HTTP 503 if cache is not ready yet

#Prerequisites

No additional configuration is required.

#Parameters

Parameter	Type	Description	Required	Default	Options
Type Group	select	Filter interfaces by their type classification group. Custom mapping categorizes IANA interface types into practical groups for easier filtering.	yes	ethernet	Ethernet (default), Aggregation, Virtual, Other

#Returns

Network interface metrics from cached SNMP data, including traffic rates, packet statistics, operational status, and error counters. Each row represents one physical or virtual interface.

Column	Type	Unit	Visibility	Description
Interface	string			Network interface name or identifier (e.g., eth0, GigabitEthernet1/0/1, Vlan100)
Type	string			IANA-assigned interface type from IF-MIB (e.g., ethernetCsmacd, ieee80211, softwareLoopback)
Type Group	string			Custom categorization mapping IANA interface types into practical groups: Ethernet (physical Ethernet interfaces), Aggregation (LAG/port-channels, bonds), Virtual (VLANs, loopbacks), or Other (all remaining types)
Admin Status	string			Administrative state configured on the interface: up (enabled for use), down (administratively disabled), or testing (currently in test mode). Different from operational status.
Oper Status	string			Current operational state of the interface: up (operational and passing traffic), down (not operational), testing (in test mode), unknown (status cannot be determined), dormant (waiting for external actions), notPresent (interface removed but configuration remains), or lowerLayerDown (interface down due to lower-layer issues)
Traffic In	float	bit/s		Inbound network traffic rate in bits per second. High values indicate heavy inbound data flow that may require capacity planning.
Traffic Out	float	bit/s		Outbound network traffic rate in bits per second. High values indicate heavy outbound data flow. Compare with Traffic In to identify asymmetric usage patterns.
Unicast In	float	packets/s	hidden	Rate of unicast packets (destined for a single recipient) received per second. Normal traffic pattern for point-to-point communications.
Unicast Out	float	packets/s	hidden	Rate of unicast packets (addressed to a single destination) transmitted per second.
Broadcast In	float	packets/s	hidden	Rate of broadcast packets (sent to all nodes on network) received per second. High values may indicate network storms, ARP flooding, or misconfigured devices.
Broadcast Out	float	packets/s	hidden	Rate of broadcast packets transmitted per second. Consistently high broadcast rates can degrade network performance.
Packets In	float	packets/s		Total inbound packet rate (sum of unicast, broadcast, and multicast) per second. Useful for overall interface load assessment.
Packets Out	float	packets/s		Total outbound packet rate (sum of unicast, broadcast, and multicast) per second.
Errors In	float	packets/s	hidden	Rate of inbound packets with errors that prevented delivery. Non-zero values indicate physical layer issues (cable problems, signal integrity) or buffer overruns.
Errors Out	float	packets/s	hidden	Rate of outbound packets with transmission errors. Non-zero values may indicate interface hardware issues, cabling problems, or duplex mismatches.
Discards In	float	packets/s		Rate of inbound packets deliberately discarded by the device (often due to resource constraints, security policies, or unrecognized frames). Unlike errors, the interface may have been functioning correctly but chose to drop the packet.
Discards Out	float	packets/s		Rate of outbound packets deliberately discarded. Can indicate output queue overflows, ACL drops, or security policy rejections.
Multicast In	float	packets/s	hidden	Rate of multicast packets (destined for a group) received per second. Common in video streaming, multicast applications, and routing protocols.
Multicast Out	float	packets/s	hidden	Rate of multicast packets transmitted per second.

#BGP Peers

Provides detailed current BGP peer and peer-family state from cached SNMP data.

This function uses the normalized BGP surface produced during regular SNMP polling and presents it as a sortable, filterable troubleshooting table. It is designed for details that are useful operationally but should not be charted as regular time-series, such as previous state, last error, last down reason, graceful restart state, and vendor-specific unavailability reasons.

Use cases: - Identify exactly which peer or peer-family is unhealthy right now - See the most recent BGP NOTIFICATION error as human-readable text - Inspect peer identity, AFI/SAFI scope, prefix gauges, and current troubleshooting context in one view

Data is sourced from the last successful SNMP collection cycle. No additional SNMP requests are triggered when calling this function.

Aspect	Description
Name	Snmp:bgp-peers
Require Cloud	no
Performance	Uses cached normalized SNMP data only, no additional SNMP requests are triggered: • Responses are instantaneous from memory cache • Large devices with many peers or peer-families may return many rows
Security	Exposes current BGP control-plane state and identifiers only: • No authentication credentials are exposed • No device configuration changes are triggered • No packet payloads or full route inventory are exposed
Availability	Available when: • The collector has completed at least one successful BGP-capable SNMP collection cycle • BGP peer data exists for the matched profile(s) • Returns HTTP 503 if no BGP rows are available yet

#Prerequisites

No additional configuration is required.

#Parameters

Parameter	Type	Description	Required	Default	Options
View	select	Choose whether to show peer rows, peer-family rows, or both.	yes	peers	Peers (default), Peer Families, All

#Returns

Current BGP peer and peer-family details from cached normalized SNMP data. Each row represents either one peer or one peer plus AFI/SAFI, depending on the selected view. Additional hidden columns provide raw codes, message totals, and threshold fields for deeper inspection in the UI.

Column	Type	Unit	Visibility	Description
Scope	string			Whether the row represents a peer or a peer-family.
Routing Instance	string			Routing-instance / VRF identifier when exposed by the source MIB.
Neighbor	string			Remote peer address.
Local Address	string			Local address used for the BGP session when exposed by the source MIB.
Remote AS	string			Remote Autonomous System number.
Peer Description	string			Peer description or label when exposed by the source MIB.
Family	string			Address-family / SAFI scope for peer-family rows.
Admin Status	string			Whether the peer is administratively enabled.
Connection State	string			Current BGP FSM state.
Previous State	string			Previous FSM state when the source MIB exposes it.
Established Uptime	integer	seconds		Time spent in the Established state.
Last Update Age	integer	seconds		Time since the last received UPDATE.
Updates Received	integer	updates		Current received UPDATE counter from the latest poll.
Updates Sent	integer	updates		Current sent UPDATE counter from the latest poll.
Prefixes Accepted	integer	prefixes		Current accepted-prefix gauge where the source MIB exposes it.
Prefixes Advertised	integer	prefixes		Current advertised-prefix gauge where the source MIB exposes it.
Last Error	string			Human-readable BGP last-error text derived from the code/subcode pair when available.
Down Reason	string			Last peer-down reason when the source MIB exposes it.
GR State	string			Graceful-restart state for peer-family scoped rows when exposed by the source MIB.
Unavailability Reason	string			Vendor-specific unavailability reason for peer-family scoped rows when exposed by the source MIB.

#Network Topology

Provides the agent-wide SNMP topology view built from all currently running topology-enabled SNMP jobs.

This function reads cached LLDP/CDP, bridge, FDB, ARP, and STP data collected by the independent topology refresh loop and returns a netdata.topology.v1 payload with compact actor, link, evidence, and detail tables. No additional SNMP requests are triggered when calling this function.

Use cases: - Discover Layer 2 neighbors and link mapping - Validate cabling and port connections - Identify adjacent devices that are discovered but not monitored

Aspect	Description
Name	Snmp:topology
Require Cloud	no
Performance	Uses cached SNMP data only, no additional SNMP requests are triggered: • Responses are instantaneous from memory cache • Large devices with many discovered neighbors may return many rows
Security	Exposes discovered device identifiers, interface/port identifiers, and management addresses only: • No packet payloads or authentication credentials are exposed • No device configuration details are exposed
Availability	Available when: • The collector has completed at least one successful topology refresh cycle • LLDP/CDP topology data is present in cache from the last successful topology refresh • Returns HTTP 503 if topology cache is not ready yet

#Prerequisites

No additional configuration is required.

#Parameters

Parameter	Type	Description	Required	Default	Options
Nodes Identity	select	Choose actor identity strategy. ip collapses nodes by management IP and removes non-IP inferred actors. mac keeps MAC-oriented identities.	yes	ip	IP (default), MAC
Map	select	Select the topology map mode. Defaults to the managed-device LLDP/CDP view. Other modes progressively include inferred devices and lower-confidence links.	yes	lldp_cdp_managed	LLDP/CDP/Managed Devices Map (default), High Confidence Inferred Map, All Devices (Low Confidence)
Infer Strategy	select	Select the inference algorithm used for FDB/STP/CDP correlation.	yes	fdb_minimum_knowledge	FDB Minimum-Knowledge (Baseline) (default), STP Parent Tree, FDB Pairwise Minimum-Knowledge, STP + FDB Correlated, CDP + FDB Hybrid
Focus On	multiselect	Limit depth filtering to selected managed SNMP roots. The static default is all_devices; additional ip:<address> options are supplied dynamically from the current managed SNMP jobs.	yes	all_devices	All Devices (default)
Focus Depth	select	Limit topology expansion hops from the focus roots. all disables depth filtering.	yes	all	All (default), 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10

#Returns

Agent-wide SNMP topology data using the netdata.topology.v1 schema, suitable for cross-agent aggregation.

Column	Type	Unit	Visibility	Description
schema_version	string			Topology schema version.
producer	object			Producer metadata identifying the SNMP L2 topology source, plugin, and local node when available.
collected_at	datetime			Collection timestamp in RFC 3339 format.
view	object			Topology view metadata, including selected mode and focus parameters when present.
dictionaries	object			Compact-table dictionaries used by actors, links, evidence, and detail tables.
types	object			Actor, link, evidence, table, and presentation type registry.
presentation	object			Graph-level presentation metadata.
actors	object			Compact actor table for managed devices, discovered devices, inferred endpoints, and network segments.
links	object			Compact link table for LLDP, CDP, bridge, FDB, STP, ARP, SNMP, and inferred L2 relationships.
evidence	object			Relationship evidence tables backing the rendered links.
tables	object			Actor detail, port, path, and label tables used by topology modals.
stats	object			Summary stats for collected observations, actors, links, and pruning/filtering decisions.

#Licenses

Provides normalized licensing rows for the selected SNMP device.

This function reads the collector's cached licensing rows and shows one row per normalized license entry. It is the drill-down view behind the device-level licensing charts: expiry timers, authorization/certificate/grace timers, usage/capacity, raw vendor state, normalized state bucket, and operational impact.

It follows the same pattern as the SNMP interfaces function: - the function itself is global for the SNMP collector - the Live tab targets the selected SNMP job/device automatically using the standard SNMP function context - the returned rows belong only to that selected device

Use cases: - See which exact license rows make the device show degraded or broken counts - Inspect expiry and grace timers for subscriptions, support, and smart-licensing signals - Review usage/capacity for finite license pools on the selected device

Data is sourced from the last successful SNMP collection. No extra SNMP requests are triggered when calling this function.

Aspect	Description
Name	Snmp:licenses
Require Cloud	no
Performance	Uses cached SNMP data only, no additional SNMP requests are triggered: • Responses are instantaneous from memory cache • Large devices with many licensing rows may return many rows
Security	Exposes licensing names, states, timers, counts, and impact notes only: • No credentials or secrets are exposed • No device configuration is modified
Availability	Available when: • The collector has completed at least one licensing-aware data collection cycle that produced licensing rows • Licensing data is cached from the last successful SNMP collection • Returns HTTP 503 if cache is not ready yet or the device/profile exposes no licensing rows

#Prerequisites

No additional configuration is required.

#Parameters

This function has no parameters.

#Returns

Normalized licensing rows for the selected SNMP device. Each row represents one cached normalized licensing entry from the collector.

Column	Type	Unit	Visibility	Description
License	string			Human-readable license row name, or the normalized license identifier when no name exists.
ID	string		hidden	Stable row identifier used by the UI to track one normalized licensing row across updates.
Bucket	string			Normalized health bucket for the row: healthy, informational, degraded, broken, or ignored.
State	string			Raw vendor licensing state when the device exposes one.
Component	string			Normalized component or area associated with the license row.
Type	string			Normalized license type such as subscription, certificate, authorization, evaluation, or usage pool.
Remaining	duration	milliseconds		Time remaining until the row's primary expiry, when applicable.
Expiry	timestamp			Absolute expiry time for the row, when known.
Usage	integer	licenses		Used license units for finite pools.
Capacity	integer	licenses		Total capacity for finite license pools.
Usage %	float	percentage		Usage pressure for finite license pools.
Impact	string			Operational impact text when the vendor or profile provides it.

#Troubleshooting

#Debug Mode

Important: Debug mode is not supported for data collection jobs created via the UI using the Dyncfg feature.

To troubleshoot issues with the snmp collector, run the go.d.plugin with the debug option enabled. The output should give you clues as to why the collector isn't working.

• Navigate to the plugins.d directory, usually at /usr/libexec/netdata/plugins.d/. If that's not the case on your system, open netdata.conf and look for the plugins setting under [directories].

  cd /usr/libexec/netdata/plugins.d/

• Switch to the netdata user.

  sudo -u netdata -s

• Run the go.d.plugin to debug the collector:

  ./go.d.plugin -d -m snmp

To debug a specific job:

  ./go.d.plugin -d -m snmp -j jobName

#Getting Logs

If you're encountering problems with the snmp collector, follow these steps to retrieve logs and identify potential issues:

• Run the command specific to your system (systemd, non-systemd, or Docker container).
• Examine the output for any warnings or error messages that might indicate issues. These messages should provide clues about the root cause of the problem.

#System with systemd

Use the following command to view logs generated since the last Netdata service restart:

journalctl _SYSTEMD_INVOCATION_ID="$(systemctl show --value --property=InvocationID netdata)" --namespace=netdata --grep snmp

#System without systemd

Locate the collector log file, typically at /var/log/netdata/collector.log, and use grep to filter for collector's name:

grep snmp /var/log/netdata/collector.log

Note: This method shows logs from all restarts. Focus on the latest entries for troubleshooting current issues.

#Docker Container

If your Netdata runs in a Docker container named "netdata" (replace if different), use this command:

docker logs netdata 2>&1 | grep snmp

#Debugging Gaps on Charts

If your SNMP charts show gaps, it means the collector could not finish metric collection before the next scheduled run. This usually happens when SNMP tables take longer to collect than your configured update_every.

These gaps do not mean the device stopped exporting SNMP metrics — only that the collector had to skip cycles.

Step 1: Check the Logs

Look for messages like:

level=warn msg="skipping data collection: previous run is still in progress for 4s (skipped 4 times in a row, interval 1s)" collector=snmp job=your_device
level=info msg="data collection resumed after 4.36s (skipped 4 times)" collector=snmp job=your_device

The “resumed after” message shows how long the previous collection actually took.
For example, if a run needs ~4.4 seconds and update_every is 1 second, 4 cycles will be skipped.

Step 2: Check Collection Timings

Open SNMP → Internal → Stats in the dashboard.
The SNMP profile collection timings chart shows how long each part of the SNMP polling takes.
Table metrics are usually the slowest and often determine the total collection time.

Step 3: Increase the data collection interval

Set update_every to a value higher than your slowest collection time, with some extra buffer for network variability.

Typical Collection Time	Recommended update_every
< 2 seconds	2 seconds
2–5 seconds	5 seconds
5–10 seconds	10 seconds
> 10 seconds	collection_time × 2

:::info

• Rule of thumb: update_every should be at least 2× your slowest table collection time.
  
• The default update_every: 10 works well in most environments.
  
• Only reduce it if your device consistently responds fast enough.

:::

Quick Checklist 1. Do logs show “skipping data collection”?
2. Does Internal → Stats show collection time > update_every?
3. Increase update_every until skips disappear.