SNMP Service

This covers snmpd, the Net-SNMP agent that runs on a Linux machine and answers SNMP queries about that machine itself - CPU, memory, disk, network interfaces, and so on, via HOST-RESOURCES-MIB and the standard system MIBs. If you want your own Linux servers to show up when something polls them over SNMP, this is the daemon that makes that happen.

Installing snmpd

# Debian / Ubuntu
sudo apt install snmpd

# RHEL / CentOS / Fedora
sudo dnf install net-snmp

Basic configuration

Configuration lives in /etc/snmp/snmpd.conf. A minimal working config just needs a community string and what it's allowed to see:

# /etc/snmp/snmpd.conf

# Read-only access for anything asking with community "public",
# restricted to a specific subnet
rocommunity public 10.0.0.0/24

syslocation "Rack 4, DC1"
syscontact  admin@example.com

# Listen on all interfaces, standard port
agentaddress udp:161

Restart the service after any config change:

sudo systemctl restart snmpd
sudo systemctl enable snmpd   # start on boot

Test it locally before assuming it's broken remotely:

snmpwalk -v2c -c public localhost system

More advanced configuration

SNMPv3 instead of a plaintext community string

# Run this once, interactively, then restart snmpd - it creates the
# user and writes the resulting config into /var/lib/snmp/snmpd.conf
sudo net-snmp-create-v3-user -a authpassword -A SHA -x privpassword -X AES myuser

After that, remote queries authenticate as that user instead of a shared community string:

snmpget -v3 -u myuser -l authPriv -a SHA -A authpassword -x AES -X privpassword localhost sysDescr.0

Restricting what a community/user can actually see (views)

By default, rocommunity without a view exposes the whole standard MIB tree. To limit visibility - for example, allowing monitoring tools to see interface stats but not process/user listings - define a view and reference it:

# /etc/snmp/snmpd.conf
view  systemview included .1.3.6.1.2.1.1     # sysDescr, sysName, etc.
view  systemview included .1.3.6.1.2.1.2     # interfaces
rocommunity public 10.0.0.0/24 -V systemview

Exposing a custom value with extend

To surface something snmpd doesn't natively know about - the output of a local script, a custom health check - extend runs a command and makes its output available over SNMP under NET-SNMP-EXTEND-MIB:

# /etc/snmp/snmpd.conf
extend disk-check /usr/local/bin/check_disk_usage.sh

# Querying it back:
snmpwalk -v2c -c public localhost NET-SNMP-EXTEND-MIB::nsExtendOutputFull

Fully custom OIDs with pass / pass_persist

For cases where extend isn't flexible enough - you want the data to live under your own private enterprise OID rather than the generic extend tree - pass hands off an entire OID subtree to an external script that implements GET/GETNEXT itself:

# /etc/snmp/snmpd.conf
pass .1.3.6.1.4.1.99999.1 /usr/local/bin/my_custom_oid_handler.sh

pass re-launches the script on every request (simple, but slower under load); pass_persist keeps one long-running instance of the script and talks to it over stdin/stdout, which is the better choice for anything queried frequently.