You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
SNMP Traps are notifications sent from an SNMP-enabled device to an SNMP manager. When a network device encounters unusual activity, such as a sudden state change on a piece of equipment, the device triggers an SNMP Trap event.
15
+
SNMP traps are notifications sent from an SNMP-enabled device to an SNMP manager when unusual activity occurs, such as a sudden state change on a piece of equipment.
16
16
17
-
Monitoring SNMP Traps helps you to capture issues that might otherwise go unnoticed due to device instability. For example, if an interface is flapping between an available and a broken state every 15 seconds, relying on polls that run every 60 seconds could lead you to misjudge the degree of network instability. Traps can also fill visibility gaps for certain hardware components, such as device battery or chassis health.
17
+
Monitoring SNMP traps helps you capture issues that might otherwise go unnoticed due to device instability. For example, if an interface flaps between available and broken states every 15 seconds, polling every 60 seconds could miss the degree of network instability. Traps also provide visibility into the health of hardware components, such as device battery or chassis.
18
18
19
-
Datadog Agent v7.37+ supports listening for SNMP Traps, enabling you to set up [monitors][1] for specific Trap events.
19
+
Datadog Agent v7.37+ supports listening for SNMP traps, enabling you to configure [monitors][1] for specific trap events.
20
20
21
21
## Configuration
22
22
23
-
1. To enable listening for SNMP traps, add the following to your `datadog.yaml` file:
23
+
To enable listening for SNMP traps, use the following instructions:
24
+
25
+
1. Ensure that your [firewall rules][7] allow incoming UDP traffic on the configured port.
26
+
2. Add the following to your `datadog.yaml` file:
24
27
25
28
```yaml
26
29
network_devices:
@@ -52,17 +55,15 @@ Datadog Agent v7.37+ supports listening for SNMP Traps, enabling you to set up [
52
55
53
56
**Note**: Multiple v3 users and passwords are supported as of Datadog Agent `7.51` or higher.
54
57
55
-
**Note**: Ensure that your [firewall rules][7] allow incoming UDP traffic on the configured port.
56
-
57
-
2. Once configured, SNMP traps are forwarded as logs and can be found in the [Log Explorer][2] with the following search query: `source:snmp-traps`.
58
+
After configuration, SNMP traps are forwarded as logs to Datadog. You can find them in the [Log Explorer][2] with the following search query: `source:snmp-traps`.
58
59
59
-
{{< img src="network_device_monitoring/snmp/snmp_logs_2.png" alt="Log Explorer showing `source:snmp-traps` with an SNMP Trap log line selected, highlighting the Network Device tag" style="width:90%" >}}
60
+
{{< img src="network_device_monitoring/snmp/snmp_traps_3.png" alt="Log Explorer showing `source:snmp-traps` with an SNMP trap log line selected, highlighting the Network Device tag" style="width:90%" >}}
60
61
61
-
**Note**: Even though SNMP traps are _forwarded as logs_, `logs_enabled` does **not** need to be set to `true`.
62
+
<div class="alert alert-info">Even though SNMP traps are <em>forwarded as logs</em>, <code>logs_enabled</code> does <strong>not</strong> need to be set to <code>true</code>.</div>
62
63
63
-
### Using the default SNMP Trap port 162
64
+
### Using the default SNMP trap port 162
64
65
65
-
Binding to a port number under 1024 requires elevated permissions. To bind to a port number such as the default SNMP Trap port 162, do the following:
66
+
Binding to a port number under `1024` requires elevated permissions. To bind to a port number such as the default SNMP Trap port `162`, use the following instructions:
66
67
67
68
1. Grant access to the port using the `setcap` command:
68
69
@@ -88,20 +89,21 @@ Binding to a port number under 1024 requires elevated permissions. To bind to a
88
89
89
90
## Device namespaces
90
91
91
-
As in [Network Device Monitoring][3], namespaces can be used as tags to differentiate between multiple network devices that may share the same private IP. For example, consider a case of two routers: one in New York and one in Paris, which share the same private IP. There should be one Agent in the New York data center and another in the Paris data center. You may wish to tag these with `namespace: nyc` and `namespace: paris`, respectively.
92
+
As with [Network Device Monitoring][3], use namespace tags to differentiate between multiple network devices that share the same private IP. For example, you could have two routers that share the same private IP: one in New York, and another in Paris. In this case, you can deploy an Agent in the New York data center that sends telemetry tagged with `namespace: nyc`; and a second Agent in the Paris data center that sends telemetry tagged with `namespace: paris`.
92
93
93
-
The namespace can then be used to uniquely pivot from an SNMP Trap to the emitter device, or from the emitter device to an SNMP Trap.
94
+
The namespace can then be used to uniquely pivot from an SNMP trap to the emitter device, or from the emitter device to an SNMP trap.
94
95
95
-
It is critical to have consistency between the multiple Agent configurations. For instance, if you have two Agents configured (for example, one for trap collection, and the other for metrics) you must ensure that the namespaces exist in both places. Alternatively, ensure that the namespaces exist in neither.
96
+
**Note**: If you are using namespace tags on any of your Agents, ensure that all of your Agents are using namespace tags. Do not configure namespace tags for only a subset of your Agents.
96
97
97
98
## Resolution
98
99
99
-
Each SNMP Trap has a specific OID-based format. The Datadog Agent performs a _resolution_ step to convert OIDs into more readable strings.
100
+
Each SNMP trap has a specific {{< tooltip text="object identifier (OID)" tooltip="A unique ID or address on a device that when polled returns the response code of that value." >}} based format. The Datadog Agent performs a _resolution_ step to convert OIDs into more readable strings.
100
101
101
-
An SNMP Trap consists of:
102
-
- Emitter information (for example, the IP of the device)
103
-
- An OID that defines the type of trap
104
-
- "Variables"—that is, a list of pairs (`OID:value`) that provides additional context for the trap.
102
+
An SNMP trap consists of:
103
+
104
+
- Emitter information (for example, the IP of the device).
105
+
- An OID that defines the type of trap.
106
+
- Metadata: A list of pairs (`OID:value`) that provides additional context for the trap.
105
107
106
108
Decoding is performed on the Agent side, using a mapping stored on disk at `$<PATH_TO_AGENT_CONF.D>/snmp.d/traps_db/dd_traps_db.json.gz`. Datadog supports more than 11,000 different management information bases (MIBs).
107
109
@@ -160,12 +162,13 @@ You can write these mappings by hand, or generate mappings from a list of MIBs u
Put all your MIBs into a dedicated folder. Then, run:
164
-
`ddev meta snmp generate-traps-db -o ./output_dir/ /path/to/my/mib1 /path/to/my/mib2 /path/to/my/mib3 ...`
165
+
Place all your MIBs in a dedicated folder and run:
165
166
166
-
If your MIBs have dependencies, `ddev` fetches them online if they can be found.
167
+
```shell
168
+
ddev meta snmp generate-traps-db -o ./output_dir/ /path/to/my/mib1 /path/to/my/mib2 /path/to/my/mib3 ...
169
+
```
167
170
168
-
If there are errors due to missing dependencies and you have access to the missing MIB files, put the files in a separate folder and use the `--mib-sources <DIR>` parameter so that ddev knows where to find them. Make sure that each filename is the same as the MIB name (for example, `SNMPv2-SMI` and not `snmp_v2_smi.txt`).
171
+
The `ddev` tool automatically fetches available MIB dependencies. If you encounter missing dependency errors and have the MIB files locally, use the `--mib-sources <DIR>` parameter to specify the location of your local MIB files. Ensure filenames match the MIB name (for example, `SNMPv2-SMI`, not `snmp_v2_smi.txt`).
0 commit comments