Set up SNMP data monitoring

You can use our guided install process to install the SNMP monitoring agent, or install the agent manually. This doc covers prerequisites to start this install process and a step-by-step walk through of your install options.

Prerequisites

Before you can start, you'll need to sign up for a New Relic account. If you choose to install the agent manually, you also need:

A New Relic account ID.
A New Relic .

If you're using Linux to install the agent as a service, you need:

SSH access to the host
Access to install/remove applications and services
One of these supported operating systems:
- CentOS 7
- CentOS 8
- Debian 12 (Bookworm)
- Debian 11 (Bullseye)
- Debian 10 (Buster)
- RedHat Enterprise Linux 9
- Ubuntu 20.04 (Focal LTS)
- Ubuntu 22.04 (Jammy LTS)
- Ubuntu 23.04 (Lunar)
Important
To receive SNMP Traps, the agent must bind to UDP 162. In a host-based install, the following command will be included during the install process. When executed, KTranslate will be run with elevated privileges.
sudo setcap cap_net_bind_service=+ep /usr/bin/ktranslate

Supported SNMP versions

Our network monitoring container supports all major versions of SNMP (v1, v2c, and v3), including both Traps and Informs. Additionally, SNMP v3 has support for the following authentication and privacy settings:

Setting	Protocol
Authentication	`NoAuth`
Authentication	`MD5`
Authentication	`SHA`
Authentication	`SHA224`
Authentication	`SHA256`
Authentication	`SHA384`
Authentication	`SHA512`
Privacy	`NoPriv`
Privacy	`DES`
Privacy	`AES`
Privacy	`AES192`
Privacy	`AES256`
Privacy	`AES192C`
Privacy	`AES256C`

Tip

We recommend using read-only community strings/authentication with SNMP.

Set up SNMP data monitoring in New Relic

Before reading about installing the SNMP agent manually, consider using our guided install process to avoid errors:

If you follow this manual installation process, support may be unable to assist you if issues arise. If you still wish to proceed, do the following:

Step 1 of 5

On a Linux host with Docker installed, download the ktranslate image by running one of the following:

Docker Hub
bash
```
$docker pull kentik/ktranslate:v2
```

Quay.io

bash

$docker pull quay.io/kentik/ktranslate:v2

Step 2 of 5

Copy the snmp-base.yaml file to the local $HOME directory of your Docker user, and discard the container by running

bash

$cd .
$id=$(docker create kentik/ktranslate:v2)
$docker cp $id:/etc/ktranslate/snmp-base.yaml .
$docker rm -v $id

Step 3 of 5

Edit the snmp-base.yaml file and define the discovery.cidrs and discovery.default_communities attributes to appropriate values for your network.

Tip

We recommend to set discovery.add_mibs: true to automate the addition of all discovered MIBs into the global.mibs_enabled attribute. Additionally, it is recommended to set discovery.check_all_ips: true to avoid discovery issues on devices with tightened security postures. If you intend to collect SNMP traps we also recommend changing the default value of listener: 127.0.0.1:1620 to listener: 0.0.0.0:1620

Step 4 of 5

Start the network monitoring agent to poll target devices and listen for incoming SNMP trap messages. Replace $CONTAINER_SERVICE with a unique name for the container and substitute$YOUR_NR_LICENSE_KEY and $YOUR_NR_ACCOUNT_ID with your values:

bash

$docker run -d --name ktranslate-$CONTAINER_SERVICE --restart unless-stopped --pull=always -p 162:1620/udp \
>-v `pwd`/snmp-base.yaml:/snmp-base.yaml \
>-e NEW_RELIC_API_KEY=$YOUR_NR_LICENSE_KEY \
>kentik/ktranslate:v2 \
>  -snmp /snmp-base.yaml \
>  -nr_account_id=$YOUR_NR_ACCOUNT_ID \
>  -metrics=jchf \
>  -tee_logs=true \
>  -service_name=$CONTAINER_SERVICE \
>  -snmp_discovery_on_start=true \
>  -snmp_discovery_min=180 \
>  nr1.snmp

Tip

It is not necessary to run a dedicated agent for trap collection as all SNMP polling agents will run a passive listener. By default the container will listen on the host's port 162 (UDP); but you can change the published port mapping in the docker run command - -p 162:1620/udp. If you do want a dedicated container, you can follow the steps in this section.

Step 5 of 5

Investigate your network performance data in the New Relic UI.

Optional installation for SNMP Traps

In some circumstances, it's beneficial to isolate the collection of SNMP trap messages into a dedicated container. This is helpful to control scale in large environments as well as creating a distributed monitoring footprint with lower risk of full outages if a container fails.

Step 1 of 3

On a Linux host with Docker installed, use the text editor of your choice to create the configuration file you'll use to run the container:

Example using vim:

bash

$sudo vim traps-base.yaml

File contents:

devices: {}
trap:
  listen: '0.0.0.0:1620'
discovery: {}
global:
  poll_time_sec: 300
  timeout_ms: 30000

By default the container will use the source IP address as device names in New Relic. You can control this by mapping devices manually in your configuration file:

devices:
  trap_source_host:    # Note: this YAML key needs to be unique for every device entry
    device_name: $YOUR_DEVICE_NAME
    device_ip: $YOUR_DEVICE_SOURCE_IP
    provider: kentik-trap-device
trap:
  listen: '0.0.0.0:1620'
discovery: {}
global:
  poll_time_sec: 300
  timeout_ms: 30000

Tip

You can also control device names by providing a -dns container argument at runtime. This will allow the container to run a lookup on the source IP address and try name resolution.

Step 2 of 3

Start the network monitoring agent to listen for incoming SNMP trap messages. Replace $CONTAINER_SERVICE with a unique name for the container and substitute$YOUR_NR_LICENSE_KEY and $YOUR_NR_ACCOUNT_ID with your values:

bash

$docker run -d --name ktranslate-$CONTAINER_SERVICE --restart unless-stopped --pull=always -p 162:1620/udp \
>  -v `pwd`/traps-base.yaml:/snmp-base.yaml \
>  -e NEW_RELIC_API_KEY=$YOUR_NR_LICENSE_KEY \
>kentik/ktranslate:v2 \
>  -snmp /snmp-base.yaml \
>  -nr_account_id=$YOUR_NR_ACCOUNT_ID \
>  -metrics=jchf \
>  -tee_logs=true \
>  -service_name=$CONTAINER_SERVICE
$  nr1.snmp

This will start the container that will listen for SNMP trap messages on $HOST_IP:162, where $HOST_IP is the IP address of your Docker host.

Step 3 of 3

Investigate your results in New Relic by querying the KSnmpTrap event type:

FROM KSnmpTrap SELECT *

Tip

It's important to remember that SNMP trap messages are events generated by the source device. If you aren't seeing messages in New Relic, ensure your devices have actually created messages. Vendor documentation on sending sample messages varies, but you can use snmptrap on your Docker host to send a test message like this:

bash

$snmptrap -v 2c -c public localhost '' 1.3.6.1.4.1.8072.2.3.0.1 1.3.6.1.4.1.8072.2.3.2.1 i 123456

What's next

You can set up more agents to complement your SNMP data:

To get better visibility into how your network is used, set up network flow data monitoring.
To get insights into system messages from your devices, setup network syslog collection.

Prerequisites

Docker prerequisites

Linux host prerequisites

Important

SNMP devices prerequisites

Network security prerequisites

Supported SNMP versions

SNMP v3 options

Tip

Set up SNMP data monitoring in New Relic

Guided install setup

Manual container setup

Tip

Tip

Optional installation for SNMP Traps

Manual container setup for SNMP traps

Tip

Tip

What's next

Did this doc help with your installation?