Monitoring and logs

snmpwalk

Also snmpget, snmptranslate, snmpbulkwalk, net-snmp, SNMP

Reads values from a device's SNMP agent: one with snmpget, a whole subtree with snmpwalk.

The net-snmp tools ask an agent on UDP 161. snmpget reads named values; snmpwalk reads every value below an OID, such as the whole interface table. snmptranslate turns names into numbers and back, using the MIB files on your own machine. v2c needs the community (-c); v3 a user, a level and passwords (-u -l -a -A -x -X).

snmpwalk command usage

snmpget -v2c -c COMMUNITY [-Oqv] HOST OID...
snmpwalk -v2c -c COMMUNITY HOST [OID]
snmpget -v3 -u USER -l authPriv -a SHA -A AUTHPASS -x AES -X PRIVPASS HOST OID
snmptranslate [-On|-Of] OID

Options

-v2c / -v3: the SNMP version
-c n3tops-ro: v2c: the community string, sent in the clear
-u monitor -l authPriv: v3: the user, and signed and encrypted (authNoPriv: signed only)
-a SHA -A …: v3: the signing hash and its password
-x AES -X …: v3: the encryption and its password
-Oqv: print only the value
-On: print OIDs as numbers
-t 2 -r 1: wait 2 seconds for an answer, retry once

snmpwalk examples

snmpget -v2c -c n3tops-ro coreRouter.lab sysName.0 sysUpTime.0: Reads the router's name and how long its agent has run.
snmpwalk -v2c -c n3tops-ro coreRouter.lab system: Reads the whole system group: description, contact, name, location.
snmpwalk -v2c -c n3tops-ro coreRouter.lab IF-MIB::ifDescr: Lists the router's cards by ifIndex.
snmpget -v2c -c n3tops-ro -Oqv coreRouter.lab IF-MIB::ifHCOutOctets.3: Prints how many bytes card 3 has sent, as a bare number.
snmpget -v3 -u monitor -l authPriv -a SHA -A monitor-auth-pass -x AES -X monitor-priv-pass coreRouter.lab sysName.0: Reads the name with SNMPv3, signed and encrypted.
snmptranslate -On SNMPv2-MIB::sysName.0: Prints the numeric OID behind a name.

Reading the output

$ snmpwalk -v2c -c n3tops-ro coreRouter.lab system
SNMPv2-MIB::sysDescr.0 = STRING: Linux coreRouter 6.10.14-linuxkit #1 SMP aarch64
SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (5321) 0:00:53.21
SNMPv2-MIB::sysContact.0 = STRING: netops@example.lab
SNMPv2-MIB::sysName.0 = STRING: coreRouter
SNMPv2-MIB::sysLocation.0 = STRING: Server room, rack 2

Each line: the value's name (MIB and object), its instance (.0 for a single value), its type and the value.
Timeticks are hundredths of a second.
Timeout: No Response from v2c: wrong community, a network the community is not allowed from, or no agent. It never says which.

Pitfalls

A wrong v2c community gets no answer at all, not an error: it looks the same as a dead device.
ifInOctets/ifOutOctets are 32-bit and wrap after 4 GB: use ifHCInOctets/ifHCOutOctets.
Agents cache counters for a few seconds: two reads a second apart can return the same number.

Run it on real machines