SNMP Monitoring on Linux: Install snmpd, v3 Users and Queries

SNMP (Simple Network Management Protocol) is the classic way to monitor network devices and servers: routers, switches, firewalls, printers, UPSes, and Linux hosts all speak it. If your monitoring system (Zabbix, LibreNMS, PRTG, Observium, Nagios) already polls network gear via SNMP, enabling it on your Linux servers puts everything in one place.

SNMP in brief

Concept	Meaning
Agent	Runs on the monitored host (`snmpd` on Linux), answers queries
Manager	The monitoring system that polls agents
OID	A numeric ID for a value, e.g. `1.3.6.1.2.1.1.3.0` = system uptime
MIB	A file mapping OIDs to readable names (`SNMPv2-MIB::sysUpTime.0`)
Port	UDP 161 for queries, UDP 162 for traps

Versions:

v1 / v2c: authentication by a “community string”, sent in plain text. Fine only on trusted private networks.
v3: real users, authentication (SHA) and encryption (AES). Use v3 for anything crossing the internet.

Install

# Debian / Ubuntu
sudo apt update && sudo apt install -y snmpd snmp snmp-mibs-downloader
# RHEL / AlmaLinux / Rocky
sudo dnf install -y net-snmp net-snmp-utils

snmp provides the client tools (snmpwalk, snmpget). On Debian/Ubuntu, enable readable MIB names by commenting out mibs : in /etc/snmp/snmp.conf.

Configure snmpd

Edit /etc/snmp/snmpd.conf. By default it listens only on localhost:

# listen on all interfaces (or a specific private IP)
agentaddress udp:161,udp6:[::1]:161

sysLocation    Los Angeles DC
sysContact     [email protected]

# expose standard system, interface, disk and load data
view   systemonly  included   .1.3.6.1.2.1
view   systemonly  included   .1.3.6.1.4.1.2021

# disk and load thresholds (UCD-SNMP-MIB)
disk / 10%
load 12 10 8

Create an SNMPv3 user (recommended)

Stop the service, create the user, start again:

sudo systemctl stop snmpd
sudo net-snmp-create-v3-user -ro -a SHA -A 'AuthPass123!' -x AES -X 'PrivPass456!' monitor
sudo systemctl start snmpd
sudo systemctl enable snmpd

-ro makes the user read-only. Passwords must be at least 8 characters.

If you must use v2c (for an old manager on a private network), restrict it to one source address:

rocommunity  S3cretCommunity  10.0.0.5  -V systemonly

Never use the default public community.

Query the agent

From the monitoring server (or locally):

# v3
snmpwalk -v3 -l authPriv -u monitor -a SHA -A 'AuthPass123!' -x AES -X 'PrivPass456!' 10.0.0.10 system
snmpget  -v3 -l authPriv -u monitor -a SHA -A 'AuthPass123!' -x AES -X 'PrivPass456!' 10.0.0.10 sysUpTime.0

# v2c
snmpwalk -v2c -c S3cretCommunity 10.0.0.10 .1.3.6.1.2.1.1

Useful OIDs

What	Name / OID
Uptime	`SNMPv2-MIB::sysUpTime.0`
Hostname	`SNMPv2-MIB::sysName.0`
Interface traffic	`IF-MIB::ifHCInOctets`, `ifHCOutOctets`
Load average	`UCD-SNMP-MIB::laLoad` (`.1.3.6.1.4.1.2021.10.1.3`)
Memory	`UCD-SNMP-MIB::memTotalReal`, `memAvailReal`
Disk usage	`UCD-SNMP-MIB::dskPercent` (needs `disk` lines)
CPU	`HOST-RESOURCES-MIB::hrProcessorLoad`
Storage	`HOST-RESOURCES-MIB::hrStorageUsed`

Use the 64-bit ifHC* counters on fast interfaces: 32-bit counters wrap quickly at 1 Gbps.

Firewall

Allow UDP 161 only from your monitoring server:

sudo ufw allow from 10.0.0.5 to any port 161 proto udp

See UFW firewall. On a public VPS, never leave SNMP open to the internet: open v2c agents leak system details and can be abused for amplification attacks.

Connect a monitoring system

LibreNMS / Observium: add the device with SNMPv3 credentials. They auto-discover interfaces, storage, CPU and draw graphs.
Zabbix: use the “Linux by SNMP” template, with the v3 credentials in the host’s SNMP interface.
Prometheus: the snmp_exporter translates SNMP to Prometheus metrics, which is useful for network gear. For Linux servers, node_exporter is usually simpler and richer. See Prometheus node exporter.

SNMP or an agent?

	SNMP	Agent-based (node_exporter, Zabbix agent, Netdata)
Network devices	Yes: the standard	Usually not available
Linux detail	Basic metrics	Much richer
Security	v3 needed	TLS / local scraping
Setup	Often already supported by NMS	Extra install

Many teams use SNMP for switches and routers, and agents for servers. See Netdata monitoring and uptime monitoring tools.

Troubleshooting

Timeout: firewall blocks UDP 161, or snmpd only listens on localhost (sudo ss -ulnp | grep 161).
“Unknown user name”: the v3 user wasn’t created while snmpd was stopped; recreate it.
Only system OIDs return: the view doesn’t include the subtree you’re walking.
Logs: journalctl -u snmpd.

Linux
Monitoring
Networking