Hermetry can read switches, routers, UPSs, servers, printers and other equipment with an SNMP agent. The platform’s poller asks the agent for the OIDs your device profile maps, and stores the answers as telemetry and attributes of the device. No MIB file is needed: you map numeric OIDs to keys.
What is supported
| Item | Support |
|---|---|
| Versions | SNMPv3 (recommended) and SNMPv2c (off until a workspace admin switches it on) |
| SNMPv3 security | authPriv (default) or authNoPriv; noAuthNoPriv is not offered |
| SNMPv3 authentication | SHA-256 (default), SHA-512, SHA-384, SHA-224, SHA-1 (legacy) |
| SNMPv3 encryption | AES-128 |
| Where the poller runs | In the cloud. The agent must be reachable at a public address, directly or through your VPN or tunnel. |
| Traps | Not received. The cloud has no trap listener. |
| Polling on site by a licensed gateway | In development |
| MIB files | Not used. Numeric OIDs only. |
Step 1: create the profile
- Under Device profiles, select New profile and choose SNMP as the Transport. The online rule is Last seen only.
- Open the profile’s SNMP tab and build the mapping (step 4). The built-in templates in SNMP templates reference list ready OIDs and keys for common equipment.
Step 2: add the device and its endpoint
Add it with Devices > New device > Network device, choose the SNMP protocol and a new endpoint. The steps are in Protocol endpoints. The SNMP endpoint fields:
| Field | Default | Notes |
|---|---|---|
| Agent | — | Host name or public IP address the cloud reaches the agent at |
| UDP port | 161 | 1 to 65,535 |
| SNMP version | SNMPv3 (recommended) | Or SNMPv2c (community in plaintext) |
| Community | — | v2c only. Secret, “Sent in plaintext with every request.” |
| User | — | v3 only |
| Security level | Authentication and encryption (authPriv) | Or Authentication only (authNoPriv) |
| Authentication | SHA-256 | v3 only |
| Authentication password | — | v3 only. Secret, at least 8 characters |
| Encryption | AES-128 | v3 with authPriv |
| Encryption password | — | v3 with authPriv. Secret, at least 8 characters |
| Context name | empty | Optional. “Most agents use the empty context.” |
| How the cloud reaches the agent | Through a VPN or tunnel (recommended) | Or Directly over the internet |
The connection test reads the system group (sysDescr, sysObjectID, sysUpTime, sysName). An agent that answers neither sysUpTime nor sysObjectID fails the test.
Warnings shown with a test (they do not fail it): “SNMPv2c: the community string travels in plaintext.”, “SNMPv2c directly over the internet: the community string crosses it in plaintext.”, “authNoPriv: messages are signed but not encrypted.”, “SHA-1 authentication is legacy.”
Step 3 (v2c only): switch on SNMPv2c
SNMPv2c sends its community in clear, so cloud v2c polling is off for every workspace until an admin turns it on. Saving a v2c endpoint while it is off is refused: “SNMPv2c polling from the cloud is switched off for this workspace. Use SNMPv3, save the endpoint switched off, or let a workspace admin switch v2c on below.”
- Under the refusal, select Switch on SNMPv2c for this workspace.
- Read the warning, tick “I understand that the community string travels in plaintext.” and select Switch on.
- Save or switch on the endpoint again. Switching v2c on does not switch any endpoint on by itself.
A v2c endpoint reached Directly over the internet also needs its own acknowledgement: “I understand that the community string crosses the internet in plaintext”.
Switching cloud v2c off again switches off every v2c endpoint of the workspace at once; their polling stops at the poller’s next refresh. Turning it on later re-enables nothing: switch each endpoint on again. Both changes are recorded in the audit log.
Step 4: map OIDs to keys
The profile’s SNMP tab, SNMP mapping, says “Which OIDs the platform reads from this profile’s devices and the keys it stores them as.”
Values (scalars): one OID, one key, read with every poll.
| Field | Meaning |
|---|---|
| OID | Numeric, for example 1.3.6.1.2.1.1.3.0 for sysUpTime.0 |
| Key | Starts with a letter; letters, digits and _ . : -, at most 96 characters |
| Stored as | Telemetry (a time series) or Attribute (the latest value) |
| Type | Automatic, Gauge / integer, Counter32, Counter64, TimeTicks (seconds), Text, Enumeration, IP address |
| Per-second rate | For counters: the change per second. The first sample after a start is skipped; a 32-bit wrap is handled. Not for attributes. |
| Scale | A multiplier, for example 0.1 to turn tenths into units. Not 0. |
| Unit | At most 16 characters |
| Values and their words | For an enumeration, one per line: 1=up. At most 64 values. |
Tables: walked columns. Every row of the table becomes one key per column, <key>.<row>.
| Field | Meaning |
|---|---|
| Name | A label for you (for example ifTable); not used by the platform |
| Rows named by | The row index (the OID suffix) or The value of another column (for example ifName, so keys read if.in_bps.eth0) |
| Row cap | 1 to 256 rows, default 64. More rows are dropped and reported. |
| Columns | 1 to 16 columns, each with the value fields above. Column OID is the column without the row index. |
Poll settings: Timeout (ms) 200 to 10,000 (default 2,000), Retries 0 to 3 (default 1), Rows per bulk request 1 to 50 (default 10). “The poll interval is the profile’s expected interval”; see Polling intervals, back-off and quota.
Select Save. The mapping is checked before it is saved:
| Limit | Value |
|---|---|
| Values | 200 rows |
| Tables | 8 |
| Telemetry keys a mapping can produce (every table full) | 200 per device |
| Attributes | 50 per device |
| Duplicate keys or OIDs | Not allowed |
The editor shows “This mapping produces up to {telemetry} telemetry keys and {attributes} attributes per device.” Lower a table’s row cap or remove columns when it is over.
Removing a value or table stops reading it at the next poll; stored history is kept.
Test poll
On the SNMP tab, Test poll asks one device of this profile for OIDs with its endpoint’s stored credentials. Nothing is stored.
- Choose the Device (one connected through an SNMP endpoint).
- Choose System group, This mapping’s values, or type OIDs (numeric, one per line, at most the number shown).
- Select Run test poll. The answer lists OID, SNMP type, Raw value and what it is Mapped to. Select Add to mapping on a row to add it (save afterwards).
Running a test poll needs the permission to manage protocol endpoints. Test polls are rate limited (“Too many test polls. Try again in {seconds} s.”).
Traps
The Traps list on the SNMP tab exists for trap mapping on licensed gateways on site, which is in development. The cloud does not receive traps. To be alerted quickly, poll the relevant status OIDs and add an alarm rule on their keys.
Troubleshooting
| Test poll says | Fix |
|---|---|
| “The agent did not answer in time (check the address, the port and the firewall or VPN).” | Allow the poller’s addresses to UDP 161 (or your port). |
| “Authentication failed (check user and keys).” | Wrong v3 user or authentication password. |
| “The agent could not decrypt the request (check the encryption password).” | Wrong encryption password. |
| “The agent does not know this SNMPv3 user.” | Create the user on the agent. |
| “The agent refused the request as out of its time window.” | Try again; check the agent’s clock. |
| “No such object” / “No such instance” | The agent does not have that OID. Check the OID and row index. |
| “SNMPv2c from the cloud is off for this account. A workspace admin can switch it on.” | See step 3. |