SNMP probes

The SNMP probes use the SNMP protocol to query a particular device for a list of OIDs, which are then traversed and the results passed back to the sensors.

Discovery supports SNMP versions 1, 2c, and 3. Discovery uses version 1 and 2c by default. You must enable support for version 3. MID Servers support all SNMP protocol versions by default. You can set a MID Server to only support specific versions of SNMP.

SNMP patterns

The Network Router pattern replaces the several SNMP-related probes for the discovery of routers and switches. See New patterns for the Jakarta release.

SNMP probe parameters

This list of parameters may be passed to the SNMP probes.

For instructions on configuring probe parameters, see Set probe parameters.

Parameter Description Default Value

A list of OID specifications, one per line. Each specification must be in one of the following two forms:

  • walk {OID}: Walks the OID and all its children
  • table {OID} {OID Children}: Walks all entries in the table, returning only the given children (for example, "")

{OID Children} refers to a comma-delimited list of child nodes within the entries for the given table. For example, "ifEntry.ifIndex,ifEntry.ifDescr,ifEntry.ifType" are OID children of the table "". As a convenience, the table entry prefix may be left off. (The preceding children could be specified as "ifIndex,ifDescr,ifType".)

Any child may include a filter qualifier in parentheses. For example, the child "entPhysicalContainedIn(=0)" specifies returning table entries only if the value of "entPhysicalContainedIn" equals 0. The operators supported in the expression are:
= equals
!= does not equal
# contains

If more than one child has a filter expression, a match on any one of the children causes that entry to be read.

Any content including and after a "//" is ignored (comments). Any OID that does not start with "" or "" automatically prefaces with "" as a convenience.

source The IP address or host name of the device to query SNMP on. required
index The index to apply after the community string, for Cisco-style community string indexing (for VLAN interrogation). 0
credential_id The sys_id of a specific credential that is preferred for use above the rest. 1 none
credential_tag The credential tag that must be used. 2 none

The timeout value (in milliseconds) to wait for a response, instead of the default. You can use this parameter to override the mid.snmp.request.timeout SNMP MID Server configuration parameter.

Note: When use_getbulk is set to true, the timeout value is for an individual GETBULK request.
established_session_timeout The interval (in milliseconds) to wait for a response after at least one response has been received. Longer values can be useful for collecting complete and accurate data. You can use this parameter to override the mid.snmp.session.timeout SNMP MID Server configuration parameter. 500
debug Enables debug logging. Set to true for debug mode. false
request_interval The interval (in milliseconds) between successive requests for an OID when a response has not been received. If this value is smaller than the timeout value (or established session timeout value), then multiple requests are sent if a device takes too long to respond. The default value is 250ms, or 0.25 seconds. For example, suppose that a device takes 0.9 seconds to respond to a query. Queries are sent, four in all, at t + 0, t + 250ms, t + 500ms, and t + 750ms. The device may respond with from 1 and 4 responses. If this value is set to at least as long as the timeout value, then only a single request is sent for any particular OID. 400
request_delay The interval (in milliseconds) between the receipt of a response and the transmission of the next request. The default is 0 (no delay). This value may be set to slow the overall rate of an SNMP query. 0
result_format Returns JSON formatted payloads for the SNMP - F5 BIG-IP - System and SNMP - Netscaler - System probes. This parameter returns data in a more compact format to prevent sensor failure or memory problems on a node when the payload becomes large. Do not change this value or delete this parameter.
Caution: Use of this parameter with any other probes causes the sensor to fail.

Enables the use of SNMP GETBULK requests to retrieve tabular data from SNMP devices instead of using multiple SNMP GETNEXT requests. For tabular data, GETBULK is more efficient. Regardless of the request type, certain devices may not return any results when they are busy with other tasks.

The established_session_timeout, request_interval, and request_delay parameters are ignored when use_getbulk is set to true. Instead, the retries parameter is available. The timeout configuration is the same one used by use_getscalar.

Note: SNMP GETBULK is only available on devices that support SNMPv2c or SNMPv3. Requests to devices configured to use SNMPv1 only, automatically revert to using GETNEXT with no further configuration required.
By default, the following probes use GETBULK requests (the parameter value is true).
  • SNMP - Switch - Vlan
  • SNMP - Switch - BridgePortTable
  • SNMP - Switch - ForwardingTable
  • SNMP - Switch - SpanningTreeTable
  • SNMP - Network - ArpTable
  • SNMP - Layer 2 Protocol Caches
  • SNMP - F5 BIG IP - System (only for Service Mapping customers)
Note: These probes have a timeout value of 5000.
use_getscalar Enables the use of simplified retrieval and handling of scalar values from SNMP devices.

The established_session_timeout, request_interval, and request_delay parameters are ignored when use_getscalar is set to true. Instead, the retries and timeout parameters are available. The timeout configuration is the same one used by use_getbulk.

retries The number of additional attempts Discovery makes to complete an individual GETBULK request (see use_getbulk) or a GETNEXT request when the use_getscalar parameter is set to true. 2

Load a MIB module

You can load an additional MIB module by creating a new ecc_agent_mib record and attaching the actual MIB file to the record.

About this task

MIBs are only loaded during MID Server startup. When the MID Server starts up, the following management information base (MIB) modules are loaded:
  • Modules that are bundled with the MID Server software. These MIBs are defined industry standards.
  • Modules that are included in each instance. These MIBs are provided by manufacturers for Discovery to extract specific information from a device.

You can view any errors associated with loading a MIB module in the agent log.


  1. Navigate to MID Server > SNMP MIBs.
  2. Check whether dependencies are met.
    If your new MIB has dependencies on another MIB, the MIB that fills the dependency must exist before you create your new record. Search the existing MIBs to check that the required MIBs are already loaded. If they are not, use this procedure to also add them to the instance.
  3. Click New to create a new record.
    The MID Server MIB File form opens to create a new ecc_agent_mib record.
  4. Use the following information to fill out the form:
    • Name: The name of the MIB.
    • Version: The version of the MIB.
    • Source: Use this field to note where the MIB was acquired, such as a URL.
    • Description: The description that appears in the ecc_agent_mib table.
    • Active: This check box denotes whether the MIB module is enabled or disabled in the instance.
  5. Click the Add Attachment icon () in the upper right to attach the actual MIB file to the new record.
    The MIB name must begin with an alphabetical character. Remaining characters must be one of the following: alphanumeric, hyphen ( - ), or underscore ( _ ). The file name must not have an extension. You can reference the existing MIBs for examples. Use the actual name of the MIB for both the MIB record name and the attachment name, but it is not required.
    Figure 1. MIB form

SNMP probe MIB modules

A management information base module (MIB) is a database that is used to manage elements in a network.

Your instance includes object definitions from the most common management information base (MIB) files. Before adding a new object definition, consult the list of MIB modules to ensure that the object definitions are not already available. The instance includes object definitions from the most common management information base (MIB) files. The MID Server MIB File [ecc_agent_mib] table is domain separated. You can create versions of these policies that only a MID Server from the same domain can use. For instructions, see Set up domain separation for MID servers.

The following table contains the MIBs that load automatically. The MIBs that are bundled with the MID Server are not visible in the instance. The MIBs that are in the ecc_agent_mib table are included in the instance by default and can be viewed in the MID Server > SNMP MIBs module.

Table 1. Management Information Base (MIB) module
Bundled with the MID Server Included in the instance
IPV6-MIB NetWare-Host-Ext-MIB
ISDN-MIB NetWare-Server-MIB
Printer-MIB PowerNet-MIB
1 This parameter is for internal use only and is not supported.
2 This parameter is for internal use only and is not supported.