SNMP Monitoring

Prerequisites

• User role with discovery.view (read) or discovery.manage (write/poll)
• At least one managed host with a running agent in the same network as the SNMP devices (the probe host)
• SNMP credentials matching the target devices' configuration (community string for v1/v2c, or v3 auth credentials)
• Network connectivity from the probe host to the SNMP device on the configured port (default 161)

Understanding SNMP Monitoring

SNMP polling works the same way as discovery: the platform dispatches a poll job to a probe host agent, the agent performs the SNMP GET operations against the target device, and results come back asynchronously. The backend never contacts SNMP devices directly.

SPOG supports SNMP v1, v2c, and v3. Credentials are encrypted at rest. Community strings are never returned in API responses — only a has_community_string: true/false flag.

Device Statuses

Configuring SNMP Credentials

Credentials are organization-scoped and shared across devices within the same org.

Create a Credential

1. Navigate to SNMP > Credentials and click Create Credential.
2. For v1/v2c: provide a community string (required).
3. For v3: provide a username (required), plus optional security fields.

Update and Delete Credentials

• Open a credential and click Edit to update name, version, community string, or v3 fields.
• Click Delete to remove a credential. Deletion only succeeds if no devices reference this credential.

Adding SNMP Devices

Manual Registration

1. Navigate to SNMP > Devices and click Add Device.
2. The device is created in active status with polling enabled.
3. The scheduler begins polling automatically based on the configured poll interval.

From Discovery

Devices found via network discovery scans can be manually added as SNMP devices by creating a device record with the discovered IP address and assigning an SNMP credential.

SNMP Polling

Manual Poll

1. Open the device detail page and click Poll Now.
2. A poll job is dispatched to the probe host.
3. When the poll completes, the device's system info, interfaces, and status are updated.
4. Device type is auto-classified from the SNMP system OID and description if currently unknown.

Scheduled Polling

The scheduler checks every 60 seconds for devices due for a poll. A device is polled when:

• The device is enabled
• Status is not disabled
• Both probe host and credential are configured
• Enough time has elapsed since the last poll (based on the configured poll interval)
• No pending poll job already exists for this device

Poll Results

When a poll completes successfully, the following data is updated on the device record:

If the poll fails due to timeout or connection refused, the device status is set to unreachable. A successful subsequent poll restores it to active.

Auto-Classification

When a device has an unknown type, the first successful poll automatically classifies it using the SNMP system object ID prefix:

If the OID doesn't match, a fallback keyword search runs against the system description looking for: switch, router, printer, ups, access point, wireless, firewall, fortigate, palo alto.

Managing Device Configuration

• Open a device and click Edit to update hostname, credential, probe host, port, device type, poll interval, or enabled status.
• When changing credential or probe host, the new resource must be in the same organization.
• Disable a device to stop scheduled polling without deleting the device record.
• Click Delete to permanently remove the device record.

Use the device list filters (organization, status, device type, search) to find devices. Click a device row for full detail including interface data and extra MIB data.

SNMP Dashboard

The SNMP Dashboard shows aggregate metrics for all SNMP devices accessible to the current user.

SNMP trap ingestion

Cadres supports agent-based SNMP trap collection. Because the backend is cloud-hosted and cannot receive inbound SNMP traps directly from customer networks, traps are collected by a managed agent running inside the customer's network and forwarded to the backend as events.

How it works

1. A managed agent in the customer network is configured as the trap receiver.
2. Network devices send SNMP traps to the agent's IP address on the configured trap port.
3. The agent collects, parses, and batches the trap data.
4. Trap data is forwarded to the backend via the agent's standard authenticated API channel.
5. The backend processes traps through the event alert pipeline, creating alerts for matching event rules.

Discovery-to-SNMP auto-provisioning

When agentless network discovery finds devices that respond to SNMP probes, Cadres can automatically create SNMP device records from discovered hosts. The system links SNMP devices back to their discovery origin.

1. Run a network scan discovery job targeting the subnet containing SNMP-capable devices.
2. Discovered hosts that respond to SNMP queries are flagged as SNMP-capable.
3. Promote the discovered host to a managed SNMP device using the auto-provisioning workflow.
4. The system creates the SNMP device record with the correct IP, assigns the specified credential, and begins scheduled polling.

Unreachable device alerting

When an SNMP device transitions to "unreachable" status, the system fires an event alert. When the device recovers and responds to polling again, the alert auto-resolves. This integrates with the full event alert pipeline including incident correlation and notification.

Permissions Reference

Troubleshooting