Docs
test1test2
6.5
6.5
  • ElastiFlow Documentation
  • Unified Flow Collector
    • General Configuration
    • Changelog
    • Maxmind GeoIP2 and GeoLite2
    • RiskIQ PassiveTotal
    • Network Interfaces
    • User-Defined Metadata
    • Docker
    • Linux
    • Unified Flow Collector Introduction
    • System Requirements
    • Supported IEs
    • AWS VPC Flow Log IEs
    • IPFIX IEs
    • Netflow IEs
    • sFlow IEs
  • Unified SNMP Collector
    • Device Groups
    • Changelog
    • Devices
    • Downloading Definitions
    • Enumerations
    • Objects
    • Object Groups
    • User-Defined Metadata
    • Docker
    • Network Interfaces
    • United SNMP Collector Introduction
    • Linux
    • Scheduling Rediscovery
  • Monitoring ElastiFlow
    • Liveness & Readiness
    • Metrics
    • Prometheus & Grafana
  • Configuration Reference
    • YAML Configuration Files
    • Configuration Reference Overview
    • Common
      • API
      • Licensing
      • Overview
      • Logging
      • HTTP output
      • Elasticsearch output
      • Kafka output
      • Monitor output
      • OpenSearch output
      • Splunk output
      • stdout output
      • Processor
    • Unified Flow Collector
      • Overview
      • Community/Conversation IDs
      • EF_PROCESSOR_ENRICH_TOTALS_IF_NO_DELTAS
      • Overview
      • RiskIQ PassiveTotal
      • Maxmind
      • User-Defined Metadata
      • Overview
      • Overview
      • User-Defined Metadata
      • Overview
      • Benchmark Input
      • Netflow/IPFIX/sFlow (UDP)
      • Licensing
      • Decoder/Processor
      • Sample Rate
      • Configuration Changes
    • Unified SNMP Collector
      • User-Defined Metadata
      • Overview
      • Licensing
      • SNMP Poller
      • EF_PROCESSOR_SNMP_ENUM_DEFINITIONS_DIRECTORY_PATH
  • API Reference
    • API Reference Overview
    • SNMP Operations
  • Data Platforms
    • Elastic
      • Basic Cluster
      • Advanced Cluster
      • Single Server
      • Multi-Tier Cluster
      • Single "Lab" Server
      • Elasticsearch
      • ElastiFlow vs. Filebeat and Logstash
      • RHEL/CentOS
      • Ubuntu/Debian
      • Kibana
      • ML
        • Network Security
        • Machine Learning
        • Availability
          • Network Availability
          • DHCP
          • LDAP
          • DNS
          • NTP
          • RADIUS
          • TCP Sessions
        • Network Security Activity
          • Rare Autonomous System
          • Network Activity
          • Rare Conversation
          • Rare Geolocation
        • Network Security Brute Force
          • Brute Force CLI Access
          • Brute Force Remote Desktop Access
          • Brute Force Attacks
        • Network Security DDoS
          • Denial-of-Service
          • ICMP Flood Attack
          • SYN Flood Attack
          • TCP DDoS Attack
          • UDP Amplification Attack
        • Network Security Recon
          • ICMP Scan
          • Reconnaissance
          • Port Scan
        • Performance
          • Unusual ASN Traffic Volume
          • Unusual Network Interface Traffic Volume
          • Network Performance
    • Opensearch
      • Dashboards
      • Auth Sig V4
    • Splunk
      • Default Search Macro
      • Configuring Data Input & Index
      • Splunk App Installation
    • Output Configuration
  • Additional Guides
    • Catalyst (sFlow)
    • FortiGate
    • hsflowd
    • Configuring Flow Sampling on Juniper Routers
    • Junos OS (sFlow)
    • MikroTik RouterOS
    • OpenWRT (softflowd)
    • Ubiquiti EdgeRouter
    • SonicWall
    • Junos OS
    • Extending SNMP Device Support
    • Flow Device Support Overview
    • SNMP Device Support Overview
    • Generating A Support Bundle
  • FAQ
    • Flows stopped showing up in Kibana (Disk(s) Full)
    • Common reasons why you have discrepancies between ElastiFlow data & reality
    • What Are Snapshots?
    • Importing the wrong dashboards (No data)
  • Knowledge Base
    • Config
      • Elasticsearch Authentication Failure
      • CA Certificate Path Incorrect
      • license/error Invalid Segments
    • Flow
      • Bidirectional Flow Support
      • Configure the UDP Input
      • Flow Records Not Received
      • Netflow v9/IPFIX Template Not Receieved
      • Unsupported sFlow Structures
    • General
      • License Has Expired
      • License Agreement Not Accepted
    • Install
      • .deb Upgrade Fails File Overwrite
    • Operation
      • Flow Collector Queues 90% Full
      • Dashboard Updates
      • Change elastiflow-* Index Name?
  • Elastic Stack Deployment
  • Download Links
Powered by GitBook
On this page
  1. Configuration Reference
  2. Unified SNMP Collector

SNMP Poller

The ElastiFlow Unified SNMP Collector can poll devices for metrics, status and other telemetry using SNMP.

EF_INPUT_SNMP_POLLER_WORKER_POOL_SIZE

When the SNMP poller input is enabled a pool of poller workers is initialized to provide concurrent polling of multiple devices and objects. The default size of this pool is 4 times the number of CPU threads (real cores + HT/SMT threads). This setting allow a specific pool size to be configured.

  • Minimum Value

    • 1

  • Default

    • CPU threads * 4

EF_INPUT_SNMP_POLLER_ERROR_HANDLING

This configuration determines the approach of the SNMP poller in managing SNMP Get request errors. There are three modes:

  1. Full Error Handling: The SNMP poller will modify the device object schedule for all types of errors. However, this mode is not advised for production environments, as it may lead to unnecessary schedule changes.

  2. Partial Error Handling: In this mode, the SNMP poller adjusts the device object schedule only for errors that are not transient. This is more selective and avoids reacting to temporary issues.

  3. No Error Handling: The SNMP poller will not alter the device object schedule in response to any errors.

  • Valid Values

    • none, partial, full

  • Default

    • partial

EF_INPUT_SNMP_DEVICE_DEFINITIONS_DIRECTORY_PATH

This setting specifies the path to the directory where the Device definitions files are located.

  • Default

    • /etc/elastiflow/snmp/devices

EF_INPUT_SNMP_DEVICE_GROUP_DEFINITIONS_DIRECTORY_PATH

This setting specifies the path to the directory where the Device Group definitions files are located.

  • Default

    • /etc/elastiflow/snmp/device_groups

EF_INPUT_SNMP_OBJECT_GROUP_DEFINITIONS_DIRECTORY_PATH

This setting specifies the path to the directory where the Object Group definitions files are located.

  • Default

    • /etc/elastiflow/snmp/object_groups

EF_INPUT_SNMP_OBJECT_DEFINITIONS_DIRECTORY_PATH

This setting specifies the path to the directory where the Object definitions files are located.

  • Default

    • /etc/elastiflow/snmp/objects

EF_INPUT_SNMP_DEFAULTS_DIRECTORY_PATH

This setting specifies the path to the directory where the Device default definition files are located.

  • Default

    • /etc/elastiflow/snmp/defaults

EF_INPUT_SNMP_PERSIST_ENABLE

The ElastiFlow Unified SNMP Collector can persist the discovered inventory of SNMP objects, preventing the need for the inventory to be rebuilt when the collector is restarted. This setting specifies whether this feature is enabled.

  • Valid Values

    • true, false

  • Default

    • true

EF_INPUT_SNMP_PERSIST_DIRECTORY_PATH

When inventory persistence is enabled (EF_INPUT_SNMP_PERSIST_ENABLE is true), this setting specifies the path to the directory where the files will be written.

  • Default

    • /usr/share/elastiflow/snmpcoll

PreviousLicensingNextEF_PROCESSOR_SNMP_ENUM_DEFINITIONS_DIRECTORY_PATH