Docs
test1test2
6.5
6.5
  • ElastiFlow Documentation
  • Unified Flow Collector
    • General Configuration
    • Changelog
    • Maxmind GeoIP2 and GeoLite2
    • RiskIQ PassiveTotal
    • Network Interfaces
    • User-Defined Metadata
    • Docker
    • Linux
    • Unified Flow Collector Introduction
    • System Requirements
    • Supported IEs
    • AWS VPC Flow Log IEs
    • IPFIX IEs
    • Netflow IEs
    • sFlow IEs
  • Unified SNMP Collector
    • Device Groups
    • Changelog
    • Devices
    • Downloading Definitions
    • Enumerations
    • Objects
    • Object Groups
    • User-Defined Metadata
    • Docker
    • Network Interfaces
    • United SNMP Collector Introduction
    • Linux
    • Scheduling Rediscovery
  • Monitoring ElastiFlow
    • Liveness & Readiness
    • Metrics
    • Prometheus & Grafana
  • Configuration Reference
    • YAML Configuration Files
    • Configuration Reference Overview
    • Common
      • API
      • Licensing
      • Overview
      • Logging
      • HTTP output
      • Elasticsearch output
      • Kafka output
      • Monitor output
      • OpenSearch output
      • Splunk output
      • stdout output
      • Processor
    • Unified Flow Collector
      • Overview
      • Community/Conversation IDs
      • EF_PROCESSOR_ENRICH_TOTALS_IF_NO_DELTAS
      • Overview
      • RiskIQ PassiveTotal
      • Maxmind
      • User-Defined Metadata
      • Overview
      • Overview
      • User-Defined Metadata
      • Overview
      • Benchmark Input
      • Netflow/IPFIX/sFlow (UDP)
      • Licensing
      • Decoder/Processor
      • Sample Rate
      • Configuration Changes
    • Unified SNMP Collector
      • User-Defined Metadata
      • Overview
      • Licensing
      • SNMP Poller
      • EF_PROCESSOR_SNMP_ENUM_DEFINITIONS_DIRECTORY_PATH
  • API Reference
    • API Reference Overview
    • SNMP Operations
  • Data Platforms
    • Elastic
      • Basic Cluster
      • Advanced Cluster
      • Single Server
      • Multi-Tier Cluster
      • Single "Lab" Server
      • Elasticsearch
      • ElastiFlow vs. Filebeat and Logstash
      • RHEL/CentOS
      • Ubuntu/Debian
      • Kibana
      • ML
        • Network Security
        • Machine Learning
        • Availability
          • Network Availability
          • DHCP
          • LDAP
          • DNS
          • NTP
          • RADIUS
          • TCP Sessions
        • Network Security Activity
          • Rare Autonomous System
          • Network Activity
          • Rare Conversation
          • Rare Geolocation
        • Network Security Brute Force
          • Brute Force CLI Access
          • Brute Force Remote Desktop Access
          • Brute Force Attacks
        • Network Security DDoS
          • Denial-of-Service
          • ICMP Flood Attack
          • SYN Flood Attack
          • TCP DDoS Attack
          • UDP Amplification Attack
        • Network Security Recon
          • ICMP Scan
          • Reconnaissance
          • Port Scan
        • Performance
          • Unusual ASN Traffic Volume
          • Unusual Network Interface Traffic Volume
          • Network Performance
    • Opensearch
      • Dashboards
      • Auth Sig V4
    • Splunk
      • Default Search Macro
      • Configuring Data Input & Index
      • Splunk App Installation
    • Output Configuration
  • Additional Guides
    • Catalyst (sFlow)
    • FortiGate
    • hsflowd
    • Configuring Flow Sampling on Juniper Routers
    • Junos OS (sFlow)
    • MikroTik RouterOS
    • OpenWRT (softflowd)
    • Ubiquiti EdgeRouter
    • SonicWall
    • Junos OS
    • Extending SNMP Device Support
    • Flow Device Support Overview
    • SNMP Device Support Overview
    • Generating A Support Bundle
  • FAQ
    • Flows stopped showing up in Kibana (Disk(s) Full)
    • Common reasons why you have discrepancies between ElastiFlow data & reality
    • What Are Snapshots?
    • Importing the wrong dashboards (No data)
  • Knowledge Base
    • Config
      • Elasticsearch Authentication Failure
      • CA Certificate Path Incorrect
      • license/error Invalid Segments
    • Flow
      • Bidirectional Flow Support
      • Configure the UDP Input
      • Flow Records Not Received
      • Netflow v9/IPFIX Template Not Receieved
      • Unsupported sFlow Structures
    • General
      • License Has Expired
      • License Agreement Not Accepted
    • Install
      • .deb Upgrade Fails File Overwrite
    • Operation
      • Flow Collector Queues 90% Full
      • Dashboard Updates
      • Change elastiflow-* Index Name?
  • Elastic Stack Deployment
  • Download Links
Powered by GitBook
On this page
  • Enabling SNMP Collection
  • Further Resources
  1. Unified SNMP Collector

United SNMP Collector Introduction

PreviousNetwork InterfacesNextLinux

import DocCardList from '@theme/DocCardList';

The ElastiFlow Unified SNMP Collector is more than a simple SNMP poller. It has been designed to meet the requirements of the most demanding production environments, with particular attention on the following attributes:

Turnkey

The SNMP Input puts an end to countless hours of building polling configurations, and the error-prone copy-pasting necessary to poll new devices, which is required of other solutions. SNMP MIB attributes must be defined only once and can be flexibly referenced by the devices to which they are applicable.

The input includes a growing collection of out-of-the-box MIB Object definitions, as well as Object Groups and Device Groups, which make it quick and easy to get started polling your environment. This enables the collector to understand how to poll a Juniper EX-Series differently than a Cisco Catalyst. Adding a device is as simple as providing an IP address, credentials and one or more Device Groups, e.g. juniper_ex.

snmp_definitions

Extensible

The SNMP Input includes pre-built support for some of the most popular network equipment, which will continue to grow in the future. However there will always be new, rare or custom devices which are not yet part of our pre-built options. In this scenario, it is easy for users to add configurations or even modify existing definitions.

Efficient

The key to using SNMP with a minimal impact on network bandwidth and device resources is efficient polling. The SNMP Input achieves this by first performing a low-touch discovery of Objects applicable to the target device. The resulting SNMP object inventory is leveraged by the scheduler to poll devices in the most efficient manner possible. It is not uncommon for the input to collect 50 or more OIDs in a single poll. This greatly reduces the number of packets sent out over the network, as well as the load on the limited resources found in many devices.

Adaptive

It isn’t uncommon for devices to be reconfigured or restarted for maintenance or other operational requirements. The SNMP Input can respond dynamically to detected changes, modifying the polling schedule to remove objects and attributes which are no longer available, or automatically trigger a rediscovery when warranted by a device’s new state.

Scalable

ElastiFlow has proven itself as perhaps the most scalable Flow Collector available, especially when considering its depth of processing and features. The SNMP Input provides this same level of scalability by:

  1. Leveraging a large (and configurable) pool of concurrent poller workers.

  2. Taking advantage of the same processing techniques and outputs as the Flow input.

Enabling SNMP Collection

To enable the SNMP Input, refer to the configuration reference HERE. Devices can be added as explained HERE.

Further Resources