SNMP v1/v2 Configuration

For most common Linux-based application and devices, enabling the SNMP background service is an essential step in the the very minimal steps that it takes to configure your host for monitoring. The aim of this page is to provide you with a general understanding of how to configure SNMP on your Linux host, and troubleshoot issues that may relate to IPtables blocking either of these protocols from working to the utmost potential. Depending on your configuration, additional adjustments may be necessary.

If you're looking for help configuring SNMP v3, see this page. If you're looking for help troubleshooting SNMP, see this page.

Configuring SNMP

The most basic steps to configure SNMP are as follows. To ensure that you have sufficient permission, you should become root or use the sudo command for the following configuration steps.

Start out by editing your /etc/snmp/snmpd.conf file to declare your read-only community string (think of it as a password). We recommend you replace your entire /etc/snmp/snmpd.conf with a simple version:
```
rocommunity  <10.0.0.0/8>
```
You may either replace the entire text file or you can prepend the above line to the top of the file. Of course, backing up your existing file is always a good idea:
```
mv /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.old
```
The IP range is optional. If set, only hosts within that network/mask combination will be able to query snmpd, so ensure it contains the IP address of the LogicMonitor collector(s) that will monitor this Linux device. You can enable all addresses by omitting the IP.
If you are running Dell hardware you will also want to include these lines in snmpd.conf so the underlying hardware can be monitored via the Dell OpenManage suite of packages:
```
smuxsocket 127.0.0.1
smuxpeer .1.3.6.1.4.1.674.10892.1
```
After updating the snmpd.conf file, set snmpd to start on boot and start it now:
```
chkconfig snmpd on
service snmpd restart
```

For more detailed instructions specific to the Linux distribution you are using, see the following RedHat/CentOS and Debian/Ubuntu sections.

RedHat/CentOS

Install the RPM:
```
yum install net-snmp
```
You can optionally install snmpwalk and other tools that can be useful for troubleshooting (these are not required for LogicMonitor to monitor the device):
```
yum install net-snmp-utils
```

Move the default config file and keep it as backup:

mv /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.original

Define an snmp community in a new config file:
```
echo "rocommunity notpublic" > /etc/snmp/snmpd.conf
```
Note that:
- if you're using sudo, the command may look like this:
```
sudo sh -c "echo 'rocommunity notpublic' > /etc/snmp/snmpd.conf"
```
- you can optionally include an IP address or a range of IP addresses to restrict which IP addresses can connect to your system via SNMP. To do this, add the IP address after the community string in the command above, so that it looks like this:
```
echo "rocommunity notpublic 10.9.8.0/24" > /etc/snmp/snmpd.conf
```
Start the daemon, and set it to start on server boot. For RedHat/CentOS 7.0 you can use these systemctl commands:
```
systemctl restart snmpd.service
systemctl enable snmpd.service
```
Otherwise, for older versions of RedHat/CentOS, you can use these commands:
```
/etc/init.d/snmpd restart
chkconfig snmpd on
```

Debian/Ubuntu

Install the snmpd package:

apt-get install snmpd

Backup the original snmpd.conf file:

mv /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.org

Create a new snmpd.conf file:

echo "rocommunity logicmonitor" > /etc/snmp/snmpd.conf

Make sure to substitute "logicmonitor" with the community string that you would like to use.

Now edit your snmpd file:

nano /etc/default/snmpd

Find and comment out (with #) this line (or similar):

SNMPDOPTS='-Lsd -Lf /dev/null -u snmp -p /var/run/snmpd.pid'

Add this line underneath:

SNMPDOPTS='-Lsd -Lf /dev/null -u snmp -I -smux -p /var/run/snmpd.pid -c /etc/snmp/snmpd.conf'

Close and save the file.
If you are running iptables, make the following exception:

iptables -A INPUT -p udp -s 10.1.1.10 --dport 161 -j ACCEPT

You need to replace "10.1.1.10" with the IP of your collector machine.

Restart snmpd and set it to start on server boot:

systemctl restart snmpd
systemctl enable snmpd

Adding Firewall Rules

The following procedures below detail how to allow both SNMP and NTP access for Linux devices.

Adding Firewall Rules Using iptables

Access the command shell of the Linux host (via ssh or from the console).
Open the file/etc/sysconfig/iptables in your preferred editor.
After the line matching similar to "-A RH-Firewall-1-INPUT –p udp –dport 5353", add the following lines to the INPUT section:
```
-A RH-Firewall-1-INPUT -p udp --dport 161 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 123 -j ACCEPT 
```
Save and close the file.
Restart the firewall service:
```
service iptables restart
```

Adding Firewall Rules Using firewalld

firewall-cmd --permanent --add-port=161/udp 
firewall-cmd --permanent --add-service=ntp
firewall-cmd --reload
firewall-cmd --permanent --list-all

Support Center

Monitoring