SNMP Network Interface Monitoring
Last updated - 08 April, 2026
The SNMP Network Interface module monitors interface status and performance across SNMP-enabled resources using the SNMP_Network_Interfaces DataSource.
The module automatically discovers interfaces, tracks operational status and flapping, and collects throughput and utilization metrics. It supports configurable alerting, interface identification behavior, and collection methods. Non-physical interfaces (for example, loopbacks, VLANs) are filtered by default.
After monitoring is configured, you can customize behavior using the following supported property settings:
- Selective alerting—Manages which interfaces generate status and flap alerts using resource-level regular expression properties. For more information, see Selective Alerting.
- Interface speed—Override detected link speed for accurate utilization calculations using instance-level properties. For more information, see Interface Speed.
- Interface identification—Manages how interfaces are uniquely identified (ifIndex and ifName) and displayed. For more information, see Interface Identification.
- Counter mode and collection method—Force 32-bit or 64-bit counters and select the SNMP collection strategy (
walk,get, orgetconcurrent). For more information, see Counter Mode and Collection Method. - Filtering and blocking metrics—Disable automatic interface filtering or exclude specific metrics from collection. For more information, see Filtering and Blocking Metrics.
Requirements for SNMP Network Interface Monitoring
To configure SNMP Network Interface monitoring, you need the following:
- SNMP v2c or v3 enabled on the monitored resource
- SNMP accessible from the assigned LogicMonitor Collector
The Collector must successfully poll the resource using SNMP and the resource must return valid IF-MIB responses. For more information, see Troubleshooting SNMP.
Warning: If SNMP polling fails, interfaces will not be discovered and no metrics will collect.
For more information, see SNMP Data Collection.
Configuring SNMP Network Interface Monitoring
- Install the
SNMP_Network_Interfacesmonitoring module.
For more information, see Modules Installation.
This package includes the following module:
| Module Name | Type | Description |
SNMP_Network_Interfaces | DataSource | Discovers interfaces and collects interface status and performance metrics. |
- Confirm the resource matches AppliesTo Logic.
TheSNMP_Network_InterfacesDataSource applies automatically to SNMP-enabled resources. For more information, see AppliesTo Function Scripting Overview.
After configuration, active discovery runs, interface instances are created, and status and performance metrics begin collecting.
Note: The module uses virtual DataPoints in throughput graphs to prevent temporary speed detection anomalies from causing display spikes.
Selective Alerting
By default with version 2.0 and later, status and flap alerting is enabled for all discovered interfaces. You can restrict alerts to specific interfaces (for example, uplinks or core) using the following resource-level properties:
Note: If you remove all alert-enable properties, alerting returns to the default behavior and applies to all discovered interfaces.
| Property | Matches Against | Description |
|---|---|---|
interface.description.alert_enable | system.instanceDescription | Regex to match against the system-level instance description. Use to alert on specific keywords. |
interface.alias.alert_enable | auto.interface.alias | Regex to match against the interface alias. Note: Can be blank on some resources |
interface.wildalias.alert_enable | auto.interface.wildalias | Regex to match against the instance display name in LogicMonitor. Use to alert on interfaces by name pattern. |
Note: auto.interface.alias matches the alias assigned at the system level (can be left blank). auto.interface.wildalias matches the instance display name shown in LogicMonitor.
Note: If multiple alert enable properties are configured, an interface generates alerts if it matches any configured pattern (OR logic).
To understand when these properties can apply, refer to the following table:
| Example Use Case | Property & Value | Match Behavior |
|---|---|---|
| Alert on specific keywords | interface.description.alert_enable = core|uplink | Alerts for interfaces with “core” or “uplink” in description |
| Exclude specific interfaces | interface.alias.alert_enable = ^((?!bridge).)*$ | Excludes interfaces containing “bridge” from status alerts |
| Alert on interfaces by name pattern | interface.wildalias.alert_enable = ^(Gi|Te|Eth) | Alerts only for GigabitEthernet, TenGigabit, or Ethernet interfaces |
| Alert on uplinks except backup | interface.description.alert_enable = uplink.*(?<!backup)$ | Alerts on interfaces with “uplink” but excludes those ending in “backup” |
Interface Speed
Interface utilization is calculated as a percentage of detected link speed. If the detected speed is inaccurate (for example, due to resource reporting issues or rate-limited interfaces) you can override the value used for calculations, using the following property settings:
| Property | Units | Description |
|---|---|---|
ActualSpeed | Megabits per second (Mbps) | Sets inbound and outbound speed. |
ActualSpeedUpstream | Mbps | Sets outbound speed only. Overrides ActualSpeed for the outbound direction. |
in_speed | bits per second (bps) | Sets inbound speed in bps. |
out_speed | bps | Sets outbound speed in bps. |
Note: ActualSpeed and ActualSpeedUpstream use Megabits per second (Mbps).in_speed and out_speed use bits per second (bps).
Interface Identification
The SNMP_Network_Interfaces module uses ifIndex (a WildValue) to uniquely identify interface instances.
Note: ifIndex is the only interface attribute guaranteed to be unique across vendors.
If a resource does not support SNMP ifIndex persists, the ifIndex value can change after reboot or configuration, which can cause duplicate instances or gaps in historical data.
Recommendation: If interface names are unique, enable device-side ifIndex persistence (for example, snmp ifindex persist or vendor equivalent) to maintain identifier stability.
The following table provides more information on interface identification property settings:
| Property | Value | Description | Use Cases |
|---|---|---|---|
interface.wildvalue.ifname | true | Use ifName instead of ifIndex for the instance WildValue (unique identifier)Note: Removing the index affects only the display name. It does not change the unique identifier or historical data continuity. | Resource-side persistence is not possible |
interface.wildalias.ifname | true | Use ifName instead of ifDescr for the WildAlias (display name) | Resources that have snmp ifindex persist enabled, do not require index disambiguation, or uses interface.wildalias.ifname = true and ifName values are already unique |
instance.alias.removeIndex | true | Remove the [ID: <ifIndex>] suffix from the display name (v2.23+) | Resources that have long or confusing names |
Important: Changing the WildValue can cause existing instances to be recreated.
Counter Mode and Collection Method
The SNMP_Network_Interfaces module enables you to adjust counter mode and SNMP collection behavior.
The following table summarizes the available property settings:
| Setting | Property | Values | Default | Description | Use Case | Example |
|---|---|---|---|---|---|---|
| Counter mode | interface.mode | 64, 32 | 64 | Determines whether interface traffic counters are collected using 64-bit or 32-bit SNMP counters. | Use 32 only if the resource does not support 64-bit counters correctly. | interface.mode = 32 |
| Collection method | interface.snmp.method | walk, get, getconcurrent | walk | Determines how SNMP interface data is retrieved from the resource, | walk — Use for most resources. Retrieves all interface data at one time. get — Use for resources that experience SNMP walk failures or timeouts. Retrieves data for discovered interfaces individually.getconcurrent — Use for resources with many interfaces where parallel collection improves performance. Retrieves known active interfaces using concurrent threads. | interface.snmp.method = get |
| Concurrent collection tuning | interface.poolsize | 1–30 | 20 | Defines the number of concurrent threads used when collecting interface data with the getconcurrent method | Applies only when interface.snmp.method = getconcurrent. Increases gradually and monitors resource impact | interface.snmp.method = getconcurrentinterface.poolsize = 25 |
Filtering and Blocking Metrics
The module filters non-physical interfaces (for example, loopback, VLAN, virtual ports) during Active Discovery. You can disable filtering or block specific metrics when needed using the following properties:
| Property | Type | Default | Description |
|---|---|---|---|
interface.filtering | Boolean | false | Set to true to disable automatic interface filtering. Only Active Discovery filters within the module settings will apply. |
interface.blockedMetrics | String | (none) | Comma-separated list of metric names to exclude from collection. For example,InMulticastPkts,OutMulticastPkts,InBroadcastPkts |
Note: Disabling filtering can significantly increase discovered instances.
Troubleshooting SNMP Network Interface Monitoring
The following table outlines common issues and recommended actions for troubleshooting SNMP Network Interface Monitoring:
| Issue | Resolution |
|---|---|
| Interfaces not discovered | Verify SNMP reachability and AppliesTo match. Check that the resource returns valid IF-MIB responses. |
| Duplicate interfaces after reboot | Enable device-side ifIndex persistence (snmp ifindex persist or vendor equivalent) or configure interface.wildvalue.ifname = true. |
| High CPU or slow collection | Adjust collection method and thread pool size. Switch from walk to getconcurrent and adjust interface.poolsize. Consider blocking unused metrics with interface.blockedMetrics. |
| Incorrect utilization | Override interface speed using ActualSpeed/ActualSpeedUpstream or in_speed/out_speed instance-level properties. Verify the correct counter mode (32 or 64-bit). |
| Missing interfaces | Check if automatic filtering is excluding desired interfaces. Set interface.filtering = true to disable automatic filters and review Active Discovery filters. |
Note: Some Cisco IOS XE resources (for example, CAT9K and ASR) report discard metrics in bytes rather than packets due to firmware behavior. This is expected and cannot be changed. When analyzing discard data, interpret the values as bytes discarded, not packet counts.
List of Customizable SNMP Network Interface Monitoring Properties
The following table lists properties that can be configured at the resource or group level:
| Property | Type | Default | Description |
|---|---|---|---|
interface.description.alert_enable | String | (none) | Regular expression used to enable status and flap alerts based on system.instanceDescription. |
interface.alias.alert_enable | String | (none) | Regular expression used to enable alerts based on auto.interface.alias. |
interface.wildalias.alert_enable | String | (none) | Regular expression used to enable alerts based on auto.interface.wildalias. |
interface.mode | Number | 64 | Counter mode. Valid values: 32 or 64. |
interface.filtering | Boolean | false | Set to true to disable automatic interface filtering. |
interface.snmp.method | String | walk | SNMP collection method. Valid values: walk, get, getconcurrent. |
interface.poolsize | Number | 20 | Thread pool size used with getconcurrent. Valid range: 1–30. |
interface.blockedMetrics | String | (none) | Comma-separated list of metric names to exclude from collection. |
interface.wildvalue.ifname | Boolean | false | Use ifName instead of ifIndex as the unique identifier (WildValue). |
interface.wildalias.ifname | Boolean | false | Use ifName instead of description for the display name (WildAlias). |
instance.alias.removeIndex | Boolean | false | Remove [ID: <ifIndex>] suffix from display name (v2.23+). |
The following table lists properties configured at the interface instance level:
| Property | Type | Units | Description |
|---|---|---|---|
ActualSpeed | Number | Mbps | Sets inbound and outbound speed used for utilization calculations. |
ActualSpeedUpstream | Number | Mbps | Sets outbound speed used for utilization calculations. |
in_speed | Number | bps | Sets inbound speed in bits per second. |
out_speed | Number | bps | Sets outbound speed in bits per second. |
