SNMP.CONF(5)

📦
version 5.9.5.2 · 13 versions
, in alpine 3.23, alpine 3.24

🎀 NAME 🎀

Okay so this is SNMP.CONF(5) from Net-SNMP, aka the manual page for snmp.conf — the configuration files for the Net-SNMP applications. Slay.

🌸 DESCRIPTION 🌸

So apps built with the Net-SNMP libraries usually read one or more config files to control how they operate, bestie. These files are snmp.conf and snmp.local.conf, and they can live in one of several locations — the whole map is in the snmp_config(5) manual page.

Specifically: /etc/snmp/snmp.conf is a common file with settings shared by every user on the system. And ~/.snmp/snmp.conf is your personal file, with settings specific to one particular user. Very main character.

🦋 HOST-SPECIFIC FILES 🦋

Host-specific files can also be loaded, and they get searched for if a transport name is specified that matches a PATH/hosts/HOST.conf file. For example, if you wanted one particular host to use SNMPv2c by default, you could create a ~/.snmp/hosts/NAME.conf file and put this in it:

defVersion 2c

Then any connections set to connect to the hostname NAME will use SNMPv2c. Also see the transport token below for more host-specific examples. 👑

Host-specific configuration files are loaded at the time the connection is opened. So they’re generally loaded after all the other configuration files, and they can be used to override settings from the generic files. Iconic behaviour.

To avoid loading any host-specific config files, set "dontLoadHostConfig true" in your snmp.conf file. No cap.

✨ COMMAND-LINE OPTIONS ✨

All of the tokens described in this file can also be used on the command line of Net-SNMP applications — just prefix them with --. EG, specifying --dontLoadHostConfig=true on the command line will turn off loading of the host-specific configuration files. We love a flexible queen.

🚨 IMPORTANT NOTE 🚨

Several of these directives may contain sensitive information (such as pass phrases). Configuration files that include such settings should only be readable by the user concerned. Protect her, fr fr.

As well as application-specific configuration tokens, there are several directives that relate to standard library behaviour, relevant to most Net-SNMP applications. Many of these correspond to standard command-line options, which are described in the snmpcmd(1) manual page.

These directives can be divided into several distinct groups. Let’s get into it.

💅 CLIENT BEHAVIOUR 💅

  • defDomain application domain — the transport domain that should be used for a certain application type unless something else is specified. It’s giving “default vibe but make it domain.”
  • defTarget application domain target — the target that should be used for connections to a certain application if the connection should be in a specific domain.
  • defaultPort PORT — defines the default UDP port that client SNMP applications will attempt to connect to. This can be overridden by explicitly including a port number in the AGENT specification. See the snmpcmd(1) manual page for more details.

If not specified, the default value for this token is 161. Periodt.

  • transport HOSTSPECIFIER — this special token should go into a hostname-specific configuration file in a hosts sub-directory. For example, if the file hosts/foo.conf exists in the search path, it will be loaded if a transport name of foo was used. Within the foo.conf file you may put both general snmp.conf settings as well as a special transport string to specify the destination to connect to. For example, putting:
transport tcp:foo.example.com:9876

in the hosts/foo.conf file will make applications referencing the foo hostname (e.g. snmpget) actually connect via TCP to foo.exmaple.com on port 9876. Weird little typo, but we keep it exactly as the manpage says, bestie. 🫶

  • defVersion (1|2c|3) — defines the default version of SNMP to use. This can be overridden using the -v option.
  • defCommunity STRING — defines the default community to use for SNMPv1 and SNMPv2c requests. This can be overridden using the -c option.
  • alias NAME DEFINITION — creates an alias tied to NAME for a given transport definition. The alias can then be referred to using an alias: prefix. Eg, a line of "alias here udp:127.0.0.1:6161" would allow you to use a destination host of "alias:here" instead of "udp:127.0.0.1:6161". This becomes more useful with complex transport addresses involving IPv6 addresses, etc. She ate. 💖
  • dumpPacket yes — defines whether to display a hexadecimal dump of the raw SNMP requests sent and received by the application. This is equivalent to the -d option.
  • doDebugging (1|0) — turns on debugging for all applications run if set to 1.
  • debugTokens TOKEN[,TOKEN...] — defines the debugging tokens that should be turned on when doDebugging is set. This is equivalent to the -D option.
  • debugLogLevel (emerg|alert|crit|err|warning|notice|info|debug) — set the priority level for logging of debug output. Defaults to debug.
  • 16bitIDs yes — restricts requestIDs, etc to 16-bit values.

The SNMP specifications define these ID fields as 32-bit quantities, and the Net-SNMP library typically initialises them to random values for security. However certain (broken) agents cannot handle ID values greater than 2^16 — this option allows interoperability with such agents. Not me defending the broken agents, but okay. 💀

  • clientaddr [<transport-specifier>:]<transport-address> — specifies the source address to be used by command-line applications when sending SNMP requests. See snmpcmd(1) for more information about the format of addresses.

This value is also used by snmpd when generating notifications.

  • clientaddrUsesPort no — specifies whether the clientaddr option contains a port number. Set this option to "yes" if clientaddr contains a port number and this port should be used for sending outgoing SNMP requests. This option only affects IPv4 client addresses and is ignored for IPv6 client addresses.
  • clientRecvBuf INTEGER — specifies the desired size of the buffer to be used when receiving responses to SNMP requests. If the OS hard limit is lower than the clientRecvBuf value, then this will be used instead. Some platforms may decide to increase the size of the buffer actually used for internal housekeeping.

This directive will be ignored if the platform doesn’t support setsockopt().

  • clientSendBuf INTEGER — is similar to clientRecvBuf, but applies to the size of the buffer used when sending SNMP requests.
  • noRangeCheck yes — disables the validation of varbind values against the MIB definition for the relevant OID. This is equivalent to the -Ir option.

This directive is primarily relevant to the snmpset command, but will also apply to any application that calls snmp_add_var() with a non-NULL value.

  • noTokenWarnings — disables warnings about unknown config file tokens. Peace and quiet, finally. 😭
  • reverseEncodeBER (1|yes|true|0|no|false) — controls how the encoding of SNMP requests is handled.

The default behaviour is to encode packets starting from the end of the PDU and working backwards. This directive can be used to disable this behaviour, and build the encoded request in the (more obvious) forward direction.

It should not normally be necessary to change this setting, as the encoding is basically the same in either case — but working backwards typically produces a slightly more efficient encoding, and hence a smaller network datagram.

  • dontLoadHostConfig (1|yes|true|0|no|false) — specifies whether or not the host-specific configuration files are loaded. Set to "true" to turn off the loading of the host-specific configuration files.
  • retries INTEGER — specifies the number of retries to be used in the requests.
  • timeout INTEGER — specifies the timeout in seconds between retries.

🚫 SNMPv1/SNMPv2c SETTINGS 🚫

  • disableSNMPv1 (1|yes|true|0|no|false)
  • disableSNMPv2c (1|yes|true|0|no|false)

Both of these disable protocol versions at runtime. Incoming and outgoing packets for the protocol will be dropped. Not the vibe for those versions, apparently. 🙈

🦋 SNMPv3 SETTINGS 🦋

okay bestie this is the v3 era, the secure era, the glow-up era 💅

  • disableSNMPv3 (1|yes|true|0|no|false) — kills protocol versions at runtime, like at runtime runtime. Incoming AND outgoing packets for that protocol get dropped. gone. blocked. not invited to the party 🙈
  • defSecurityName STRING — the default security name for SNMPv3 requests. you can override it with the -u option whenever you feel like it ✨
  • defSecurityLevel noAuthNoPriv|authNoPriv|authPriv — the default security level for SNMPv3 requests. override with -l. if you don't specify anything, the default value for this token is noAuthNoPriv.
note: authPriv is only available if the software has been compiled to use the OpenSSL libraries 🫶
  • defPassphrase STRING
  • defAuthPassphrase STRING
  • defPrivPassphrase STRING — these three set the default authentication and privacy pass phrases for SNMPv3 requests, and you can override them with -A and -X respectively. here's the tea: the defPassphrase value gets used for the authentication and/or privacy pass phrases if either of the other directives are not specified. so it's the fallback bestie, always got your back 🧚
  • defAuthType MD5|SHA|SHA-512|SHA-384|SHA-256|SHA-224
  • defPrivType DES|AES — default authentication and privacy protocols for SNMPv3 requests. override with -a and -x respectively. don't specify anything and SNMPv3 requests default to MD5 authentication and DES encryption. iconic old-school behaviour, honestly.
note: if the software has not been compiled to use the OpenSSL libraries, then only MD5 authentication is supported. neither SHA authentication nor any form of encryption will be available. that's it, that's the whole menu 😭
  • defContext STRING — default context for SNMPv3 requests, overridable with -n. if not specified, the default value for this token is the default context (i.e. the empty string ""). the void. the nothing. the main character of contexts 🌈
  • defSecurityModel STRING — the security model for SNMPv3 requests. default value is "usm", which is the only widely used security model for SNMPv3. lowkey the only one anyone shows up with.
  • defAuthMasterKey 0xHEXSTRING
  • defPrivMasterKey 0xHEXSTRING
  • defAuthLocalizedKey 0xHEXSTRING
  • defPrivLocalizedKey 0xHEXSTRING — these define the (hexadecimal) keys used for SNMPv3 secure communications. SNMPv3 keys are frequently derived from a passphrase, as discussed in the defPassphrase section above. but for improved security you can generate a truly random key and use that instead (which would normally have better entropy than a password unless it's amazingly long 👑). these directives are equivalent to the short-form command line options -3m, -3M, -3k, and -3K.

localized keys are master keys that have been converted to a unique key which is only suitable for one particular SNMP engine (agent). and the length of the key needs to be appropriate for the authentication or encryption type being used — auth keys: MD5=16 bytes, SHA1=20 bytes; priv keys: DES=16 bytes (8 bytes of which is used as an IV and not a key), and AES=16 bytes. yes bestie, do the math, the math matters 💀

  • sshtosnmpsocket PATH — sets the path of the sshtosnmp socket created by an application (e.g. snmpd) listening for incoming ssh connections through the sshtosnmp unix socket.
  • sshtosnmpsocketperms MODE [OWNER [GROUP]] — sets the mode, owner and group of that same sshtosnmp socket made by an application (e.g. snmpd) listening for incoming ssh connections through the sshtosnmp unix socket. the socket needs to be read/write privileged for SSH users that are allowed to connect to the SNMP service — and heads up, VACM access still needs to be granted as well, most likely through the TSM security model. it's giving layered security, we love to see it 🫶
  • sshusername NAME — sets the SSH user name for logging into the remote system.
  • sshpubkey FILE — set the public key file to use when connecting to a remote system 🔑
  • sshprivkey FILE — set the private key file to use when connecting to a remote system. keep this one close, bestie 🙈

🌸 SERVER BEHAVIOUR 🌸

  • persistentDir DIRECTORY — defines the directory where snmpd and snmptrapd store persistent configuration settings. if not specified, the persistent directory defaults to /var/lib/net-snmp.
  • noPersistentLoad yes
  • noPersistentSave yes — disable the loading and saving of persistent configuration information.
note: this will break SNMPv3 operations (and other behaviour that relies on changes persisting across application restart). Use With Care. like, capital-W capital-C. this is the "don't touch the stove" of config tokens 🔥
  • tempFilePattern PATTERN — defines a filename template for creating temporary files, for handling input to and output from external shell commands. used by the mkstemp() and mktemp() functions. if not specified, the default pattern is "/tmp/snmpdXXXXXX".
  • serverRecvBuf INTEGER — specifies the desired size of the buffer used when receiving incoming SNMP requests. if the OS hard limit is lower than the serverRecvBuf value, then that lower limit will be used instead. some platforms may decide to increase the size of the buffer actually used for internal housekeeping. this directive gets ignored if the platform doesn't support setsockopt(). platforms, amirite 😭
  • serverSendBuf INTEGER — similar to serverRecvBuf, but for the size of the buffer used when sending SNMP responses. the outgoing twin ✨
  • sourceFilterType none|acceptlist|blocklist — specifies whether or not addresses added with sourceFilterAddress are accepted or blocked. the default is none, meaning incoming packets won't be checked against the filter list at all. the vibes are open-door policy.
  • sourceFilterAddress ADDRESS — specifies an address to add to the source address filter list. sourceFilterType configuration determines whether addresses are accepted or blocked. so pick your side 💅

🎀 MIB HANDLING 🎀

  • mibdirs DIRLIST — a list of directories to search for MIB files. operates the same way as the -M option — see snmpcmd(1) for the details. note that this value can be overridden by the MIBDIRS environment variable, and the -M option.
  • mibs MIBLIST — a list of MIB modules (not files, bestie, modules) that should be loaded. operates the same way as the -m option — see snmpcmd(1) for the details. this list can be overridden by the MIBS environment variable, and the -m option.
  • mibfile FILE — specifies a (single) MIB file to load, in addition to the list read from the mibs token (or equivalent configuration). note that this value can be overridden by the MIBFILES environment variable.
  • showMibErrors (1|yes|true|0|no|false) — whether to display MIB parsing errors. do you want to see the drama or not 🌈
  • commentToEOL (1|yes|true|0|no|false) — whether MIB parsing should be strict about comment termination. lots of MIB writers assume that ASN.1 comments extend to the end of the text line instead of being terminated by the next -- token. this token lets you accept such (strictly incorrect) MIBs. note that this directive was previous (mis-)named strictCommentTerm, but with the reverse behaviour from what that name implies. that earlier token is still accepted for backwards compatibility 🫶
  • mibAllowUnderline (1|yes|true|0|no|false) — whether to allow underline characters in MIB object names and enumeration values. this token lets you accept such (strictly incorrect) MIBs. rules were made to be bent, apparently.
  • mibWarningLevel INTEGER — the minimum warning level of the warnings printed by the MIB parser. set your drama threshold ⭐

✨ OUTPUT CONFIGURATION ✨

  • logTimestamp (1|yes|true|0|no|false) — whether the commands should log timestamps with their error/message logging or not. note that output won't look as pretty with timestamps if the source code doing the logging does incremental logging of messages that aren't line buffered before being passed to the logging routines. this option is only used when file logging is active.
  • printNumericEnums (1|yes|true|0|no|false) — equivalent to -Oe.
  • printNumericOids (1|yes|true|0|no|false) — equivalent to -On.
  • dontBreakdownOids (1|yes|true|0|no|false) — equivalent to -Ob.
  • escapeQuotes (1|yes|true|0|no|false) — equivalent to -OE.
  • quickPrinting (1|yes|true|0|no|false) — equivalent to -Oq.
  • printValueOnly (1|yes|true|0|no|false) — equivalent to -Ov.
  • dontPrintUnits (1|yes|true|0|no|false) — equivalent to -OU.
  • numericTimeticks (1|yes|true|0|no|false) — equivalent to -Ot.
  • printHexText (1|yes|true|0|no|false) — equivalent to -OT.
  • hexOutputLength integer — specifies where to break up the output of hexadecimal strings. set to 0 to disable line breaks. defaults to 16.
  • suffixPrinting (0|1|2) — the value 1 is equivalent to -Os and the value 2 is equivalent to -OS.
  • oidOutputFormat (1|2|3|4|5|6) — maps -O options as follows: -Os=1, -OS=2, -Of=3, -On=4, -Ou=5. the value 6 has no matching -O option — it suppresses output entirely. the "say nothing" slay 💀
  • extendedIndex (1|yes|true|0|no|false) — equivalent to -OX.
  • noDisplayHint (1|yes|true|0|no|false) — disables the use of DISPLAY-HINT information when parsing indices and values to set. equivalent to -Ih.
  • outputPrecision PRECISION — uses the PRECISION string to allow modification of the value output format. see snmpcmd(1) for details. equivalent to -Op (which takes precedence over the config file 👑).

💖 FILES 💖

system-wide configuration files:

/etc/snmp/snmp.conf
/etc/snmp/snmp.local.conf

user-specific configuration settings:

$HOME/.snmp/snmp.conf
$HOME/.snmp/snmp.local.conf

destination host specific files:

/etc/snmp/hosts/HOSTNAME.conf
$HOME/.snmp/hosts/HOSTNAME.conf

🦋 SEE ALSO 🦋

snmp_config(5), netsnmp_config_api(3), snmpcmd(1). go read those next, bestie, we're building a whole lore universe here 📚✨

and that's the whole page, no cap 🫶 this version is V5.9.5.2, dated 21 Apr 2010, and it lives at SNMP.CONF(5). she's vintage, she's iconic, she's still running your monitoring stack. periodt 💅🎀

📦 where this page comes from