banshee/linux-collection/linux/snmp/interfaces

Network interfaces of a Linux host, by SNMP

Returns, for each interface, its link state, negotiated speed, MTU, inbound and outbound traffic, usage, packets, errors, drops and IPv4 addresses. Eleven watches are offered, each adjustable on the probe.

Versions

Generic: IF-MIB and IP-MIB are served the same way by net-snmp on any Linux.

How it works

The collector reads ifTable and ifXTable (IF-MIB), and ipAddrTable (IP-MIB) for the addresses. An interface is named by ifName (eth0, ens192, bond0).

The link state is ifOperStatus in words (up, down, lowerlayerdown…); an interface the administrator has disabled reads disabled, so it does not pass for a link down.
Throughput, packets, errors and drops come from the 64-bit counters, over the interval between two runs: on the first run they are not returned; they come on the next one. An interface without 64-bit counters returns its state only.
Utilisation is throughput against the negotiated speed (ifHighSpeed); an interface without a negotiated speed (down, or virtual) has none.
Two interfaces with the same name each keep their own: the second carries its index (eth0 #12).
The default selection leaves out the loopback and container interfaces: everything except lo, docker* and veth*. It can be changed on the probe.

Prerequisites

snmpd (net-snmp) running on the host, listening on an address the poller reaches (UDP 161), with the firewall open to the poller only.
The view granted to the poller includes interfaces (.1.3.6.1.2.1.2), ifXTable (.1.3.6.1.2.1.31) and ipAddrTable (.1.3.6.1.2.1.4.20).
Read-only access, SNMPv2c or SNMPv3, set on the host or one of its folders (protocol:snmp:* variables).

# /etc/snmp/snmpd.conf
agentaddress udp:161
view   banshee included .1.3.6.1.2.1.2
view   banshee included .1.3.6.1.2.1.31
view   banshee included .1.3.6.1.2.1.4.20
rocommunity <community> 192.0.2.10 -V banshee
# or: rouser <user> priv -V banshee

Outputs

Name	Label	Unit	Per instance
`link`	Link state	—	yes, per interface
`speed`	Negotiated speed	Mbit/s	yes, per interface
`mtu`	MTU	—	yes, per interface
`traffic-in`	Inbound traffic	bit/s	yes, per interface
`traffic-out`	Outbound traffic	bit/s	yes, per interface
`traffic`	Total traffic	bit/s	yes, per interface
`in-percent`	Inbound usage	%	yes, per interface
`out-percent`	Outbound usage	%	yes, per interface
`packets`	Packets	packets/s	yes, per interface
`errors`	Errors	errors/s	yes, per interface
`drops`	Drops	packets/s	yes, per interface
`drop-percent`	Share of packets dropped	%	yes, per interface
`addresses`	IPv4 addresses	—	yes, per interface

Watches

Name	Title	Kind	Defaults	Checked by default
`link-down`	Link down	state, on `link`	critical on `down`, `lowerlayerdown`	yes
`speed-degraded`	Negotiated speed degraded	custom	warning below the expected speed, 1000 Mbit/s	no
`saturation-in`	Inbound saturation	above a threshold, on `in-percent`	warning above 70 %, critical above 90 %, for 5 min	yes
`saturation-out`	Outbound saturation	above a threshold, on `out-percent`	warning above 70 %, critical above 90 %, for 5 min	yes
`errors`	Errors	custom	warning beyond 1 error/min, critical beyond 0.1 % of traffic	yes
`drops`	Packets dropped	above a threshold, on `drop-percent`	warning above 0.5 %, critical above 2 %	yes
`traffic-unusual`	Unusual traffic	habit, on `traffic`	sensitivity normal, floor 10,000,000 bit/s	no
`mute`	Silent interface	silence, on `packets`	warning after 10 min	no
`missing`	Interface missing	expected instances, on `link`	no interface named: it raises nothing until names are set on the probe	no
`mtu`	Unexpected MTU	expected value, on `mtu`	warning when not 1500	no
`no-address`	No IPv4 address left	below a threshold, on `addresses`	critical below 1	no

Limits

Neither duplex nor link changes are read: IF-MIB does not carry them. The linux/ssh/interfaces collector reads them, and the members of a bond.
IPv6 addresses are not counted: ipAddrTable lists IPv4 only.
A virtual interface (bridge, bond, VLAN) often has no negotiated speed: its utilisation is not returned.