banshee/linux-collection/linux/snmp/interfaces

Network interfaces of a Linux host, by SNMP

Returns, for each interface, its link state, negotiated speed, MTU, inbound and outbound throughput, utilisation, packets, errors, drops and IPv4 addresses. Eleven watches are offered, each adjustable on the probe.

How it works

The collector reads ifTable and ifXTable (IF-MIB), and ipAddrTable (IP-MIB) for the addresses. An interface is named by ifName (eth0, ens192, bond0).

The link state is ifOperStatus in words (up, down, lowerlayerdown…); an interface the administrator has disabled reads disabled, so it does not pass for a link down.
Throughput, packets, errors and drops come from the 64-bit counters, over the interval between two runs: on the first run they are not returned; they come on the next one. An interface without 64-bit counters returns its state only.
Utilisation is throughput against the negotiated speed (ifHighSpeed); an interface without a negotiated speed (down, or virtual) has none.
Two interfaces with the same name each keep their own: the second carries its index (eth0 #12).
The default selection leaves out the loopback and container interfaces: everything except lo, docker* and veth*. It can be changed on the probe.

Prerequisites

snmpd (net-snmp) running on the host, listening on an address the poller reaches (UDP 161), with the firewall open to the poller only.
The view granted to the poller includes interfaces (.1.3.6.1.2.1.2), ifXTable (.1.3.6.1.2.1.31) and ipAddrTable (.1.3.6.1.2.1.4.20).
Read-only access, SNMPv2c or SNMPv3, set on the host or one of its folders (protocol:snmp:* variables).

# /etc/snmp/snmpd.conf
agentaddress udp:161
view   banshee included .1.3.6.1.2.1.2
view   banshee included .1.3.6.1.2.1.31
view   banshee included .1.3.6.1.2.1.4.20
rocommunity <community> 192.0.2.10 -V banshee
# or: rouser <user> priv -V banshee

Outputs

Name	Label	Unit	Per
`link`	Link state		interface
`speed`	Negotiated speed	Mbit/s	interface
`mtu`	MTU		interface
`traffic-in`	Inbound throughput	bit/s	interface
`traffic-out`	Outbound throughput	bit/s	interface
`traffic`	Total throughput	bit/s	interface
`in-percent`	Inbound utilisation	%	interface
`out-percent`	Outbound utilisation	%	interface
`packets`	Packets	packets/s	interface
`errors`	Errors	errors/s	interface
`drops`	Drops	packets/s	interface
`drop-percent`	Share of packets dropped	%	interface
`addresses`	IPv4 addresses		interface

Watches

Watch	Kind	Defaults	Checked
Link down	State to avoid, on `link`	critical on `down`, `lowerlayerdown`	yes
Degraded negotiated speed	Custom	warning below 1000 Mbit/s	no
Inbound saturation	Above a threshold, on `in-percent`	warning 70 %, critical 90 %, for 5 min	yes
Outbound saturation	Above a threshold, on `out-percent`	warning 70 %, critical 90 %, for 5 min	yes
Errors	Custom	warning beyond 1 error/min, critical beyond 0.1 % of traffic	yes
Dropped packets	Above a threshold, on `drop-percent`	warning 0.5 %, critical 2 %	yes
Unusual traffic	Unusual value, on `traffic`	normal sensitivity, floor 10,000,000 bit/s	no
Silent interface	No activity, on `packets`	warning after 10 min	no
Missing interface	Expected instances, on `link`	no expected name	no
Unexpected MTU	Expected value, on `mtu`	warning when not 1500	no
No IPv4 address left	Below a threshold, on `addresses`	critical below 1	no

Limits

Neither duplex nor link changes are read: IF-MIB does not carry them. The linux/ssh/interfaces collector reads them, and the members of a bond.
IPv6 addresses are not counted: ipAddrTable lists IPv4 only.
A virtual interface (bridge, bond, VLAN) often has no negotiated speed: its utilisation is not returned.