Cisco IOS SNMP

Macros used

Name	Value
{$CPU.UTIL.CRIT}	90
{$FAN_CRIT_STATUS:"critical"}	3
{$FAN_CRIT_STATUS:"shutdown"}	4
{$FAN_WARN_STATUS:"notFunctioning"}	6
{$FAN_WARN_STATUS:"warning"}	2
{$ICMP_LOSS_WARN}	20
{$ICMP_RESPONSE_TIME_WARN}	0.15
{$IF.ERRORS.WARN}	2
{$IF.UTIL.MAX}	90
{$IFCONTROL}	1
{$MEMORY.UTIL.MAX}	90
{$NET.IF.IFADMINSTATUS.MATCHES}	^.*
{$NET.IF.IFADMINSTATUS.NOT_MATCHES}	^2$
{$NET.IF.IFALIAS.MATCHES}	.*
{$NET.IF.IFALIAS.NOT_MATCHES}	CHANGE_IF_NEEDED
{$NET.IF.IFDESCR.MATCHES}	.*
{$NET.IF.IFDESCR.NOT_MATCHES}	CHANGE_IF_NEEDED
{$NET.IF.IFNAME.MATCHES}	^.*$
{$NET.IF.IFNAME.NOT_MATCHES}	(^Software Loopback Interface|^NULL[0-9.]$|^[Ll]o[0-9.]$|^[Ss]ystem$|^Nu[0-9.]*$|^veth[0-9a-z]+$|docker[0-9]+|br-[a-z0-9]{12})
{$NET.IF.IFOPERSTATUS.MATCHES}	^.*$
{$NET.IF.IFOPERSTATUS.NOT_MATCHES}	^6$
{$NET.IF.IFTYPE.MATCHES}	.*
{$NET.IF.IFTYPE.NOT_MATCHES}	CHANGE_IF_NEEDED
{$PSU_CRIT_STATUS:"critical"}	3
{$PSU_CRIT_STATUS:"shutdown"}	4
{$PSU_WARN_STATUS:"notFunctioning"}	6
{$PSU_WARN_STATUS:"warning"}	2
{$SNMP.TIMEOUT}	5m
{$TEMP_CRIT}	60
{$TEMP_CRIT:"CPU"}	75
{$TEMP_CRIT_LOW}	5
{$TEMP_CRIT_STATUS}	3
{$TEMP_DISASTER_STATUS}	4
{$TEMP_WARN}	50
{$TEMP_WARN:"CPU"}	70
{$TEMP_WARN_STATUS}	2

Items collected

Name	Description	Type	Interval	Key and additional info
ICMP ping	-	SIMPLE	-	icmpping
ICMP loss	-	SIMPLE	-	icmppingloss
ICMP response time	-	SIMPLE	-	icmppingsec
SNMP traps (fallback)	The item is used to collect all SNMP traps unmatched by other snmptrap items	SNMP_TRAP	-	snmptrap.fallback
System contact details	MIB: SNMPv2-MIB The textual identification of the contact person for this managed node, together with information on how to contact this person. If no contact information is known, the value is the zero-length string.	SNMP_AGENT	15m	system.contact[sysContact.0]
System description	MIB: SNMPv2-MIB A textual description of the entity. This value should include the full name and version identification of the system's hardware type, software operating-system, and networking software.	SNMP_AGENT	15m	system.descr[sysDescr.0]
Hardware model name	MIB: ENTITY-MIB	SNMP_AGENT	1h	system.hw.model
Hardware serial number	MIB: ENTITY-MIB	SNMP_AGENT	1h	system.hw.serialnumber
System location	MIB: SNMPv2-MIB The physical location of this node (e.g., `telephone closet, 3rd floor'). If the location is unknown, the value is the zero-length string.	SNMP_AGENT	15m	system.location[sysLocation.0]
System name	MIB: SNMPv2-MIB An administratively-assigned name for this managed node.By convention, this is the node's fully-qualified domain name. If the name is unknown, the value is the zero-length string.	SNMP_AGENT	15m	system.name
System object ID	MIB: SNMPv2-MIB The vendor's authoritative identification of the network management subsystem contained in the entity. This value is allocated within the SMI enterprises subtree (1.3.6.1.4.1) and provides an easy and unambiguous means for determiningwhat kind of box' is being managed. For example, if vendorFlintstones, Inc.' was assigned the subtree1.3.6.1.4.1.4242, it could assign the identifier 1.3.6.1.4.1.4242.1.1 to its `Fred Router'.	SNMP_AGENT	15m	system.objectid[sysObjectID.0]
Operating system	MIB: SNMPv2-MIB	SNMP_AGENT	1h	system.sw.os[sysDescr.0]
Uptime	MIB: SNMPv2-MIB The time (in hundredths of a second) since the network management portion of the system was last re-initialized.	SNMP_AGENT	30s	system.uptime[sysUpTime.0]
SNMP agent availability	Availability of SNMP checks on the host. The value of this item corresponds to availability icons in the host list. Possible value: 0 - not available 1 - available 2 - unknown	INTERNAL	-	zabbix[host,snmp,available]

Triggers

Name	Description	Expression	Priority	Dependencies
Unavailable by ICMP ping	Last three attempts returned timeout. Please check device connectivity.	max(/Cisco IOS SNMP/icmpping,#3)=0	HIGH ⛔	ICMP ping
High ICMP ping loss	-	min(/Cisco IOS SNMP/icmppingloss,5m)>{$ICMP_LOSS_WARN} and min(/Cisco IOS SNMP/icmppingloss,5m)<100	WARNING 📢	ICMP loss
High ICMP ping response time	-	avg(/Cisco IOS SNMP/icmppingsec,5m)>{$ICMP_RESPONSE_TIME_WARN}	WARNING 📢	ICMP response time
Device has been replaced	Device serial number has changed. Ack to close	last(/Cisco IOS SNMP/system.hw.serialnumber,#1)<>last(/Cisco IOS SNMP/system.hw.serialnumber,#2) and length(last(/Cisco IOS SNMP/system.hw.serialnumber))>0	INFO 🔔	Hardware serial number
System name has changed	System name has changed. Ack to close.	last(/Cisco IOS SNMP/system.name,#1)<>last(/Cisco IOS SNMP/system.name,#2) and length(last(/Cisco IOS SNMP/system.name))>0	INFO 🔔	System name
Operating system description has changed	Operating system description has changed. Possible reasons that system has been updated or replaced. Ack to close.	last(/Cisco IOS SNMP/system.sw.os[sysDescr.0],#1)<>last(/Cisco IOS SNMP/system.sw.os[sysDescr.0],#2) and length(last(/Cisco IOS SNMP/system.sw.os[sysDescr.0]))>0	INFO 🔔	Operating system
has been restarted	Uptime is less than 10 minutes.	last(/Cisco IOS SNMP/system.uptime[sysUpTime.0])<10m	WARNING 📢	Uptime
No SNMP data collection	SNMP is not available for polling. Please check device connectivity and SNMP settings.	max(/Cisco IOS SNMP/zabbix[host,snmp,available],{$SNMP.TIMEOUT})=0	WARNING 📢	SNMP agent availability

Discovery rule №1

Name	Description	Type	Interval	Key and additional info
CPU Discovery	If your IOS device has several CPUs, you must use CISCO-PROCESS-MIB and its object cpmCPUTotal5minRev from the table called cpmCPUTotalTable, indexed with cpmCPUTotalIndex. This table allows CISCO-PROCESS-MIB to keep CPU statistics for different physical entities in the router, like different CPU chips, group of CPUs, or CPUs in different modules/cards. In case of a single CPU, cpmCPUTotalTable has only one entry.	SNMP_AGENT	1h	cpu.discovery

Item prototypes

Name	Description	Type	Interval	Key and additional info
#{#SNMPINDEX}: CPU utilization	MIB: CISCO-PROCESS-MIB The cpmCPUTotal5minRev MIB object provides a more accurate view of the performance of the router over time than the MIB objects cpmCPUTotal1minRev and cpmCPUTotal5secRev . These MIB objects are not accurate because they look at CPU at one minute and five second intervals, respectively. These MIBs enable you to monitor the trends and plan the capacity of your network. The recommended baseline rising threshold for cpmCPUTotal5minRev is 90 percent. Depending on the platform, some routers that run at 90 percent, for example, 2500s, can exhibit performance degradation versus a high-end router, for example, the 7500 series, which can operate fine. Reference: http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/15215-collect-cpu-util-snmp.html	SNMP_AGENT	5m	system.cpu.util[cpmCPUTotal5minRev.{#SNMPINDEX}]

Trigger prototypes

Name	Description	Expression	Priority	Dependencies
#{#SNMPINDEX}: High CPU utilization	CPU utilization is too high. The system might be slow to respond.	min(/Cisco IOS SNMP/system.cpu.util[cpmCPUTotal5minRev.{#SNMPINDEX}],5m)>{$CPU.UTIL.CRIT}	WARNING 📢	#{#SNMPINDEX}: CPU utilization

Discovery rule №2

Name	Description	Type	Interval	Key and additional info
Entity Serial Numbers Discovery	-	SNMP_AGENT	1h	entity_sn.discovery

Item prototypes

Name	Description	Type	Interval	Key and additional info
{#ENT_NAME}: Hardware serial number	MIB: ENTITY-MIB	SNMP_AGENT	1h	system.hw.serialnumber[entPhysicalSerialNum.{#SNMPINDEX}]

Trigger prototypes

Name	Description	Expression	Priority	Dependencies
{#ENT_NAME}: Device has been replaced	Device serial number has changed. Ack to close	last(/Cisco IOS SNMP/system.hw.serialnumber[entPhysicalSerialNum.{#SNMPINDEX}],#1)<>last(/Cisco IOS SNMP/system.hw.serialnumber[entPhysicalSerialNum.{#SNMPINDEX}],#2) and length(last(/Cisco IOS SNMP/system.hw.serialnumber[entPhysicalSerialNum.{#SNMPINDEX}]))>0	INFO 🔔	{#ENT_NAME}: Hardware serial number

Discovery rule №3

Name	Description	Type	Interval	Key and additional info
FAN Discovery	The table of fan status maintained by the environmental monitor.	SNMP_AGENT	1h	fan.discovery

Item prototypes

Name	Description	Type	Interval	Key and additional info
{#SENSOR_INFO}: Fan status	MIB: CISCO-ENVMON-MIB	SNMP_AGENT	3m	sensor.fan.status[ciscoEnvMonFanState.{#SNMPINDEX}]

Trigger prototypes

Name	Description	Expression	Priority	Dependencies
{#SENSOR_INFO}: Fan is in critical state	Please check the fan unit	count(/Cisco IOS SNMP/sensor.fan.status[ciscoEnvMonFanState.{#SNMPINDEX}],#1,"eq","{$FAN_CRIT_STATUS:"critical"}")=1 or count(/Cisco IOS SNMP/sensor.fan.status[ciscoEnvMonFanState.{#SNMPINDEX}],#1,"eq","{$FAN_CRIT_STATUS:"shutdown"}")=1	AVERAGE ⚠	{#SENSOR_INFO}: Fan status
{#SENSOR_INFO}: Fan is in warning state	Please check the fan unit	count(/Cisco IOS SNMP/sensor.fan.status[ciscoEnvMonFanState.{#SNMPINDEX}],#1,"eq","{$FAN_WARN_STATUS:"warning"}")=1 or count(/Cisco IOS SNMP/sensor.fan.status[ciscoEnvMonFanState.{#SNMPINDEX}],#1,"eq","{$FAN_WARN_STATUS:"notFunctioning"}")=1	WARNING 📢	{#SENSOR_INFO}: Fan status

Discovery rule №4

Name	Description	Type	Interval	Key and additional info
Memory Discovery	Discovery of ciscoMemoryPoolTable, a table of memory pool monitoring entries. http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/15216-contiguous-memory.html	SNMP_AGENT	1h	memory.discovery

Item prototypes

Name	Description	Type	Interval	Key and additional info
{#SNMPVALUE}: Free memory	MIB: CISCO-MEMORY-POOL-MIB Indicates the number of bytes from the memory pool that are currently unused on the managed device. Note that the sum of ciscoMemoryPoolUsed and ciscoMemoryPoolFree is the total amount of memory in the pool Reference: http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/15216-contiguous-memory.html	SNMP_AGENT	-	vm.memory.free[ciscoMemoryPoolFree.{#SNMPINDEX}]
{#SNMPVALUE}: Used memory	MIB: CISCO-MEMORY-POOL-MIB Indicates the number of bytes from the memory pool that are currently in use by applications on the managed device. Reference: http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/15216-contiguous-memory.html	SNMP_AGENT	-	vm.memory.used[ciscoMemoryPoolUsed.{#SNMPINDEX}]
{#SNMPVALUE}: Memory utilization	Memory utilization in %.	CALCULATED	-	vm.memory.util[vm.memory.util.{#SNMPINDEX}]

Trigger prototypes

Name	Description	Expression	Priority	Dependencies
{#SNMPVALUE}: High memory utilization	The system is running out of free memory.	min(/Cisco IOS SNMP/vm.memory.util[vm.memory.util.{#SNMPINDEX}],5m)>{$MEMORY.UTIL.MAX}	AVERAGE ⚠	{#SNMPVALUE}: Memory utilization

Discovery rule №5

Name	Description	Type	Interval	Key and additional info
Network interfaces discovery	Discovering interfaces from IF-MIB.	SNMP_AGENT	1h	net.if.discovery

Item prototypes

Name	Description	Type	Interval	Key and additional info
Interface {#IFNAME}({#IFALIAS}): Inbound packets discarded	MIB: IF-MIB The number of inbound packets which were chosen to be discarded even though no errors had been detected to prevent their being deliverable to a higher-layer protocol. One possible reason for discarding such a packet could be to free up buffer space. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.	SNMP_AGENT	3m	net.if.in.discards[ifInDiscards.{#SNMPINDEX}]
Interface {#IFNAME}({#IFALIAS}): Inbound packets with errors	MIB: IF-MIB For packet-oriented interfaces, the number of inbound packets that contained errors preventing them from being deliverable to a higher-layer protocol. For character-oriented or fixed-length interfaces, the number of inbound transmission units that contained errors preventing them from being deliverable to a higher-layer protocol. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.	SNMP_AGENT	3m	net.if.in.errors[ifInErrors.{#SNMPINDEX}]
Interface {#IFNAME}({#IFALIAS}): Bits received	MIB: IF-MIB The total number of octets received on the interface, including framing characters. This object is a 64-bit version of ifInOctets. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.	SNMP_AGENT	3m	net.if.in[ifHCInOctets.{#SNMPINDEX}]
Interface {#IFNAME}({#IFALIAS}): Outbound packets discarded	MIB: IF-MIB The number of outbound packets which were chosen to be discarded even though no errors had been detected to prevent their being deliverable to a higher-layer protocol. One possible reason for discarding such a packet could be to free up buffer space. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.	SNMP_AGENT	3m	net.if.out.discards[ifOutDiscards.{#SNMPINDEX}]
Interface {#IFNAME}({#IFALIAS}): Outbound packets with errors	MIB: IF-MIB For packet-oriented interfaces, the number of outbound packets that contained errors preventing them from being deliverable to a higher-layer protocol. For character-oriented or fixed-length interfaces, the number of outbound transmission units that contained errors preventing them from being deliverable to a higher-layer protocol. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.	SNMP_AGENT	3m	net.if.out.errors[ifOutErrors.{#SNMPINDEX}]
Interface {#IFNAME}({#IFALIAS}): Bits sent	MIB: IF-MIB The total number of octets transmitted out of the interface, including framing characters. This object is a 64-bit version of ifOutOctets.Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.	SNMP_AGENT	3m	net.if.out[ifHCOutOctets.{#SNMPINDEX}]
Interface {#IFNAME}({#IFALIAS}): Speed	MIB: IF-MIB An estimate of the interface's current bandwidth in units of 1,000,000 bits per second. If this object reports a value of n' then the speed of the interface is somewhere in the range of n-500,000' to`n+499,999'. For interfaces which do not vary in bandwidth or for those where no accurate estimation can be made, this object should contain the nominal bandwidth. For a sub-layer which has no concept of bandwidth, this object should be zero.	SNMP_AGENT	5m	net.if.speed[ifHighSpeed.{#SNMPINDEX}]
Interface {#IFNAME}({#IFALIAS}): Operational status	MIB: IF-MIB The current operational state of the interface. - The testing(3) state indicates that no operational packet scan be passed - If ifAdminStatus is down(2) then ifOperStatus should be down(2) - If ifAdminStatus is changed to up(1) then ifOperStatus should change to up(1) if the interface is ready to transmit and receive network traffic - It should change todormant(5) if the interface is waiting for external actions (such as a serial line waiting for an incoming connection) - It should remain in the down(2) state if and only if there is a fault that prevents it from going to the up(1) state - It should remain in the notPresent(6) state if the interface has missing(typically, hardware) components.	SNMP_AGENT	-	net.if.status[ifOperStatus.{#SNMPINDEX}]
Interface {#IFNAME}({#IFALIAS}): Interface type	MIB: IF-MIB The type of interface. Additional values for ifType are assigned by the Internet Assigned Numbers Authority (IANA), through updating the syntax of the IANAifType textual convention.	SNMP_AGENT	1h	net.if.type[ifType.{#SNMPINDEX}]

Trigger prototypes

Name	Description	Expression	Priority	Dependencies
Interface {#IFNAME}({#IFALIAS}): Link down	This trigger expression works as follows: 1. Can be triggered if operations status is down. 2. {$IFCONTROL:"{#IFNAME}"}=1 - user can redefine Context macro to value - 0. That marks this interface as not important. No new trigger will be fired if this interface is down. 3. {TEMPLATE_NAME:METRIC.diff()}=1) - trigger fires only if operational status was up(1) sometime before. (So, do not fire 'ethernal off' interfaces.) WARNING: if closed manually - won't fire again on next poll, because of .diff.	{$IFCONTROL:"{#IFNAME}"}=1 and last(/Cisco IOS SNMP/net.if.status[ifOperStatus.{#SNMPINDEX}])=2 and (last(/Cisco IOS SNMP/net.if.status[ifOperStatus.{#SNMPINDEX}],#1)<>last(/Cisco IOS SNMP/net.if.status[ifOperStatus.{#SNMPINDEX}],#2))	AVERAGE ⚠	Interface {#IFNAME}({#IFALIAS}): Operational status

Discovery rule №6

Name	Description	Type	Interval	Key and additional info
EtherLike-MIB Discovery	Discovering interfaces from IF-MIB and EtherLike-MIB. Interfaces with up(1) Operational Status are discovered.	SNMP_AGENT	1h	net.if.duplex.discovery

Item prototypes

Name	Description	Type	Interval	Key and additional info
Interface {#IFNAME}({#IFALIAS}): Duplex status	MIB: EtherLike-MIB The current mode of operation of the MAC entity. 'unknown' indicates that the current duplex mode could not be determined. Management control of the duplex mode is accomplished through the MAU MIB. When an interface does not support autonegotiation, or when autonegotiation is not enabled, the duplex mode is controlled using ifMauDefaultType. When autonegotiation is supported and enabled, duplex mode is controlled using ifMauAutoNegAdvertisedBits. In either case, the currently operating duplex mode is reflected both in this object and in ifMauType. Note that this object provides redundant information with ifMauType. Normally, redundant objects are discouraged. However, in this instance, it allows a management application to determine the duplex status of an interface without having to know every possible value of ifMauType. This was felt to be sufficiently valuable to justify the redundancy. Reference: [IEEE 802.3 Std.], 30.3.1.1.32,aDuplexStatus.	SNMP_AGENT	-	net.if.duplex[dot3StatsDuplexStatus.{#SNMPINDEX}]

Trigger prototypes

Name	Description	Expression	Priority	Dependencies
Interface {#IFNAME}({#IFALIAS}): In half-duplex mode	Please check autonegotiation settings and cabling	last(/Cisco IOS SNMP/net.if.duplex[dot3StatsDuplexStatus.{#SNMPINDEX}])=2	WARNING 📢	Interface {#IFNAME}({#IFALIAS}): Duplex status

Discovery rule №7

Name	Description	Type	Interval	Key and additional info
PSU Discovery	The table of power supply status maintained by the environmental monitor card.	SNMP_AGENT	1h	psu.discovery

Item prototypes

Name	Description	Type	Interval	Key and additional info
{#SENSOR_INFO}: Power supply status	MIB: CISCO-ENVMON-MIB	SNMP_AGENT	3m	sensor.psu.status[ciscoEnvMonSupplyState.{#SNMPINDEX}]

Trigger prototypes

Name	Description	Expression	Priority	Dependencies
{#SENSOR_INFO}: Power supply is in critical state	Please check the power supply unit for errors	count(/Cisco IOS SNMP/sensor.psu.status[ciscoEnvMonSupplyState.{#SNMPINDEX}],#1,"eq","{$PSU_CRIT_STATUS:"critical"}")=1 or count(/Cisco IOS SNMP/sensor.psu.status[ciscoEnvMonSupplyState.{#SNMPINDEX}],#1,"eq","{$PSU_CRIT_STATUS:"shutdown"}")=1	AVERAGE ⚠	{#SENSOR_INFO}: Power supply status
{#SENSOR_INFO}: Power supply is in warning state	Please check the power supply unit for errors	count(/Cisco IOS SNMP/sensor.psu.status[ciscoEnvMonSupplyState.{#SNMPINDEX}],#1,"eq","{$PSU_WARN_STATUS:"warning"}")=1 or count(/Cisco IOS SNMP/sensor.psu.status[ciscoEnvMonSupplyState.{#SNMPINDEX}],#1,"eq","{$PSU_WARN_STATUS:"notFunctioning"}")=1	WARNING 📢	{#SENSOR_INFO}: Power supply status

Discovery rule №8

Name	Description	Type	Interval	Key and additional info
Temperature Discovery	Discovery of ciscoEnvMonTemperatureTable (ciscoEnvMonTemperatureDescr), a table of ambient temperature status maintained by the environmental monitor.	SNMP_AGENT	1h	temperature.discovery

Item prototypes

Name	Description	Type	Interval	Key and additional info
{#SNMPVALUE}: Temperature status	MIB: CISCO-ENVMON-MIB The current state of the test point being instrumented.	SNMP_AGENT	3m	sensor.temp.status[ciscoEnvMonTemperatureState.{#SNMPINDEX}]
{#SNMPVALUE}: Temperature	MIB: CISCO-ENVMON-MIB The current measurement of the test point being instrumented.	SNMP_AGENT	3m	sensor.temp.value[ciscoEnvMonTemperatureValue.{#SNMPINDEX}]

Trigger prototypes

Name	Description	Expression	Priority	Dependencies
{#SNMPVALUE}: Temperature is too low	-	avg(/Cisco IOS SNMP/sensor.temp.value[ciscoEnvMonTemperatureValue.{#SNMPINDEX}],5m)<{$TEMP_CRIT_LOW:"{#SNMPVALUE}"}	AVERAGE ⚠	{#SNMPVALUE}: Temperature