Monitor SNMP devices with Zabbix: v2c, v3, discovery and traps

web01 (192.168.56.81) will run snmpd as the “device”, and zbx01 (192.168.56.80) will poll it and receive traps. If web01 is behind remote-proxy from Lesson 19, that’s fine: you’ll create a separate host web01-snmp monitored by the server, so SNMP traffic goes straight from zbx01. The outputs below were captured from net-snmp 5.9.4 and a Zabbix 8.0.0 server; interface names and counters on your VM will differ.

1Install and configure snmpd on web01

Paste this whole block on web01:

sudo apt install -y snmpd
sudo cp /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.orig
sudo systemctl stop snmpd
sudo tee /etc/snmp/snmpd.conf >/dev/null <<'EOF'
sysLocation    Bhubaneswar lab rack 2
sysContact     noc@lab.local
sysServices    72
agentaddress   udp:161
view   labview    included   .1.3.6.1.2.1
view   labview    included   .1.3.6.1.4.1.2021
rocommunity  labro  192.168.56.80  -V labview
rocommunity  labro  192.168.56.82  -V labview
includeDir /etc/snmp/snmpd.conf.d
EOF
sudo net-snmp-create-v3-user -ro -a SHA -A 'Snmp@Auth2026' -x AES -X 'Snmp@Priv2026' zbxv3
sudo sed -i 's/^rouser zbxv3$/rouser zbxv3 authpriv -V labview/' /etc/snmp/snmpd.conf
sudo systemctl start snmpd
sudo ufw allow from 192.168.56.80 to any port 161 proto udp
sudo ss -ulnp | grep ':161 '

You should see this (your PID will differ):

adding the following line to /var/lib/snmp/snmpd.conf:
   createUser zbxv3 SHA "Snmp@Auth2026" AES "Snmp@Priv2026"
adding the following line to /etc/snmp/snmpd.conf:
   rouser zbxv3
Rule added
UNCONN 0  0   0.0.0.0:161   0.0.0.0:*   users:(("snmpd",pid=2741,fd=6))

The community labro is read-only and accepted only from zbx01 and zbxprx01, and the view limits what it can see to MIB-2 and the UCD (Net-SNMP) tree. net-snmp-create-v3-user must run while snmpd is stopped: it writes a createUser line to /var/lib/snmp/snmpd.conf, which snmpd turns into a hashed key on its next start, and appends rouser zbxv3 to the main config. The sed line after it requires authPriv and limits the v3 user to the same view as the community. These passwords are for the lab only.

✅ Checkpoint: ss on web01 shows snmpd listening on UDP 0.0.0.0:161 and ufw allows 161/udp from 192.168.56.80.

2Install net-snmp tools and MIBs on zbx01

Run this on zbx01:

sudo apt install -y snmp snmp-mibs-downloader
sudo sed -i 's/^mibs :/# mibs :/' /etc/snmp/snmp.conf
snmpget -v2c -c labro 192.168.56.81 sysName.0 sysLocation.0 sysUpTime.0

You should see this (your uptime will differ):

SNMPv2-MIB::sysName.0 = STRING: web01
SNMPv2-MIB::sysLocation.0 = STRING: Bhubaneswar lab rack 2
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (99244) 0:16:32.44

Ubuntu ships /etc/snmp/snmp.conf with mibs :, which disables MIB loading for licence reasons. Commenting it out after installing snmp-mibs-downloader lets the tools show names like sysName.0 instead of iso.3.6.1.2.1.1.5.0. Zabbix doesn’t need this, because it works with numeric OIDs.

✅ Checkpoint: snmpget from zbx01 returns sysName, sysLocation and sysUpTime of web01 with MIB names.

3Walk the interface table and find numeric OIDs

Run this on zbx01:

snmpwalk -v2c -c labro 192.168.56.81 IF-MIB::ifDescr
snmpwalk -v2c -c labro 192.168.56.81 IF-MIB::ifOperStatus
snmptranslate -On IF-MIB::ifHCInOctets

You should see:

IF-MIB::ifDescr.1 = STRING: lo
IF-MIB::ifDescr.2 = STRING: enp0s3
IF-MIB::ifDescr.3 = STRING: enp0s8
IF-MIB::ifOperStatus.1 = INTEGER: up(1)
IF-MIB::ifOperStatus.2 = INTEGER: up(1)
IF-MIB::ifOperStatus.3 = INTEGER: up(1)
.1.3.6.1.2.1.31.1.1.1.6

The number after the last dot is the interface index ({#SNMPINDEX} in Zabbix). snmptranslate -On turns a MIB name into the numeric OID that you’ll paste into Zabbix, and snmptranslate -Td shows the full MIB definition, including value maps like up(1) and down(2).

✅ Checkpoint: You can list web01’s interfaces with their index numbers and you know that ifHCInOctets is .1.3.6.1.2.1.31.1.1.1.6.

4Create the SNMP host with a v3 interface

In Data collection > Hosts click Create host: Host name web01-snmp, host group Lab/Network (type a new name to create it), Monitored by Server. Under Interfaces click Add > SNMP and fill it in:

Click Add. In real setups put the passphrases in secret macros (for example {$SNMPV3.AUTHPASS} with type Secret text) instead of typing them on each interface.

✅ Checkpoint: Data collection > Hosts lists web01-snmp with an SNMP interface 192.168.56.81:161.

5Add a get item and a walk[] master item

On web01-snmp open Items > Create item twice:

Use Test on the Interface walk item, tick Get value from host and click Get value and test.

The Result field shows this (your counters will differ):

.1.3.6.1.2.1.2.2.1.2.1 = STRING: "lo"
.1.3.6.1.2.1.2.2.1.2.2 = STRING: "enp0s3"
.1.3.6.1.2.1.2.2.1.2.3 = STRING: "enp0s8"
.1.3.6.1.2.1.2.2.1.8.1 = INTEGER: 1
.1.3.6.1.2.1.2.2.1.8.2 = INTEGER: 1
.1.3.6.1.2.1.2.2.1.8.3 = INTEGER: 1
.1.3.6.1.2.1.31.1.1.1.6.1 = Counter64: 775509698
.1.3.6.1.2.1.31.1.1.1.6.2 = Counter64: 48213377
.1.3.6.1.2.1.31.1.1.1.6.3 = Counter64: 1006927706

Zabbix always returns numeric OIDs in walk results, whatever MIBs are installed, so your dependent items never depend on MIB files on the server. sysUpTime counts hundredths of a second, which is why the 0.01 multiplier turns it into seconds for the “uptime” unit.

✅ Checkpoint: Testing the Interface walk item returns ifDescr, ifOperStatus and ifHCInOctets rows for every interface.

6Discover interfaces from the walk

Go to Discovery rules > Create discovery rule: Name Interface discovery, Type Dependent item, Key lab.if.discovery, Master item Interface walk. On the Preprocessing tab add SNMP walk to JSON with two fields: {#IFDESCR} = 1.3.6.1.2.1.2.2.1.2 and {#IFOPERSTATUS} = 1.3.6.1.2.1.2.2.1.8. Click Test on the preprocessing tab with the walk output as input.

You should see:

[{"{#SNMPINDEX}":"2","{#IFDESCR}":"enp0s3","{#IFOPERSTATUS}":"1"},{"{#SNMPINDEX}":"3","{#IFDESCR}":"enp0s8","{#IFOPERSTATUS}":"1"},{"{#SNMPINDEX}":"1","{#IFDESCR}":"lo","{#IFOPERSTATUS}":"1"}]

Zabbix adds {#SNMPINDEX} by itself. Now add an item prototype: Name Interface {#IFDESCR}: bits received, Type Dependent item, Key lab.if.in[{#SNMPINDEX}], Master item Interface walk, Units bps, preprocessing SNMP walk value 1.3.6.1.2.1.31.1.1.1.6.{#SNMPINDEX}, then Change per second, then Custom multiplier 8.

✅ Checkpoint: After a couple of minutes Latest data for web01-snmp shows “Interface enp0s8: bits received” with a bps value.

7Auto-add SNMP devices with network discovery

Go to Data collection > Discovery > Create discovery rule: Name Lab SNMP devices, Discovery by Server, IP range 192.168.56.81-82, Update interval 5m. Add a check: Check type SNMPv2 agent, Port range 161, SNMP community labro, SNMP OID 1.3.6.1.2.1.1.5.0. Set Host name to the value of that SNMP check, and keep the rule Enabled.

Then in Alerts > Actions > Discovery actions create Add lab SNMP devices with conditions Discovery rule equals Lab SNMP devices, Discovery status equals Up and Service type equals SNMPv2 agent, and operations Add host, Add to host groups Lab/Network and Link templates Linux by SNMP. After the next scan open Monitoring > Discovery.

Monitoring > Discovery after the first scan: web01 is Up for the SNMPv2 agent check

Pick the uniqueness and host name settings carefully: if a device already exists as a host with the same name, the action fails to add a second one, and linking a template that clashes with templates already on the host fails with a “cannot link template” message in the server log.

✅ Checkpoint: Monitoring > Discovery shows 192.168.56.81 Up for the SNMPv2 agent check.

8Receive SNMP traps on zbx01

Install snmptrapd and the Perl module, copy Zabbix’s trap receiver script, and tell both sides about the trap file.

Paste this whole block on zbx01:

sudo apt install -y snmptrapd libsnmp-perl
wget -q https://raw.githubusercontent.com/zabbix/zabbix/release/8.0/misc/snmptrap/zabbix_trap_receiver.pl
sudo install -m 755 zabbix_trap_receiver.pl /usr/local/bin/zabbix_trap_receiver.pl
sudo sed -i "s#^\$SNMPTrapperFile = .*#\$SNMPTrapperFile = '/var/log/zabbix/snmptraps.log';#" /usr/local/bin/zabbix_trap_receiver.pl
sudo tee /etc/snmp/snmptrapd.conf >/dev/null <<'EOF'
authCommunity execute labtrap
perl do "/usr/local/bin/zabbix_trap_receiver.pl";
EOF
sudo tee -a /etc/zabbix/zabbix_server.conf >/dev/null <<'EOF'
StartSNMPTrapper=1
SNMPTrapperFile=/var/log/zabbix/snmptraps.log
EOF
sudo systemctl restart snmptrapd zabbix-server
sudo ufw allow from 192.168.56.0/24 to any port 162 proto udp

On web01-snmp add two items of type SNMP trap: snmptrap["IF-MIB::linkDown"] (Log) and snmptrap.fallback (Log). Then send a test trap from web01, which has the snmp package from step 1 (install it with sudo apt install -y snmp if not).

Run this on web01:

snmptrap -v2c -c labtrap 192.168.56.80 '' 1.3.6.1.6.3.1.1.5.3 1.3.6.1.2.1.2.2.1.1.2 i 2 1.3.6.1.2.1.2.2.1.8.2 i 2

Latest data for the item snmptrap[“IF-MIB::linkDown”] shows this (your times, port and uptime will differ):

2026-11-08T12:35:44+0530 PDU INFO:
  version                        1
  community                      labtrap
  notificationtype               TRAP
  receivedfrom                   UDP: [192.168.56.81]:49724->[192.168.56.80]:162
VARBINDS:
  DISMAN-EVENT-MIB::sysUpTimeInstance type=67 value=Timeticks: (780079) 2:10:00.79
  SNMPv2-MIB::snmpTrapOID.0      type=6  value=OID: IF-MIB::linkDown
  IF-MIB::ifIndex.2              type=2  value=INTEGER: 2
  IF-MIB::ifOperStatus.2         type=2  value=INTEGER: 2

1.3.6.1.6.3.1.1.5.3 is the standard linkDown trap. The receiver script writes a ZBXTRAP header with the source address, and the SNMP trapper matched it to web01-snmp because the interface IP is 192.168.56.81. A trigger like nodata(/web01-snmp/snmptrap["IF-MIB::linkDown"],5m)=0 turns each trap into a problem for five minutes.

✅ Checkpoint: Latest data for web01-snmp shows the linkDown trap text in snmptrap[“IF-MIB::linkDown”].