InfluxDB and Telegraf in Grafana, including SNMP

InfluxDB runs on graf01 (192.168.56.70); Telegraf and snmpd run on app01 (192.168.56.71). Tokens are long random strings, so you’ll keep them in files with chmod 600 instead of typing them. The InfluxDB data source in Grafana uses port 8181, the InfluxDB 3 default, not the 8086 you may know from older versions.

1Add the InfluxData repository and install InfluxDB 3 Core on graf01

Paste this whole block on graf01:

cd /tmp
curl --silent --location -O https://repos.influxdata.com/influxdata-archive.key
gpg --show-keys --with-fingerprint --with-colons ./influxdata-archive.key 2>&1 \
  | grep -q '^fpr::*24C975CBA61A024EE1B631787C3D57159FC2F927:$' \
  && cat influxdata-archive.key | gpg --dearmor \
  | sudo tee /usr/share/keyrings/influxdata-archive.gpg >/dev/null \
  && echo 'deb [signed-by=/usr/share/keyrings/influxdata-archive.gpg] https://repos.influxdata.com/debian stable main' \
  | sudo tee /etc/apt/sources.list.d/influxdata.list
sudo apt-get update && sudo apt-get install -y influxdb3-core
influxdb3 --version
grep -v ^# /etc/influxdb3/influxdb3-core.conf | grep .

Leaving out the apt messages, you should see:

deb [signed-by=/usr/share/keyrings/influxdata-archive.gpg] https://repos.influxdata.com/debian stable main
influxdb3 InfluxDB 3 Core, 3.12.2, revision cc9769917ab399ed5b48567a92b5d34ed4d918ea
node-id="primary-node"
object-store="file"
data-dir="/var/lib/influxdb3/data"
plugin-dir="/var/lib/influxdb3/plugins"

The package writes a long, fully commented config file and switches on only these four keys, so the grep hides the comments.

The grep checks the key’s fingerprint before trusting it, which is what InfluxData’s own install guide does; if the fingerprint doesn’t match, nothing is written. The package enables the influxdb3-core unit but doesn’t start it, so you can configure it first.

✅ Checkpoint: The version check prints a 3.x version and the TOML file shows object-store file and data-dir /var/lib/influxdb3/data.

2Cap memory and start the service

graf01 has 3 GB shared by Grafana, Prometheus, Loki and now InfluxDB. The systemd launcher turns each TOML key into an INFLUXDB3_* environment variable, so you add settings to the same file.

Paste this whole block on graf01:

sudo tee -a /etc/influxdb3/influxdb3-core.conf >/dev/null <<'EOF'
exec-mem-pool-size = "10%"
disable-telemetry-upload = true
EOF
sudo systemctl start influxdb3-core
sleep 5; systemctl is-active influxdb3-core
sudo ss -ltnp | grep 8181
sudo ufw status | grep 8181 || echo "8181 not open in ufw (good for now)"

You should see this (your pid and fd numbers will differ):

active
LISTEN 0      1024         0.0.0.0:8181       0.0.0.0:*    users:(("influxdb3",pid=6114,fd=12))
8181 not open in ufw (good for now)

Until the first admin token exists, InfluxDB 3 accepts the token-creation call without authentication, so whoever reaches port 8181 first could claim it. ufw already blocks 8181 from other machines, which closes that window; you’ll open it for app01 only after the next step.

✅ Checkpoint: influxdb3-core is active, listening on 8181, and ufw has no rule for 8181 yet.

3Create the operator token, a database and client tokens

Run this on graf01:

influxdb3 create token --admin

You should see this (the token is shortened here):

New token created successfully!

Token: apiv3_kH3q...0w==
HTTP Requests Header: Authorization: Bearer apiv3_kH3q...0w==

IMPORTANT: Store this token securely, as it will not be shown again.

Copy the token (the whole apiv3_... string) into a private file and use it for the next commands:

Paste this whole block on graf01 (put your token in the first line):

echo 'apiv3_PASTE_YOUR_OPERATOR_TOKEN' > ~/.influxdb3-operator && chmod 600 ~/.influxdb3-operator
export INFLUXDB3_AUTH_TOKEN=$(cat ~/.influxdb3-operator)
influxdb3 create database --retention-period 30d telegraf
influxdb3 show databases
influxdb3 create token --admin --name telegraf
influxdb3 create token --admin --name grafana
sudo ufw allow from 192.168.56.71 to any port 8181 proto tcp

You should see this (tokens shortened here):

Database "telegraf" created successfully
+---------------+
| iox::database |
+---------------+
| _internal     |
| telegraf      |
+---------------+

New token created successfully!

Token: apiv3_Q9vd...Lw==
HTTP Requests Header: Authorization: Bearer apiv3_Q9vd...Lw==

IMPORTANT: Store this token securely, as it will not be shown again.


New token created successfully!

Token: apiv3_7mPa...Jg==
HTTP Requests Header: Authorization: Bearer apiv3_7mPa...Jg==

IMPORTANT: Store this token securely, as it will not be shown again.

Rule added

Save the telegraf token for step 4 and the grafana token for step 6. The 30 day retention period means rows older than 30 days stop being queryable and are removed, which keeps the lab disk small. _internal is InfluxDB’s own system database.

✅ Checkpoint: show databases lists telegraf, you have three tokens (operator, telegraf, grafana) and ufw allows 8181 from 192.168.56.71 only.

4Install Telegraf on app01 and send Linux metrics

Paste this whole block on app01 (repository lines are the same as on graf01):

cd /tmp
curl --silent --location -O https://repos.influxdata.com/influxdata-archive.key
gpg --show-keys --with-fingerprint --with-colons ./influxdata-archive.key 2>&1 \
  | grep -q '^fpr::*24C975CBA61A024EE1B631787C3D57159FC2F927:$' \
  && cat influxdata-archive.key | gpg --dearmor \
  | sudo tee /usr/share/keyrings/influxdata-archive.gpg >/dev/null \
  && echo 'deb [signed-by=/usr/share/keyrings/influxdata-archive.gpg] https://repos.influxdata.com/debian stable main' \
  | sudo tee /etc/apt/sources.list.d/influxdata.list
sudo apt-get update && sudo apt-get install -y telegraf

# token goes in an environment file only root can read
echo 'INFLUX_TOKEN=apiv3_PASTE_THE_TELEGRAF_TOKEN' | sudo tee /etc/default/telegraf >/dev/null
sudo chmod 600 /etc/default/telegraf

sudo mv /etc/telegraf/telegraf.conf /etc/telegraf/telegraf.conf.sample
sudo tee /etc/telegraf/telegraf.conf >/dev/null <<'EOF'
[agent]
  interval = "10s"
  flush_interval = "10s"
  snmp_translator = "gosmi"

[[outputs.influxdb_v3]]
  urls = ["http://192.168.56.70:8181"]
  token = "${INFLUX_TOKEN}"
  database = "telegraf"

[[inputs.cpu]]
  percpu = false
  totalcpu = true

[[inputs.mem]]

[[inputs.disk]]
  ignore_fs = ["tmpfs", "devtmpfs", "overlay", "squashfs"]

[[inputs.net]]
  interfaces = ["enp0s3", "enp0s8"]

[[inputs.system]]
EOF
sudo -u telegraf telegraf --config /etc/telegraf/telegraf.conf --test --input-filter cpu:mem 2>/dev/null
sudo systemctl restart telegraf && systemctl is-active telegraf

You should see this (your numbers will differ, and the two lines can swap places):

> cpu,cpu=cpu-total,host=app01 usage_guest=0,usage_guest_nice=0,usage_idle=97.01492537313433,usage_iowait=0.4975124378109453,usage_irq=0,usage_nice=0,usage_softirq=0,usage_steal=0,usage_system=1.4925373134328357,usage_user=0.9950248756218906 1794135610000000000
> mem,host=app01 active=512319488u,available=905338880u,available_percent=58.890451982820174,buffered=48439296u,cached=611934208u,commit_limit=1573711872u,committed_as=1187516416u,dirty=118784u,free=153419776u,high_free=0u,high_total=0u,huge_page_size=2097152u,huge_pages_free=0u,huge_pages_total=0u,inactive=659230720u,low_free=0u,low_total=0u,mapped=214523904u,page_tables=9682944u,shared=1851392u,slab=137916416u,sreclaimable=91463680u,sunreclaim=46452736u,swap_cached=0u,swap_free=805302272u,swap_total=805302272u,total=1537327104u,used=519266304u,used_percent=33.777216484956995,vmalloc_chunk=0u,vmalloc_total=35184372087808u,vmalloc_used=24326144u,write_back=0u,write_back_tmp=0u 1794135610000000000
active

Telegraf sorts the fields by name in test mode. The u after a number marks an unsigned integer, and the cpu input is gathered twice half a second apart so it can work out the usage percentages.

--test runs the inputs once and prints line protocol without sending anything, which is the best way to check a new input. The sample config that ships with the package enables an old InfluxDB 1.x output by default, which is why you replace the file instead of editing it. Telegraf reads /etc/default/telegraf through its systemd unit, so ${INFLUX_TOKEN} in the config is filled in at start and the token never sits in telegraf.conf.

✅ Checkpoint: The Telegraf test run prints cpu and mem lines for host=app01 and the telegraf service is active.

5Query InfluxDB with SQL from the CLI

Run this on graf01:

export INFLUXDB3_AUTH_TOKEN=$(cat ~/.influxdb3-operator)
influxdb3 query --database telegraf \
  "SELECT table_name FROM information_schema.tables WHERE table_schema = 'iox' ORDER BY table_name"
influxdb3 query --database telegraf \
  "SELECT time, host, round(100 - usage_idle, 1) AS cpu_busy FROM cpu WHERE cpu = 'cpu-total' ORDER BY time DESC LIMIT 3"

You should see this (your times and values will differ):

+------------+
| table_name |
+------------+
| cpu        |
| disk       |
| mem        |
| net        |
| system     |
+------------+
+---------------------+-------+----------+
| time                | host  | cpu_busy |
+---------------------+-------+----------+
| 2026-11-08T11:00:40 | app01 | 2.9      |
| 2026-11-08T11:00:30 | app01 | 3.1      |
| 2026-11-08T11:00:20 | app01 | 2.6      |
+---------------------+-------+----------+

Each Telegraf input became a table, created on the first write. Rows arrive every 10 seconds, and the time column is UTC.

✅ Checkpoint: The table list shows cpu, disk, mem, net and system, and the cpu query returns recent rows for app01.

6Add the InfluxDB data source in Grafana

In Grafana go to Connections > Data sources > Add data source > InfluxDB and fill in:

Click Save & test. A green result means Grafana reached port 8181 over Flight SQL and the token was accepted. Without Insecure Connection the test fails, because Grafana tries TLS on a port that only speaks plain gRPC.

✅ Checkpoint: The InfluxDB data source saves and tests green with SQL.

7Build the “Linux via Telegraf” dashboard

Create a dashboard Linux via Telegraf in SaatVedha Lab. Add a query variable host on the InfluxDB data source with SELECT DISTINCT host FROM cpu WHERE $__timeFilter(time), then these panels:

CPU busy % (time series):

SELECT $__dateBin(time) AS time, 100 - avg(usage_idle) AS "CPU busy"
FROM cpu
WHERE $__timeFilter(time) AND cpu = 'cpu-total' AND host = '$host'
GROUP BY 1 ORDER BY 1

Memory and root disk used % (two queries on one time series panel):

SELECT $__dateBin(time) AS time, avg(used_percent) AS "RAM used"
FROM mem WHERE $__timeFilter(time) AND host = '$host' GROUP BY 1 ORDER BY 1

SELECT $__dateBin(time) AS time, avg(used_percent) AS "Root disk used"
FROM disk WHERE $__timeFilter(time) AND host = '$host' AND path = '/' GROUP BY 1 ORDER BY 1

Network in, bits per second (counter turned into a rate):

SELECT time, interface,
  (CAST(bytes_recv AS DOUBLE) - LAG(CAST(bytes_recv AS DOUBLE)) OVER w) * 8
  / ((CAST(time AS BIGINT) - LAG(CAST(time AS BIGINT)) OVER w) / 1e9) AS in_bps
FROM net
WHERE $__timeFilter(time) AND host = '$host'
WINDOW w AS (PARTITION BY interface ORDER BY time)
ORDER BY time

Set the unit to percent (0-100) for the first two panels and bits/sec (SI) for the network panel. CAST(time AS BIGINT) gives nanoseconds, so dividing by 1e9 gives seconds between samples. If the network panel draws one line instead of one per interface, add the Partition by values transformation on the interface field.

✅ Checkpoint: Linux via Telegraf shows CPU busy, RAM and root disk percentages, and a bits per second line for enp0s3 and enp0s8.

8Turn app01 into a pretend tower router with snmpd

A real tower site has a router you can’t install Telegraf on. snmpd on app01 plays that role. Ubuntu’s default snmpd only listens on 127.0.0.1 and shows only the system group to the public community, so you write your own config with a private community and the interface tables visible.

Paste this whole block on app01:

sudo apt-get install -y snmpd snmp snmp-mibs-downloader
sudo sed -i 's/^mibs :/# mibs :/' /etc/snmp/snmp.conf
sudo cp /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.orig
sudo tee /etc/snmp/snmpd.conf >/dev/null <<'EOF'
agentaddress  udp:161
view   netview  included  .1.3.6.1.2.1.1
view   netview  included  .1.3.6.1.2.1.2
view   netview  included  .1.3.6.1.2.1.31
rocommunity  tower-ro  127.0.0.1         -V netview
rocommunity  tower-ro  192.168.56.0/24   -V netview
sysLocation  KOL-0142 tower shelter, Kolkata
sysContact   noc@lab.local
EOF
sudo systemctl restart snmpd
snmpget -v2c -c tower-ro 192.168.56.71 SNMPv2-MIB::sysName.0 SNMPv2-MIB::sysLocation.0
snmpwalk -v2c -c tower-ro 192.168.56.71 IF-MIB::ifName

You should see:

SNMPv2-MIB::sysName.0 = STRING: app01
SNMPv2-MIB::sysLocation.0 = STRING: KOL-0142 tower shelter, Kolkata
IF-MIB::ifName.1 = STRING: lo
IF-MIB::ifName.2 = STRING: enp0s3
IF-MIB::ifName.3 = STRING: enp0s8

snmp-mibs-downloader (from Ubuntu’s multiverse section) fetches the standard IETF and IANA MIB files into /usr/share/snmp/mibs/ietf and iana, and commenting out mibs : lets the net-snmp tools load them, so you see names like ifName instead of numbers. The three views expose system, interfaces and the 64-bit interface counters, nothing else.

✅ Checkpoint: snmpget returns sysName app01 and the KOL-0142 location, and snmpwalk lists lo, enp0s3 and enp0s8.

9Poll the “router” with Telegraf inputs.snmp

Add an SNMP input in its own file. Telegraf on app01 polls 192.168.56.71 over the network, the same way it would poll a router at a tower site, and adding a second device later is one more entry in agents.

Paste this whole block on app01:

sudo tee /etc/telegraf/telegraf.d/snmp-towers.conf >/dev/null <<'EOF'
[[inputs.snmp]]
  agents = ["udp://192.168.56.71:161"]
  version = 2
  community = "tower-ro"
  timeout = "5s"
  retries = 3
  agent_host_tag = "source"
  path = ["/usr/share/snmp/mibs"]

  [[inputs.snmp.field]]
    oid = "SNMPv2-MIB::sysName.0"
    name = "sysName"
    is_tag = true

  [[inputs.snmp.field]]
    oid = "SNMPv2-MIB::sysUpTime.0"
    name = "uptime"
    conversion = "float(2)"

  [[inputs.snmp.table]]
    oid = "IF-MIB::ifXTable"
    name = "interface"
    inherit_tags = ["sysName"]

    [[inputs.snmp.table.field]]
      oid = "IF-MIB::ifName"
      is_tag = true

    [[inputs.snmp.table.field]]
      oid = "IF-MIB::ifOperStatus"
EOF
sudo -u telegraf telegraf --config /etc/telegraf/telegraf.conf --config-directory /etc/telegraf/telegraf.d \
  --test --input-filter snmp 2>/dev/null | head -n 3
sudo systemctl restart telegraf

The first line is the device row (your uptime will differ):

> snmp,host=app01,source=192.168.56.71,sysName=app01 uptime=118734.52 1794136020000000000

The next two lines are interface rows that start with > interface,host=app01,ifName=lo,source=192.168.56.71,sysName=app01 and the same for ifName=enp0s3, each followed by a long, sorted list of fields such as ifHCInOctets, ifHCOutOctets, ifHighSpeed and ifOperStatus.

Telegraf walked the whole ifXTable (64-bit counters, ifName, ifHighSpeed) and joined ifOperStatus from ifTable because both use the same interface index. agent_host_tag = "source" names the polled device’s address tag the same way other Telegraf plugins do, and sysName is copied to every interface row so you can filter by device name.

✅ Checkpoint: The Telegraf test run prints an snmp line and one interface line per ifName, and the service restarts cleanly.

10Build the “Tower routers (SNMP)” dashboard

Create a dashboard Tower routers (SNMP) with a variable device (SELECT DISTINCT "sysName" FROM interface WHERE $__timeFilter(time)) and these panels:

Interface traffic in and out, bits per second (time series):

SELECT time, "ifName",
  (CAST("ifHCInOctets" AS DOUBLE)  - LAG(CAST("ifHCInOctets" AS DOUBLE))  OVER w) * 8
    / ((CAST(time AS BIGINT) - LAG(CAST(time AS BIGINT)) OVER w) / 1e9) AS in_bps,
  (CAST("ifHCOutOctets" AS DOUBLE) - LAG(CAST("ifHCOutOctets" AS DOUBLE)) OVER w) * 8
    / ((CAST(time AS BIGINT) - LAG(CAST(time AS BIGINT)) OVER w) / 1e9) AS out_bps
FROM interface
WHERE $__timeFilter(time) AND "sysName" = '$device' AND "ifName" <> 'lo'
WINDOW w AS (PARTITION BY "ifName" ORDER BY time)
ORDER BY time

Interface status (table, Format Table):

SELECT "ifName", last_value("ifOperStatus" ORDER BY time) AS status,
       last_value("ifHighSpeed" ORDER BY time) AS speed_mbps
FROM interface
WHERE $__timeFilter(time) AND "sysName" = '$device'
GROUP BY "ifName" ORDER BY "ifName"

Column names with capital letters ("ifName", "sysName") must be in double quotes in SQL, or they are read as lower case and not found. On the status table add value mappings 1 = up (green) and 2 = down (red). From graf01 run curl -s -o /dev/null http://app01/ in a loop or reuse the Lesson 8 traffic script, and the enp0s8 line climbs.

✅ Checkpoint: Tower routers (SNMP) shows in and out bits per second for enp0s3 and enp0s8, and the status table shows both as up.

11Snapshot both VMs

Run this on your laptop:

VBoxManage snapshot graf01 take influx-telegraf
VBoxManage snapshot app01 take influx-telegraf

You should see this (your UUIDs will differ):

0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100%
Snapshot taken. UUID: 5d9a2c47-8e13-4b6f-a0d2-6c7e1f3b9a84
0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100%
Snapshot taken. UUID: e8b03f15-4a7c-4d29-9b61-0f5d2e8c7a39

✅ Checkpoint: Both VMs have a snapshot called influx-telegraf.