Oid 1 SNMP Traps

Plugin: go.d.plugin Module: snmp_traps

Overview

Receive, decode, and store SNMP traps and INFORMs from Oid 1 devices with Netdata. The bundled Oid 1 trap profile decodes 216 trap definitions across 47 MIBs into structured journal events with named, typed varbinds — searchable and filterable in the Logs tab.

Netdata's SNMP trap listener receives traps on UDP/162, matches them to the Oid 1 enterprise OID space, and decodes the varbinds using the bundled Oid 1 trap profile. No per-trap configuration.

This integration is supported on all platforms.

This integration supports multiple instances configured side-by-side.

Default Behavior

Auto-Detection

Traps from Oid 1 devices are decoded automatically once the device is pointed at the Agent's trap listener.

Limits

The default configuration for this integration does not impose any limits.

Performance Impact

The default configuration for this integration is not expected to impose a significant performance impact on the system.

Setup

You can configure the snmp_traps collector in two ways:

Method	Best for	How to
UI	Fast setup without editing files	Go to Nodes → Configure this node → Collectors → Jobs, search for snmp_traps, then click + to add a job.
File	If you prefer configuring via file, or need to automate deployments (e.g., with Ansible)	Edit go.d/snmp_traps.conf and add a job.

important

UI configuration requires paid Netdata Cloud plan.

Prerequisites

Devices configured to send traps

The devices must be configured to send SNMP traps or INFORMs to the Netdata Agent acting as the site's trap receiver, and the trap port must be reachable from them.

A usable Netdata log directory

Jobs that write direct journals store them under ${NETDATA_LOG_DIR}/traps/ — /var/log/netdata on package installs, /opt/netdata/var/log/netdata on static ones. Job creation fails if that directory is missing or unwritable. A job that only exports over OTLP can set journal.enabled: false instead.

Permission to bind the trap port

The default listener is UDP/162, a privileged port: binding it needs CAP_NET_BIND_SERVICE or root on Linux. Netdata packages grant this capability, so standard installations just work; hardened or custom deployments must grant it, or move the listener to an unprivileged port.

Configuration

Options

Configure the trap listener: the address and port it binds, the SNMP versions and credentials it accepts, and the enrichment options — see the SNMP Trap Listener page for the full option reference. Trap decoding itself needs no configuration: the stock trap profiles ship with Netdata.

via UI

Configure the snmp_traps collector from the Netdata web interface:

1. Go to Nodes.
2. Select the node where you want the snmp_traps data-collection job to run and click the ⚙ (Configure this node). That node will run the data collection.
3. The Collectors → Jobs view opens by default.
4. In the Search box, type snmp_traps (or scroll the list) to locate the snmp_traps collector.
5. Click the + next to the snmp_traps collector to add a new job.
6. Fill in the job fields, then click Test to verify the configuration and Submit to save.
   • Test runs the job with the provided settings and shows whether data can be collected.
   • If it fails, an error message appears with details (for example, connection refused, timeout, or command execution errors), so you can adjust and retest.

via File

The configuration file name for this integration is go.d/snmp_traps.conf.

The file format is YAML. Generally, the structure is:

update_every: 1
autodetection_retry: 0
jobs:
  - name: some_name1
  - name: some_name2

You can edit the configuration file using the edit-config script from the Netdata config directory.

cd /etc/netdata 2>/dev/null || cd /opt/netdata/etc/netdata
sudo ./edit-config go.d/snmp_traps.conf

Examples

Basic (SNMPv1/v2c)

A single listener on the standard trap port, accepting any SNMPv1/v2c community. listen is required: without an endpoint the job binds nothing. Restrict the allowlist for production.

jobs:
  - name: local
    listen:
      endpoints:
        - protocol: udp
          address: 0.0.0.0
          port: 162
    versions:
      - v1
      - v2c

Alerts

There are no alerts configured by default for this integration.

Metrics

Netdata decodes 216 trap definitions from Oid 1 across 47 MIBs into structured journal events. A trap is decoded only if the device actually sends it; inclusion here means the profile can decode it.

By severity: alert 5 · crit 6 · err 3 · warning 121 · notice 75 · info 6

By category: state_change 126 · config_change 12 · security 35 · auth 1 · mobility 2 · diagnostic 39 · unknown 1

Coverage by MIB

47 MIBs decoded — show per-MIB trap counts

MIB	Trap definitions
DC-ISIS-MIB	18
ISIS-D13-MIB	17
IB-SM-MIB	15
IPSEC-FLOW-MONITOR-MIB	15
SLAPM-MIB	12
IB-SMA-MIB	10
PGM-MIB	9
DC-BGP-MIB	8
IPSEC-SA-MON-MIB	8
IPSEC-MIB	7
MPLS-LSR-MIB	6
FCMGMT-MIB	5
IBSWITCH-MIB	5
MPLS-VPN-MIB	5
OPS-MIB	5
IPPM-MIB	4
IPSEC-TUN-MON-MIB	4
MPLS-CEM-MIB	4
SMF-MIB	4
DC-EVPN-MIB	3
DC-RTM-MIB	3
H320ENTIRY-MIB	3
IEEE802dot11-MIB	3
MPLS-TE-MIB	3
SCSPATMARP-MIB	3
VPLS-MIB	3
DC-PIM-BSR-MIB	2
DC-PIM-MIB	2
DRAFT-MSDP-MIB	2
DVMRP-MIB	2
DVMRP-STD-MIB	2
IEEE8023-LAG-MIB	2
IPPM-CONTROL-MIB	2
MPLS-FRR-MIB	2
MSDP-MIB	2
PCE-PCEP-DRAFT-MIB	2
PW-CEP-MIB	2
SEE-MIB	2
SNA-LLC-MIB	2
BULK-DATA-MIB	1
FRF16-MFR-MIB-EXP	1
H221-MIB	1
MPLS-VPN-MIB-DRAFT-05	1
PIM-MIB	1
PIMG-MIB	1
SCSP-MIB	1
XGCP-MIB	1

Sample decoded traps

• DC-RTM-MIB::rtmOperStateChange
• DC-RTM-MIB::rtmStaticRouteChange
• DC-RTM-MIB::rtmPathActivityChange
• DC-ISIS-MIB::isisDatabaseOverload
• DC-ISIS-MIB::isisManualAddressDrops