Skip to main content
Version: 7.4

Objects

Objects define the SNMP objects and attributes that may be polled by the SNMP Input.

The location of the object definition files is specified by EF_INPUT_SNMP_OBJECT_DEFINITIONS_DIRECTORY_PATH in the collectors configuration options. The default location is /etc/elastiflow/snmp/objects.

Configuration Example

IF-MIB::ifEntry:
mib: IF-MIB
object: ifEntry
index:
- type: Integer
oid: .1.3.6.1.2.1.2.2.1.1
name: netif
syntax: InterfaceIndex
discovery_attribute: ifDescr
attributes:
ifDescr:
oid: .1.3.6.1.2.1.2.2.1.2
tag: true
name: netif.descr
syntax: DisplayString
ifType:
oid: .1.3.6.1.2.1.2.2.1.3
tag: true
name: netif.type
syntax: IANAifType
ifSpeed:
oid: .1.3.6.1.2.1.2.2.1.5
name: netif.bandwidth.bw
syntax: Gauge32
ifPhysAddress:
oid: .1.3.6.1.2.1.2.2.1.6
tag: true
name: netif.mac
syntax: PhysAddress
ifAdminStatus:
oid: .1.3.6.1.2.1.2.2.1.7
name: netif.state.admin
syntax: EnumInteger
ifOperStatus:
oid: .1.3.6.1.2.1.2.2.1.8
name: netif.state.oper
syntax: EnumInteger
ifInOctets:
oid: .1.3.6.1.2.1.2.2.1.10
name: netif.bytes.in
syntax: Counter32
ifInUcastPkts:
oid: .1.3.6.1.2.1.2.2.1.11
name: netif.packets.ucast.in
syntax: Counter32
ifInDiscards:
oid: .1.3.6.1.2.1.2.2.1.13
name: netif.packets.discard.in
syntax: Counter32
ifInErrors:
oid: .1.3.6.1.2.1.2.2.1.14
name: netif.packets.error.in
syntax: Counter32
ifInUnknownProtos:
oid: .1.3.6.1.2.1.2.2.1.15
name: netif.packets.unkproto.in
syntax: Counter32
ifOutOctets:
oid: .1.3.6.1.2.1.2.2.1.16
name: netif.bytes.out
syntax: Counter32
ifOutUcastPkts:
oid: .1.3.6.1.2.1.2.2.1.17
name: netif.packets.ucast.out
syntax: Counter32
ifOutDiscards:
oid: .1.3.6.1.2.1.2.2.1.19
name: netif.packets.discard.out
syntax: Counter32
ifOutErrors:
oid: .1.3.6.1.2.1.2.2.1.20
name: netif.packets.error.out
syntax: Counter32

Configuration Attributes

mib

Contains the name of the SNMP MIB where the object is defined.

EXAMPLE: mib: IF-MIB

object

Contains the name of the SNMP object which the attributes. This is usually one level up from where the attributes are defined.

EXAMPLE: object: ifEntry

index (optional)

The Object Identifier (OID) of a value provided by an agent is made of of the OID of the values definition and the ID of the index of the value within the agent. Scalar SNMP values will always have an index of .0. The index of values within an SNMP conceptual table is defined in the MIB by the INDEX clause.

This option describes the contents of the index, and how the collector will process them. The following are examples of index definitions.

caution

An contains attributes from a conceptual table must include either index or augments definition. If both are omitted, the object's attributes must be only scalar values.

A single value index:

index:
- type: Integer
oid: .1.3.6.1.2.1.2.2.1.1
name: netif
syntax: InterfaceIndex

A multi-value index:

index:
- type: IpAddress
oid: .1.3.6.1.2.1.14.17.1.1
name: ospf.lsdb.link_local.lsa.netif # ospfLocalLsdbIpAddress
syntax: IpAddress
- type: Integer32
oid: .1.3.6.1.2.1.14.17.1.2
name: ospf.lsdb.link_local.lsa.netif # ospfLocalLsdbAddressLessIf
syntax: InterfaceIndexOrZero
- type: Integer
oid: .1.3.6.1.2.1.14.17.1.3
name: ospf.lsdb.link_local.lsa.type # ospfLocalLsdbType
syntax: EnumInteger
- type: IpAddress
oid: .1.3.6.1.2.1.14.17.1.4
name: ospf.lsdb.link_local.lsa.lsid # ospfLocalLsdbLsid
syntax: IpAddressNoSuffix
- type: IpAddress
oid: .1.3.6.1.2.1.14.17.1.5
name: ospf.lsdb.link_local.lsa.router.id # ospfLocalLsdbRouterId
syntax: IpAddressNoSuffix # RouterID

type

Defines the type of the index value. Valid values are:

  • Integer
  • OctetString
  • ImplicitOctetString
  • ObjectIdentifier
  • ImplicitObjectIdentifier
  • Integer32
  • IpAddress
  • MacAddress
  • Unsigned32
  • Opaque

oid

The OID of the index value's MIB definition.

EXAMPLE: oid: .1.3.6.1.2.1.2.2.1.1

name

The name of the field in the output record to which the value will be assigned.

syntax

The syntax of the value. See below for details on all supported syntax values.

augments (optional)

An object which "augments" another object shares the index definition of that object.

caution

An contains attributes from a conceptual table must include either index or augments definition. If both are omitted, the object's attributes must be only scalar values.

EXAMPLE: augments: IF-MIB::ifEntry

discovery_attribute

The attribute defined in the attributes section which will be inspected to discover all available indices.

attributes

The attributes section contains a list of SNMP MIB values to collect for this object.

oid

The OID of the value's MIB definition.

EXAMPLE: oid .1.3.6.1.2.1.31.1.1.1.6

tag (optional)

Specifies whether the attribute is "tag", also referred to as a "label" or "dimension" by various time-series datastores, or a metric value.

Default: tag: false

name

The name of the field in the output record to which the attribute's value will be assigned.

syntax

The syntax of the value. See below for details on all supported syntax values.

overrides (optional)

A common SNMP pattern is the instrumentation of both 32-bit and 64-bit variations of a value. In such scenarios it is unnecessary to collect both values. For example, when the 64-bit value is available it should be preferred, or "override" the 32-bit version.

This attribute defines the object and attribute that an attribute should override, if available.

EXAMPLE:

overrides:
object: IF-MIB::ifEntry
attribute: ifOutOctets
object

The object of the attribute to be overridden.

attribute

The attribute of to be overridden.

rediscover

Defines whether the attribute can trigger a rediscovery, and how the value is evaluated to trigger the rediscovery. Valid values are:

  • OnChange - Any change in the value compared to the previous poll.
  • OnReset - A reduction in the value compared to the previous poll.

Supported syntax Types

The syntax field specifies how the raw SNMP values should be interpreted by NetObserv SNMP. Object index and attribute definitions support the follow syntax values.

SNMPv2-SMI (RFC 2578) Types

syntaxoutput type
Integer64-bit integer
IntegerAsID64-bit integer, which may be stored as a string/keyword
Integer3264-bit integer
UnsignedAsID64-bit unsigned, which may be stored as a string/keyword
Unsigned3264-bit unsigned
Gauge3264-bit unsigned
Counter3264-bit unsigned
Counter6464-bit unsigned
OctetStringhex string
ObjectIdentifierstring
IpAddressIPv4 or IPv6 address, output with .ip.addr suffix added
IpAddressNoSuffixIPv4 or IPv6 address, output without an added suffix
IpAddressAsIDIPv4 address, output as an IP, which may be stored as a string/keyword
IpAddressAsUnsigned32IPv4 address, output as a unsigned 32-bit integer
TimeTicks64-bit unsigned
Opaquehex string

SNMPv2-TC (RFC 2579) Types

syntaxoutput type
DisplayStringstring
PhysAddressMAC-formatted string
MacAddressMAC-formatted string, output with .addr suffix added
MacAddressNoSuffixMAC-formatted string, output without an added suffix
TruthValueenumerated .value & .state
AutonomousTypestring
InstancePointerstring
VariablePointerstring
RowPointerstring
RowStatusenumerated ID & name
TimeStampduration normalized to EF_PROCESSOR_DURATION_PRECISION
TimeIntervalduration normalized to EF_PROCESSOR_DURATION_PRECISION
DateAndTimetimestamp normalized to EF_PROCESSOR_TIMESTAMP_PRECISION
StorageTypeenumerated ID & name
TDomainstring
TAddresshex string

FLOAT-TC-MIB (RFC 6340) Types

syntaxoutput type
Float3264-bit float
Float6464-bit float

HCNUM-TC (RFC 2856) Types

syntaxoutput type
CounterBasedGauge6464-bit unsigned
ZeroBasedCounter6464-bit unsigned

Common MIB-defined Types

syntaxoutput type
IanaL4Protoenumerated .id & .name
IanaSafienumerated .id & .name
IANAifTypeenumerated .id & .name
InterfaceIndexoutput with .index suffix added
InterfaceIndexOrZerooutput with .index suffix added
InetAddressTypeenumerated .id & .name
InetVersionenumerated .id & .name

Enumerated Types

syntaxoutput type
EnumBitmapenumerated .bits & .tags - see Enumerations
EnumIntegerenumerated .id & .name - see Enumerations
EnumIntegerKeepIDenumerated .id & .name - see Enumerations
EnumObjectIdentifierenumerated .oid & .name - see Enumerations
EnumObjectIdentifierKeepOIDenumerated .oid & .name - see Enumerations

Unit Types

Unit types can be defined for any attribute with an underlying type of Integer, Integer32, Unsigned32, Gauge32, Counter32, Counter64, Float32 or Float64.

Bandwidth Types

Bandwidth types are normalized to bits/sec and output as a 64-bit unsigned value.

syntaxdescription
BandwidthBitsbits
BandwidthKBitskilobits (1000 bits)
BandwidthMBitsmegabits (1000000 bits)
BandwidthGBitsgigabits (1000000000 bits)
BandwidthTBitsterabits (1000000000000 bits)
BandwidthBytesbytes (8 bits)
BandwidthKByteskilobytes (8000 bits)
BandwidthMBytesmegabytes (8000000 bits)
BandwidthGBytesgigabytes (8000000000 bits)
BandwidthTBytesterabytes (8000000000000 bits)

Byte Types

Byte types are normalized to bytes and output as a 64-bit unsigned value.

syntaxdescription
BytesBbytes
BytesB44-byte units
BytesKBkilobytes (1000 bytes)
BytesMBmegabytes (1000000 bytes)
BytesGBgigabytes (1000000000 bytes)
BytesTBterabytes (1000000000000 bytes)
BytesKiBkibibytes (1024 bytes)
BytesMiBmebibytes (1048576 bytes)
BytesGiBgibibytes (1073741824 bytes)
BytesTiBtibibytes (1099511627776 bytes)

Decibel Types

Decibel types are normalized to decibels and output as a 64-bit float value.

syntaxdescription
Decibeldecibels

Signal Level Types

Signal Level types are normalized to dBm and output as a 64-bit float value.

syntaxdescription
SignalDBmdBm
SignalDeciDBm1/10th of a dBm
SignalCentiDBm1/100th of a dBm
SignalMilliDBm1/1000th of a dBm

Current Types

Current types are normalized to amps and output as a 64-bit float value.

syntaxdescription
CurrentKiloAmpkiloamps
CurrentAmpamps
CurrentDeciAmp1/10th of an amp
CurrentCentiAmp1/100th of an amp
CurrentMilliAmpmilliamps
CurrentMicroAmpmicroamps
CurrentNanoAmpnanoamps

Energy Types

Energy types are normalized to joules and output as a 64-bit float value.

syntaxdescription
EnergyGigaJoulegigajoules
EnergyMegaJoulemegajoules
EnergyKiloJoulekilojoules
EnergyJoulejoules
EnergyDeciJoule1/10th of a joule
EnergyCentiJoule1/100th of a joule
EnergyMilliJoulemillijoules
EnergyMicroJoulemicrojoules
EnergyNanoJoulenanojoules

Timestamp Types

Timestamp types are normalized to a quantity of time units since epoch, as specified by EF_PROCESSOR_TIMESTAMP_PRECISION, and output as a 64-bit unsigned value.

syntaxdescription
EpochSecseconds since epoch
EpochDeciSec1/10ths of a second since epoch
EpochCentiSec1/100ths of a second since epoch
EpochMilliSecmilliseconds since epoch
EpochMicroSecmicroseconds since epoch
EpochNanoSecnanoseconds since epoch

Frequency Types

Frequency types are normalized to hertz and output as a 64-bit float value.

syntaxdescription
FreqGHzgigahertz
FreqMHzmegahertz
FreqKHzkilohertz
FreqHzhertz
FreqDeciHzdecihertz
FreqCentiHzcentihertz
FreqMilliHzmillihertz

Length Types

Length types are normalized to meters and output as a 64-bit float value.

syntaxdescription
LengthKiloMeterkilometers
LengthMetermeters
LengthDeciMeterdecimeters
LengthCentiMetercentimeters
LengthMilliMetermillimeters
LengthMicroMetermicrometers
LengthNanoMeternanometers

Operation Duration Types

Operation Duration types are normalized to nanoseconds and output as a 64-bit float value.

syntaxdescription
OpTicksSecseconds
OpTicksDeciSec1/10ths of a second
OpTicksCentiSec1/100ths of a second
OpTicksMilliSecmilliseconds
OpTicksHundredMicroSec100 microseconds
OpTicksTenMicroSec10 microseconds
OpTicksMicroSecmicroseconds
OpTicksHundredNanoSec100 nanoseconds
OpTicksTenNanoSec10 nanoseconds
OpTicksNanoSecnanoseconds
OpTicksHundredPicoSec100 picoseconds
OpTicksTenPicoSec10 picoseconds
OpTicksPicoSecpicoseconds

Percentage Types

Percentage types are normalized to either a 0-1 or 0-100 based percentage, as specified by EF_PROCESSOR_PERCENT_NORM, and output as a 64-bit float value.

syntaxdescription
Percent10-1 based percentage
PercentDeci10-1 based percentage in 1/10ths of a percent
PercentCenti10-1 based percentage in 1/100ths of a percent
PercentMilli10-1 based percentage in 1/1000ths of a percent
Percent1000-100 based percentage
PercentDeci1000-100 based percentage in 1/10ths of a percent
PercentCenti1000-100 based percentage in 1/100ths of a percent
PercentMilli1000-100 based percentage in 1/1000ths of a percent

Power Types

Power types are normalized to watts and output as a 64-bit float value.

syntaxdescription
PowerGigaWattgigawatts
PowerMegaWattmegawatts
PowerKiloWattkilowatts
PowerWattwatts
PowerDeciWattdeciwatts
PowerCentiWattcentiwatts
PowerMilliWattmilliwatts
PowerMicroWattmicrowatts
PowerNanoWattnanowatts

Rate Types

Rate types are normalized to quantity/sec and output as a 64-bit float value.

syntaxdescription
RateMina quantity per minute
RateSeca quantity per second
RateDeciSeca quantity per 1/10th of a second
RateCentiSeca quantity per 1/100th of a second
RateMilliSeca quantity per millisecond
RateMicroSeca quantity per microsecond
RateNanoSeca quantity per nanosecond

Temperature Types

Temperature types are normalized to degrees celsius and output as a 64-bit float value.

syntaxdescription
TemperatureCdegrees celsius
TemperatureDeciC1/10th degrees celsius
TemperatureCentiC1/100th degrees celsius
TemperatureMilliC1/1000th degrees celsius

Duration Types

Duration types are normalized to a quantity of time units, as specified by EF_PROCESSOR_DURATION_PRECISION, and output as a 64-bit unsigned value.

syntaxdescription
TicksMinminutes
TicksSecseconds
TicksDeciSec1/10ths of a second
TicksCentiSec1/100ths of a second
TicksMilliSecmilliseconds
TicksMicroSecmicroseconds
TicksNanoSecnanoseconds

Voltage Types

Voltage types are normalized to volts and output as a 64-bit float value.

syntaxdescription
VoltageKiloVoltkilovolts
VoltageVoltvolts
VoltageDeciVolt1/10ths of a volt
VoltageCentiVolt1/100ths of a volt
VoltageMilliVoltmillivolts
VoltageMicroVoltmicrovolts
VoltageNanoVoltnanovolts

Wavelength Types

Wavelength types are normalized to nanometers and output as a 64-bit float value.

syntaxdescription
WavelengthKiloMeterkilometers
WavelengthMetermeters
WavelengthDeciMeterdecimeters
WavelengthCentiMetercentimeters
WavelengthMilliMetermillimeters
WavelengthMicroMetermicrometers
WavelengthNanoMetermeters