Prometheus snmp_exporter: Monitor Switches and Routers

Routers and switches cannot expose a Prometheus /metrics endpoint, but they all speak SNMP - which is exactly what snmp_exporter bridges: it walks the device over SNMP and re-exposes the results as Prometheus metrics. Together with Grafana this gives you a fully open-source network observability stack: interface utilization, error rates, up/down states and alerting, all in the same platform as your server metrics. This guide covers the exporter setup, the snmp.yml auth/module model, the Prometheus relabel boilerplate, and the PromQL queries that matter.

How It Fits Together

Prometheus --GET /snmp?target=192.0.2.1&module=if_mib--> snmp_exporter
snmp_exporter --SNMP GET/GETBULK--> router / switch

The exporter is stateless: Prometheus pulls http://snmp-exporter:9116/snmp?target=<device>&module=<module>, the exporter polls the device and returns metrics. auth and module are defined in snmp.yml; modules are pre-built walk definitions (the default if_mib covers interface counters for most switches and routers).

Configuration

# prometheus.yml
scrape_configs:
- job_name: "snmp-network"
  static_configs:
  - targets:
    - 192.0.2.1      # core-sw-01
    - 192.0.2.2      # core-sw-02
  metrics_path: /snmp
  params:
    module: [if_mib]
  relabel_configs:
  - source_labels: [__address__]
    target_label: __param_target
  - source_labels: [__param_target]
    target_label: instance
  - target_label: __address__
    replacement: snmp-exporter:9116

The relabel block is boilerplate for every SNMP job: it passes the real device address as the target parameter, labels the instance with it, and points the scrape at the exporter. For SNMPv3 devices, define an auth section in snmp.yml (username, auth/protocol+password, priv protocol+password) and pass auth: [<name>] in params - see the exporter README for the generator-based snmp.yml workflow.

Useful PromQL for Network Monitoring

# interface utilization (use 64-bit counters when available)
rate(ifHCOutOctets{instance="192.0.2.1"}[5m]) * 8 / 1e9   # Gbps out
rate(ifHCInOctets{instance="192.0.2.1"}[5m]) * 8 / 1e9    # Gbps in

# interface error rate
rate(ifInErrors{instance="192.0.2.1"}[5m]) / rate(ifHCInOctets{instance="192.0.2.1"}[5m])

# alert: interface down (ifOperStatus up = 1, down = 2)
expr: ifOperStatus{ifDescr!~"Loopback.*"} == 2
for: 2m

Prefer ifHC* (64-bit) counters where supported - 32-bit counters wrap on busy 10G+ links in minutes. The for: 2m guard on the down alert prevents flap noise.

Operational Notes

• Start with the if_mib module and a read-only v2c community (public_v2 auth) to prove the pipeline, then move to SNMPv3 (authPriv) - configuration steps for v3 users on Cisco/Junos are in our AAA article and the SNMPv3 guides on this site.
• When the NMS cannot reach a device at all, work the connectivity problem methodically - the 8-step SNMP troubleshooting flow in our 华为 CE 交换机 SNMP 排障指南 applies to any vendor.
• Verify the underlying NIC/interface health from the host side with ethtool when exporter numbers disagree with device CLI output.

原文链接：https://github.com/prometheus/snmp_exporter