SNMP Graphing with Telegraf, InfluxDB and Grafana

Bandwidth graphs are the single most requested network dashboard, and the TIG stack —
Telegraf, InfluxDB, Grafana — delivers them with three open-source components and no vendor
licence. Telegraf does the polling, InfluxDB stores the time series, Grafana draws it. The part
that catches people out is the mathematics: SNMP interface counters are cumulative integers,
not rates, so a graph built directly on ifHCInOctets shows a monotonically rising
line instead of traffic. This guide builds the stack and the queries properly.

Install the Three Components

# InfluxDB 2.x
wget -qO- https://repos.influxdata.com/influxdata-archive_compat.key | sudo apt-key add -
echo "deb https://repos.influxdata.com/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/influxdb.list
sudo apt update && sudo apt install -y influxdb2 telegraf snmp snmp-mibs-downloader

# Grafana
wget -q -O - https://packages.grafana.com/gpg.key | sudo apt-key add -
echo "deb https://packages.grafana.com/oss/deb stable main" | sudo tee /etc/apt/sources.list.d/grafana.list
sudo apt update && sudo apt install -y grafana

sudo systemctl enable --now influxdb telegraf grafana-server
# InfluxDB UI on :8086, Grafana on :3000 — complete the InfluxDB setup wizard,
# create org "netops" and bucket "network", then copy the API token.

Telegraf: Poll SNMP and Write to InfluxDB

Keep snippets in /etc/telegraf/telegraf.d/ rather than one giant file. Note the
use of ifHCInOctets/ifHCOutOctets — the 64-bit counters. The 32-bit
variants wrap on anything faster than a few hundred Mbit/s and produce negative spikes that
look like outages.

# /etc/telegraf/telegraf.d/snmp.conf
[agent]
  interval = "30s"
  round_interval = true
  metric_batch_size = 1000
  metric_buffer_limit = 10000
  flush_interval = "10s"

[[inputs.snmp]]
  agents = ["192.168.1.1:161", "192.168.1.2:161"]
  version = 2
  community = "public"
  name = "network"
  timeout = "5s"
  retries = 3
  agent_host_tag = "source"

  [[inputs.snmp.field]]
    name = "hostname"
    oid = "RFC1213-MIB::sysName.0"
    is_tag = true

  [[inputs.snmp.field]]
    name = "uptime"
    oid = "RFC1213-MIB::sysUpTime.0"

  # Cisco CPU (platform dependent)
  [[inputs.snmp.field]]
    name = "cpu_5min"
    oid = "CISCO-PROCESS-MIB::cpmCPUTotal5minRev.1"

  [[inputs.snmp.table]]
    name = "interface"
    inherit_tags = ["hostname"]

    [[inputs.snmp.table.field]]
      name = "ifName"
      oid = "IF-MIB::ifName"
      is_tag = true
    [[inputs.snmp.table.field]]
      name = "ifAlias"
      oid = "IF-MIB::ifAlias"
      is_tag = true
    [[inputs.snmp.table.field]]
      name = "in_octets"
      oid = "IF-MIB::ifHCInOctets"
    [[inputs.snmp.table.field]]
      name = "out_octets"
      oid = "IF-MIB::ifHCOutOctets"
    [[inputs.snmp.table.field]]
      name = "in_errors"
      oid = "IF-MIB::ifInErrors"
    [[inputs.snmp.table.field]]
      name = "out_errors"
      oid = "IF-MIB::ifOutErrors"
    [[inputs.snmp.table.field]]
      name = "oper_status"
      oid = "IF-MIB::ifOperStatus"

[outputs.influxdb_v2]
  urls = ["http://localhost:8086"]
  token = "YOUR-INFLUX-TOKEN"
  organization = "netops"
  bucket = "network"

For production, use SNMPv3 instead of a community string — sec_level = "authPriv"
with SHA and AES, and a read-only user:

[[inputs.snmp]]
  agents = ["192.168.1.1:161"]
  version = 3
  sec_name = "monitoring"
  sec_level = "authPriv"
  auth_protocol = "SHA"
  auth_password = "AuthPass123"
  priv_protocol = "AES"
  priv_password = "PrivPass123"
  name = "network_secure"

Test Before You Trust

# Does Telegraf collect anything at all?
sudo -u telegraf telegraf --config /etc/telegraf/telegraf.conf --test | head -40

# Does the device answer SNMP independently of Telegraf?
snmpwalk -v2c -c public 192.168.1.1 IF-MIB::ifHCInOctets | head
snmpget  -v2c -c public 192.168.1.1 IF-MIB::ifDescr.1

# Is data landing in InfluxDB?
influx query 'from(bucket:"network") |> range(start: -5m) |> filter(fn:(r)=> r._measurement=="interface") |> limit(n:5)'

If telegraf --test prints data but Grafana shows nothing, the problem is the
output plugin or the token, not the SNMP configuration.

Grafana: Data Source and the Bandwidth Query

Add InfluxDB as a data source (query language Flux, URL
http://localhost:8086, org netops, token, default bucket
network). Then build the panel query that actually matters — a
derivative to convert the counter into a rate, and a multiplication to get bits
per second:

from(bucket: "network")
  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)
  |> filter(fn: (r) => r._measurement == "interface")
  |> filter(fn: (r) => r._field == "in_octets" or r._field == "out_octets")
  |> filter(fn: (r) => r.ifName == "Te1/1")
  |> derivative(unit: 1s, nonNegative: true)
  |> map(fn: (r) => ({ r with _value: r._value * 8.0 / 1000000.0 }))
  |> aggregateWindow(every: v.windowPeriod, fn: mean, createEmpty: false)
  |> yield(name: "bandwidth_mbps")

nonNegative: true is not optional — it absorbs the counter reset that happens
when an interface bounces, which would otherwise produce a large negative spike that blows the
Y-axis scale.

Three more panels worth building immediately:

• Interface error rate — derivative on
  in_errors/out_errors, alerting on any non-zero rate for more than five
  minutes.
• Availability — oper_status as a state timeline, so a flapping
  link shows as a band of colour instead of a line you have to squint at.
• Device uptime — sysUpTime resetting proves an unplanned
  reboot, which is often the real cause behind a mystery outage.

Retention and Scale

# Keep raw data 30 days, downsample for the long view
influx bucket create --name network-30d --org netops --retention 720h --token $TOKEN
influx task create --org netops --token $TOKEN --file downsample.flux

• Poll critical interfaces every 10s and everything else every 60s. Per-input
  interval overrides the agent default.
• Watch the agent_host_tag and interface name cardinality — a changing interface
  name is a new series and will grow the index.
• Set ifAlias descriptions on the devices themselves. Those descriptions become
  tags, and tags become alert text that says uplink to DC2 instead of
  Te1/1.

If your shop is already Prometheus-centric, Zabbix SNMP switch monitoring with LLD is the alternative collector pattern, and VictoriaMetrics single-node vs cluster deployment is worth reading before you commit to long-term InfluxDB retention.

原文链接：https://binadit.com/tutorials/integrate-snmp-monitoring-with-influxdb-and-telegraf-for-time-series-analysis