Prometheus SNMP exporter

Installation of Prometheus snmp exporter in production environment consists from following high level steps:

Install exporter;
Configure authentication;
Configure firewall;
Configure service for autostart and restart;
Check access to exporter from I&B monitoring platform.

1. Install Prometheus snmp exporter.

Check latest version, available platforms on snmp_exporter GitHub page and make necessary changes in variables on next step.
Prepare environment variables to simplify installation and configuration process.

Bash

export EXPORTER_VERSION=0.29.0
export EXPORTER_PLATFORM=linux-amd64

Download exporter.

Bash

wget https://github.com/prometheus/snmp_exporter/releases/download/v$EXPORTER_VERSION/snmp_exporter-$EXPORTER_VERSION.$EXPORTER_PLATFORM.tar.gz

Create directory /usr/local/bin/snmp_exporter and untar exporter into it.

sudo mkdir -p /usr/local/bin/snmp_exporter
sudo tar xvfz snmp_exporter-$EXPORTER_VERSION.$EXPORTER_PLATFORM.tar.gz -C /usr/local/bin/snmp_exporter --strip-components=1

Create prometheus user. If it already exist - go to step 6.

Fedora (RHEL, CentOS)

sudo useradd -M -s /sbin/nologin prometheus

-M (or --no-create-home): This option prevents the creation of a home directory for the new user;
-s /sbin/nologin: This option sets the user's login shell to /sbin/nologin. This effectively prevents the user from interactively logging into the system. While the user won't have a password set, this further ensures they cannot log in.

Debian (Ubuntu)

sudo useradd -s /sbin/nologin prometheus --no-create-home

Make prometheus user owner of snmp_exporter directory

sudo chown -hR prometheus:prometheus /usr/local/bin/snmp_exporter

2. Configure firewall

Configure firewall on resource

snmp exporter uses default port 9116, so allow it in firewall on resource.

Fedora (RHEL, CentOS)

sudo firewall-cmd --zone=public --add-port=9116/tcp --permanent
sudo systemctl reload firewalld

Check firewall configuration

sudo firewall-cmd --list-all

You should see in output:

ports: 9116/tcp

Debian (Ubuntu)

Bash

sudo ufw allow 9116

You should see in output:

Bash

Rules updated
Rules updated (v6)

Check firewall configuration

Bash

sudo ufw status

You should see in output:

Bash

To                             Action          From
--                             ------          ----
9116                           ALLOW           Anywhere

its good

3. Configure authentication for exporter

Do the steps described in Exporters configuration → Authentication section.

4. Check configuration

To run Run snmp_exporter with default config file for MIB of snp devices you need to download

wget https://raw.githubusercontent.com/prometheus/snmp_exporter/refs/heads/main/snmp.yml

/usr/local/bin/snmp_exporter/snmp_exporter --web.config.file=/usr/local/bin/snmp_exporter/web-config.yml --config.file=/path/to/downloaded/snmp.yml

In output you should see:

... msg="TLS is enabled." ...

Check with browser if it is accessible at:

https://resource-hostname-or-ip:9116/metrics

After entering exporter’s user name and password you should see page like this:

# HELP go_gc_duration_seconds A summary of the wall-time pause (stop-the-world) duration in garbage collection cycles.
# TYPE go_gc_duration_seconds summary
go_gc_duration_seconds{quantile="0"} 5.1499e-05
...

Stop snmp exporter with Ctrl-c in terminal where you run it.

Make snmp_exporter service for autostart and restart.

Create file with your preferred text editor, for example nano …

sudo nano /etc/systemd/system/snmp_exporter.service

… and paste following text into it.

[Unit]
Description=snmp Exporter

[Service]
User=prometheus
ExecStart=/usr/local/bin/snmp_exporter/snmp_exporter  --web.config.file=/usr/local/bin/snmp_exporter/web-config.yml --config.file=/path/to/downloaded/snmp.yml

[Install]
WantedBy=multi-user.target

Save file and exit editor.

Start service …

sudo systemctl daemon-reload
sudo systemctl start snmp_exporter
sudo systemctl enable snmp_exporter

… and check

sudo systemctl status snmp_exporter

You should see following output similar to:

In case of any problem, you should view log entries for service:

journalctl -u snmp_exporter.service -e

Now snmp exporter is ready to accept data and then expose it to Prometheus.