The discovery methods we examined before were all Zabbix-agent based. Zabbix also supports discovering entities over SNMP. This is different from the dynamic SNMP index support we discussed in Chapter 4, Monitoring SNMP Devices. The dynamic SNMP index allows us to monitor a specific entity by name—for example, a network interface by its name. SNMP support in LLD allows us to discover all entities and monitor them.

Let's see how we could use it to discover all network interfaces:

1. Navigate to Configuration | Hosts, click on Discovery next to the host for which you created SNMP items previously, and click on Create discovery rule. Populate these fields:

• • Name: SNMP interface discovery
  • Type: SNMPv2 agent (or choose another, supported SNMP version)
  • Key: snmp.interface.discovery
  • SNMP OID: discovery[{#IFDESCR}, IF-MIB::ifDescr]
  • Update interval: 120s

2. When done, click on the Add button at the bottom.

The discovery itself was very similar to what we have created so far, with one exception—the SNMP OID value. For the SNMP LLD, we define the macro name and the OID table to be discovered. In this case, Zabbix would look at all the individual values in the IF-MIB::ifDescr table and assign them to the {#IFDESCR} macro, which is the name we just specified in the SNMP OID field. In addition to the macro we specified, Zabbix will also add one extra macro for each entity discovered – #SNMPINDEX}. That, as we will see in a moment, will be useful when creating item prototypes.

To create some prototypes, next to the new discovery rule, click on Item prototype, and then click on Create item prototype. Fill in the following:

• Name: Incoming traffic on interface $1 (SNMP LLD)
• Type: SNMPv2 agent
• Key: lld.ifInOctets[{#IFDESCR}]
• SNMP OID: IF-MIB::ifInOctets.{#SNMPINDEX}
• Units: Bps
• Preprocessing: Change per second

When done, click on the Add button at the bottom.

Notice how we prefixed lld to the item key. That way, there is no chance it could clash with the items we created manually earlier. As for the SNMP OID, we used the built-in {#SNMPINDEX} macro, which should uniquely identify values in the SNMP table. If we add such an item manually, we would find out which is the correct index for the desired interface and use that number directly. That's for the incoming traffic—to make this more complete, click on Incoming traffic on interface {#IFDESCR} (SNMP LLD) in the Name column, and then click on the Clone button at the bottom. In the Name field, change Incoming to Outgoing. In both of the Key and SNMP OID fields, change In to Out so that the OID has ifOutOctets. When done, click on the Add button at the bottom. Navigate to Configuration | Hosts and click on Items next to the host we just worked on. After a couple of minutes, there should be new items here, according to those two prototypes. As this is a configuration page, make sure to refresh it every now and then, otherwise the changes will not be visible.

Most likely, the loopback interface will be in the list as well. We did not apply any filtering for this LLD rule:

As before, let's create a graph prototype for these items:

1. Click on Discovery rules in the navigation header above the item list, click on Graph prototypes next to SNMP interface discovery, and then click on the Create graph prototype button. In the Name field, enter Traffic on {#IFDESCR} (SNMP). Click on Add prototype in the Items section, mark the checkboxes next to both of the prototypes, and click on Select.
2. Click on the Add button at the bottom. If you look at the list of graphs in the configuration section for this host after a few minutes, a new graph should appear for each interface there.

The ifDescr OID is usually the interface name. It is quite common to use the ifAlias OID for a more user-friendly description. We could change our discovery to ifAlias instead of ifDescr, but not all systems will have a useful ifAlias value on all interfaces, and we might want to know the ifDescr value anyway. Zabbix can discover multiple OIDs in a single LLD rule as well. Let's go back to the discovery rule configuration for this host and click on SNMP interface discovery in the Name column. Modify the SNMP OID field to read the following:

discovery[{#IFDESCR}, IF-MIB::ifDescr, {#IFALIAS}, IF-MIB::ifAlias] 

Further OIDs are added as extra parameters, where the macro name is always followed by the OID. We could also add more OIDs, if needed:

key[{#MACRO1}, MIB::OID1, {#MACRO2}, MIB::OID2, {#MACROn}, MIB::OIDn] 

In this case, though, ifAlias should be enough. Click on the Update button at the bottom, and then click on Graph prototypes next to the SNMP interface discovery entry. Click on Traffic on {#IFDESCR} (SNMP) in the Namecolumn, and change the name for this graph prototype:

Traffic on {#IFDESCR} ({#IFALIAS}) (SNMP) 

This way, if an interface has ifAlias set, it will be included in the graph name. We still keep the ifDescr value, as that is a unique interface identifier, and some interfaces might have nothing to return for the ifAlias OID. Let's go to the graph configuration for this host. After a few minutes have passed, the graph names should be updated, with ifAlias included in the parentheses.

This approach also provides an easy way to monitor selected interfaces only. If you have a large number of network devices and only a few selected ports are to be monitored, the description for those ports could be changed on the device—for example, they could all be prefixed with zbx. This will show up in the ifAlias OID, and we would filter by the {#IFALIAS} macro in the LLD rule properties.