---
title: SNMP Traps
description: Enable listening for SNMP traps.
breadcrumbs: Docs > Network Monitoring > Network Device Monitoring > SNMP Traps
---

# SNMP Traps

## Overview{% #overview %}

SNMP traps are notifications sent from an SNMP-enabled device to an SNMP manager when unusual activity occurs, such as a sudden state change on a piece of equipment.

Monitoring SNMP traps helps you capture issues that might otherwise go unnoticed due to device instability. For example, if an interface flaps between available and broken states every 15 seconds, polling every 60 seconds could miss the degree of network instability. Traps also provide visibility into the health of hardware components, such as device battery or chassis.

Datadog Agent v7.37+ supports listening for SNMP traps, enabling you to configure [monitors](https://docs.datadoghq.com/monitors/) for specific trap events.

## Configuration{% #configuration %}

To enable listening for SNMP traps, use the following instructions:

1. Ensure that your [firewall rules](https://docs.datadoghq.com/network_monitoring/devices/troubleshooting#traps-or-flows-not-being-received-at-all) allow incoming UDP traffic on the configured port.

1. Add the following to your `datadog.yaml` file:

   ```yaml
   network_devices:
     namespace: <NAMESPACE> # optional, defaults to "default".
     snmp_traps:
       enabled: true
       port: 9162 # on which ports to listen for traps
       community_strings: # which community strings to allow for v2 traps
         - <STRING_1>
         - <STRING_2>
       bind_host: 0.0.0.0
       users: # SNMP v3
       - user: "user"
         authKey: myAuthKey
         authProtocol: "SHA"
         privKey: myPrivKey
         privProtocol: "AES"
       - user: "user"
         authKey: myAuthKey
         authProtocol: "MD5"
         privKey: myPrivKey
         privProtocol: "DES"
       - user: "user2"
         authKey: myAuthKey2
         authProtocol: "SHA" # choices: MD5, SHA, SHA224, SHA256, SHA384, SHA512
         privKey: myPrivKey2
         privProtocol: "AES" # choices: DES, AES (128 bits), AES192, AES192C, AES256, AES256C
   ```

**Note**: Multiple v3 users and passwords are supported as of Datadog Agent `7.51` or higher.

## Viewing SNMP traps{% #viewing-snmp-traps %}

After configuration, SNMP traps are forwarded as logs to Datadog. You can find them in the [Log Explorer](https://app.datadoghq.com/logs) with the following search query: `source:snmp-traps`.

{% image
   source="https://datadog-docs.imgix.net/images/network_device_monitoring/snmp/snmp_traps_3.38f6b500060966416b46a24c6f71a16f.png?auto=format"
   alt="Log Explorer showing `source:snmp-traps` with an SNMP trap log line selected, highlighting the Network Device tag" /%}

{% alert level="info" %}
Even though SNMP traps are *forwarded as logs*, `logs_enabled` does **not** need to be set to `true`.
{% /alert %}

You can also view SNMP traps directly from the NDM device view. Select a device in [**Infrastructure > Network Devices**](https://app.datadoghq.com/devices) and click the **Events** tab. Syslog messages and SNMP traps are combined in a single view. Use the filters to narrow results by event type.

{% image
   source="https://datadog-docs.imgix.net/images/network_device_monitoring/network_topology_map/events.7f6b545ee284ff471459938eec0f1abd.png?auto=format"
   alt="The NDM device view with the Events tab open, showing Syslog messages and SNMP traps." /%}

### Using the default SNMP trap port 162{% #using-the-default-snmp-trap-port-162 %}

Binding to a port number under `1024` requires elevated permissions. To bind to a port number such as the default SNMP Trap port `162`, use the following instructions:

1. Grant access to the port using the `setcap` command:

   ```
   sudo setcap CAP_NET_BIND_SERVICE=+ep /opt/datadog-packages/datadog-agent/stable/bin/agent/agent
   ```

**Note**: Re-run this setcap command every time you upgrade the Agent.

1. Verify the setup is correct by running the `getcap` command:

   ```
   sudo getcap /opt/datadog-packages/datadog-agent/stable/bin/agent/agent
   ```

You should see the following output:

   ```
   /opt/datadog-packages/datadog-agent/stable/bin/agent/agent = cap_net_bind_service+ep
   ```

1. [Restart the Agent](https://docs.datadoghq.com/agent/configuration/agent-commands/#start-stop-and-restart-the-agent).

## Device namespaces{% #device-namespaces %}

As with [Network Device Monitoring](https://docs.datadoghq.com/network_monitoring/devices), use namespace tags to differentiate between multiple network devices that share the same private IP. For example, you could have two routers that share the same private IP: one in New York, and another in Paris. In this case, you can deploy an Agent in the New York data center that sends telemetry tagged with `namespace: nyc`; and a second Agent in the Paris data center that sends telemetry tagged with `namespace: paris`.

The namespace can then be used to uniquely pivot from an SNMP trap to the emitter device, or from the emitter device to an SNMP trap.

**Note**: If you are using namespace tags on any of your Agents, ensure that all of your Agents are using namespace tags. Do not configure namespace tags for only a subset of your Agents.

## Resolution{% #resolution %}

Each SNMP trap has a specific object identifier (OID) (A unique ID or address on a device that when polled returns the response code of that value.) based format. The Datadog Agent performs a *resolution* step to convert OIDs into more readable strings.

An SNMP trap consists of:

- Emitter information (for example, the IP of the device).
- An OID that defines the type of trap.
- Metadata: A list of pairs (`OID:value`) that provides additional context for the trap.

Decoding is performed on the Agent side, using a mapping stored on disk at `$<PATH_TO_AGENT_CONF.D>/snmp.d/traps_db/dd_traps_db.json.gz`. Datadog supports more than 11,000 different management information bases (MIBs).

### Mapping format{% #mapping-format %}

Mappings are stored as TrapsDB files, and can be YAML or JSON.

#### Examples{% #examples %}

{% tab title="YAML" %}

```yaml
mibs:
- NET-SNMP-EXAMPLES-MIB
traps:
  1.3.6.1.4.1.8072.2.3.0.1:
    mib: NET-SNMP-EXAMPLES-MIB
    name: netSnmpExampleHeartbeatNotification
vars:
  1.3.6.1.4.1.8072.2.3.2.1:
    name: netSnmpExampleHeartbeatRate
```

{% /tab %}

{% tab title="JSON" %}

```json
{
  "mibs": [
    "NET-SNMP-EXAMPLES-MIB"
  ],
  "traps": {
    "1.3.6.1.4.1.8072.2.3.0.1": {
      "mib": "NET-SNMP-EXAMPLES-MIB",
      "name": "netSnmpExampleHeartbeatNotification"
    }
  },
  "vars": {
    "1.3.6.1.4.1.8072.2.3.2.1": {
      "name": "netSnmpExampleHeartbeatRate"
    }
  }
}
```

{% /tab %}

### Extend the Agent{% #extend-the-agent %}

To extend the capabilities of the Agent, create your own mappings and place them in the `$<PATH_TO_AGENT_CONF.D>/snmp.d/traps_db/` directory.

You can write these mappings by hand, or generate mappings from a list of MIBs using Datadog's developer toolkit, [`ddev`](https://docs.datadoghq.com/extend/integrations/python).

#### Generate a TrapsDB file from a list of MIBs{% #generate-a-trapsdb-file-from-a-list-of-mibs %}

**Prerequisites**:

- Python 3
- [`ddev`](https://docs.datadoghq.com/extend/integrations/python) (`pip3 install ddev`)
- [`pysmi`](https://pypi.org/project/pysmi/) (`pip3 install pysmi`)

Place all your MIBs in a dedicated folder and run:

```shell
ddev meta snmp generate-traps-db -o ./output_dir/ /path/to/my/mib1 /path/to/my/mib2 /path/to/my/mib3 ...
```

The `ddev` tool automatically fetches available MIB dependencies. If you encounter missing dependency errors and have the MIB files locally, use the `--mib-sources <DIR>` parameter to specify the location of your local MIB files. Ensure filenames match the MIB name (for example, `SNMPv2-SMI`, not `snmp_v2_smi.txt`).

## Further Reading{% #further-reading %}

- [Monitor and diagnose network performance issues with SNMP traps](https://www.datadoghq.com/blog/diagnose-network-performance-with-snmp-trap-monitoring/)
- [NDM Troubleshooting](https://docs.datadoghq.com/network_monitoring/devices/troubleshooting)