Install and configure SNMP for EDR Telemetry Store

Simple Network Management Protocol (SNMP) monitoring allows you to track the health and status of EDR Telemetry Store virtual appliances. SNMP is not enabled by default.

You can install the SNMP service using bundled packages for offline environments or via standard repositories if the appliance has internet access. When installed, configure the service for SNMP v2c or SNMP v3 to enable monitoring.

Install the SNMP service

To perform the installation, you must first access the system shell.

Log in to the appliance as admin.
Type enable and enter the password.
Type shell.
Run the command corresponding to your environment type:
- Offline or Air-gapped installation: Install the bundled packages located in /opt/trellix/optional_packages/snmp/.
```
dnf --disablerepo='*' install /opt/trellix/optional_packages/snmp/*.rpm
```
- Online installation: If the appliance has internet access or can connect to the AlmaLinux package repositories, use the standard package manager.
```
dnf install net-snmp net-snmp-utils
```

Configure the SNMP service

Configure the SNMP service based on your specific monitoring requirements (SNMP v2c or SNMP v3). The actual configuration is specific to each environment.

Prerequisite

Create a backup of the existing configuration file before making changes.

cp /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.backup

Configure SNMP v2c

Edit the snmpd configuration file.
```
vi /etc/snmp/snmpd.conf
```

Replace the content of /etc/snmp/snmpd.conf with the following example configuration:

Note
The community strings below (idv90we3rnov90wer and 209ijvfwer0df92jd) are examples. Replace them with secure strings specific to your environment.

# Map 'idv90we3rnov90wer' community to the 'ConfigUser'
# Map '209ijvfwer0df92jd' community to the 'AllUser'
# sec.name source community
com2sec ConfigUser default idv90we3rnov90wer
com2sec AllUser default 209ijvfwer0df92jd

# Map 'ConfigUser' to 'ConfigGroup' for SNMP Version 2c
# Map 'AllUser' to 'AllGroup' for SNMP Version 2c
# sec.model sec.name
group ConfigGroup v2c ConfigUser
group AllGroup v2c AllUser

# Define 'SystemView', which includes everything under .1.3.6.1.2.1.1 (or .1.3.6.1.2.1.25.1)
# Define 'AllView', which includes everything under .1
# incl/excl subtree
view SystemView included .1.3.6.1.2.1.1
view SystemView included .1.3.6.1.2.1.25.1.1
view AllView included .1

# Give 'ConfigGroup' read access to objects in the view 'SystemView'
# Give 'AllGroup' read access to objects in the view 'AllView'
# context model level prefix read write notify
access ConfigGroup "" any noauth exact SystemView none none
access AllGroup "" any noauth exact AllView none none
dontLogTCPWrappersConnects yes

Start and enable the SNMP service.

systemctl start snmpd
systemctl enable snmpd

Open the firewall to allow UDP traffic on port 161.

firewall-cmd --add-port=161/udp --permanent
firewall-cmd --reload

Run the snmpwalk command locally on the appliance to verify that metrics are accessible.

General verification

# Show monitoring information for Config User
snmpwalk -v 2c -c idv90we3rnov90wer -O e 127.0.0.1

# Show monitoring information for All User
snmpwalk -v 2c -c 209ijvfwer0df92jd -O e 127.0.0.1

View specific metrics

Run the following commands to view specific system statistics (CPU, Memory, and System Load).

CPU Statistics

snmpwalk -v2c -c 209ijvfwer0df92jd 127.0.0.1 .1.3.6.1.4.1.2021.11

Memory Statistics

snmpwalk -v2c -c 209ijvfwer0df92jd 127.0.0.1 .1.3.6.1.4.1.2021.4

System Load Average

snmpwalk -v2c -c 209ijvfwer0df92jd 127.0.0.1 .1.3.6.1.4.1.2021.10

Configure SNMP v3

Stop the SNMP service if it is running.
```
systemctl stop snmpd
```

Create the SNMP v3 users.

Note
Replace AUTHENTICATION_PASSWORD, ENCRYPTION_PASSWORD, ADMIN_AUTHENTICATION_PASSWORD, and ADMIN_ENCRYPTION_PASSWORD in the commands below with strong passwords or passphrases.

net-snmp-create-v3-user -ro -A "AUTHENTICATION_PASSWORD" -X "ENCRYPTION_PASSWORD" -a SHA -x AES SnmpRoUser
net-snmp-create-v3-user -ro -A "ADMIN_AUTHENTICATION_PASSWORD" -X "ADMIN_ENCRYPTION_PASSWORD" -a SHA -x AES SnmpRoAdmin

Edit the snmpd configuration file.
```
vi /etc/snmp/snmpd.conf
```

Replace the content of /etc/snmp/snmpd.conf with the following configuration:

rouser SnmpRoUser priv .1.3.6.1.2.1.1
rouser SnmpRoUser priv .1.3.6.1.2.1.25.1.1
rouser SnmpRoAdmin priv .1
dontLogTCPWrappersConnects yes

Restart and enable the SNMP service.

systemctl restart snmpd
systemctl enable snmpd

Open the firewall to allow UDP traffic on port 161.

firewall-cmd --add-port=161/udp --permanent
firewall-cmd --reload

Use snmpwalk to verify user access.

# Test SnmpRoUser (limited view)
snmpwalk -v3 -l authPriv -u SnmpRoUser -a SHA -A "AUTHENTICATION_PASSWORD" -x AES -X "ENCRYPTION_PASSWORD" 127.0.0.1 .1.3.6.1.2.1.1

# Test SnmpRoAdmin (full view)
snmpwalk -v3 -l authPriv -u SnmpRoAdmin -a SHA -A "ADMIN_AUTHENTICATION_PASSWORD" -x AES -X "ADMIN_ENCRYPTION_PASSWORD" 127.0.0.1 .1.3.6.1.4.1.2021.11