devices

SNMP Monitoring for Linux Servers: Setup & Key OIDs

Monitor Linux servers with SNMP — net-snmp, the HOST-RESOURCES and UCD OIDs for CPU, RAM, disk, swap, load and processes, plus secure config and a test.

By the SNMP Monitoring team · Reviewed July 2026

Linux plus net-snmp is the canonical SNMP server case — the combination most tutorials assume, and the one where the standard MIBs give you almost everything you need without touching a vendor tree. A Linux box running snmpd exposes CPU, memory, disk, swap, load, uptime, and processes through HOST-RESOURCES-MIB and UCD-SNMP-MIB. This guide ties the install together with the specific OIDs to read, shows how to pull them with snmpwalk, and covers the alerting basics. For the deep install steps it links out rather than repeating them.

Parent: devices. Related: server monitoring, sensor index.

Install & secure the agent

The agent is net-snmp's snmpd, available in every distro's repositories. Rather than repeat the full procedure, the platform guides cover it: Ubuntu/Debian via apt, CentOS/RHEL via dnf. The essentials are the same everywhere — install the agent, edit snmpd.conf to set a random read-only community (or an SNMPv3 user) scoped to your manager, bind it to the management interface, and restart the service. Secure it before exposing it: a default snmpd.conf sometimes ships with an example community you must remove. Once it's running and locked down, you're ready to read metrics.

Key Linux OIDs

The metrics you'll actually poll, with their OIDs and the sensor page that explains each:

MetricOIDSensor
Uptime1.3.6.1.2.1.25.1.1.0uptime
CPU (per processor)1.3.6.1.2.1.25.3.3.1.2cpu
Storage (disk/RAM/swap)1.3.6.1.2.1.25.2.3.1.{3,5,6}disk
Load average1.3.6.1.4.1.2021.10.1.3load
Processes1.3.6.1.2.1.25.1.6.0processes
Logged-in users1.3.6.1.2.1.25.1.5.0sessions

The storage row uses three columns of the same table — allocation units (.3), size (.5), and used (.6) — which you combine to compute capacity and usage in bytes. Everything here is standard; no vendor MIB required.

HOST-RESOURCES vs UCD

Linux exposes overlapping data through two MIBs, and knowing which to use saves confusion:

  • HOST-RESOURCES-MIB (1.3.6.1.2.1.25) — the standard, portable set: hrStorage for disk/RAM/swap, hrProcessorLoad for CPU, hrSystemProcesses and uptime. Prefer this where it covers the metric, because it's vendor-neutral.
  • UCD-SNMP-MIB (1.3.6.1.4.1.2021) — net-snmp's own extensions: laLoad for the 1/5/15-minute load averages, plus memory and disk-check objects with a Linux-native flavour.

The practical rule: use HOST-RESOURCES for storage, CPU, and processes; reach into UCD for the load averages (laLoad), which it reports more naturally than the standard MIB. Both are present on a stock net-snmp install, so you don't choose one or the other at install time — you just poll whichever OID reports the metric you want most cleanly, mixing the two as needed.

Reading metrics with snmpwalk

Confirm the agent answers, then read the storage table — the most useful single walk on a server:

snmpwalk -v2c -c S3cr3tR0str1ng 10.0.0.20 hrStorageTable

HOST-RESOURCES-MIB::hrStorageDescr.1 = STRING: Physical memory
HOST-RESOURCES-MIB::hrStorageSize.1 = INTEGER: 4014928
HOST-RESOURCES-MIB::hrStorageUsed.1 = INTEGER: 2892104
HOST-RESOURCES-MIB::hrStorageDescr.31 = STRING: /
HOST-RESOURCES-MIB::hrStorageUsed.31 = INTEGER: 18446216

Each row is a storage area — RAM at index 1, the root filesystem at 31 — with size and used in allocation units. Multiply by hrStorageAllocationUnits for bytes, then usage percent is used ÷ size × 100. For load, read UCD's laLoad:

snmpget -v2c -c S3cr3tR0str1ng 10.0.0.20 1.3.6.1.4.1.2021.10.1.3.1

UCD-SNMP-MIB::laLoad.1 = STRING: 0.42

Alerting essentials

Once you're reading these, a handful of thresholds catch most real Linux problems:

  1. Disk usage — alert before a filesystem fills (e.g. 85% warning, 95% critical); a full / breaks things fast.
  2. Load average — alert when laLoad sustains above your core count for several minutes.
  3. Swap usage — rising swap often precedes memory exhaustion.
  4. Reachability — a device that stops answering sysUpTime is down or unreachable.

Set warning and critical levels, and alert on sustained breaches rather than single spikes to avoid noise. Server-wide context is on server monitoring and alerting.

External monitoring

On-box snmpd has the usual blind spot: if the server is in serious trouble, the agent reporting its health may be impaired too. An external poller reads the same HOST-RESOURCES metrics from outside, over an independent path, so you still get readings when the box is struggling. This is exactly the Linux metric set ostr.io reads externally over SNMPv2c — uptime, load, CPU, storage, processes, and interfaces — as an independent layer alongside your on-box monitoring. See external monitoring for how it fits.

Frequently asked questions

How do I monitor a Linux server with SNMP?

Install net-snmp's snmpd, secure snmpd.conf with a random read-only community or an SNMPv3 user scoped to your manager, and restart it. Then poll the standard OIDs — HOST-RESOURCES for CPU, storage, and processes, and UCD's laLoad for load averages. Test with snmpwalk -v2c -c <community> <host> hrStorageTable and set thresholds on disk and load.

Which MIB provides Linux server metrics?

Two: HOST-RESOURCES-MIB (1.3.6.1.2.1.25) for CPU, storage (disk/RAM/swap), processes, and uptime, and UCD-SNMP-MIB (1.3.6.1.4.1.2021) for net-snmp extensions like the laLoad load averages. HOST-RESOURCES is the portable standard; UCD adds Linux-native objects. Both come with a stock net-snmp install, so no extra MIBs are needed.

What OID is disk usage on Linux?

Disk (and RAM/swap) come from the hrStorage table under 1.3.6.1.2.1.25.2.3.1 — hrStorageSize (.5), hrStorageUsed (.6), and hrStorageAllocationUnits (.3). Multiply size/used by the allocation units for bytes, and compute usage percent as used ÷ size × 100. Each filesystem and memory area is a separate indexed row in the table.

How do I install the SNMP agent on Linux?

Install net-snmp from your distro's repositories — apt install snmpd on Ubuntu/Debian, or the net-snmp package via dnf on RHEL-family systems — then configure /etc/snmp/snmpd.conf and enable the service with systemd. The full step-by-step is on the Ubuntu/Debian and CentOS/RHEL setup guides.

Key takeaways

  • Linux + net-snmp is the canonical SNMP server case — standard MIBs cover nearly everything.
  • Metrics come from HOST-RESOURCES-MIB (…25) and UCD-SNMP-MIB (…2021).
  • Key OIDs: CPU …25.3.3.1.2, storage …25.2.3.1.{3,5,6}, uptime …25.1.1.0, load …2021.10.1.3.
  • Use HOST-RESOURCES for storage/CPU/processes, UCD laLoad for load averages.
  • Alert on disk, load, swap, and reachability with warning/critical thresholds.
  • An external poller like ostr.io reads this same set off-box — see external monitoring.

Monitor it from outside the network

SNMP only tells you a box is healthy while something is still asking. ostr.io polls your endpoints externally and fires email + SMS alerts the moment a reading crosses your line — or the agent goes silent.

Monitor with ostr.io Why monitor externally