Hello,
I have been looking for a guide that deploys Netobserve Flow and SNMP to monitor firewall in a docker compose environment, I would appreciate if someone provides detailed steps/guide to achieve this.
Thanks,
Ansh Joshi
The Docker deployment for NetObserv Flow is in this document link:
The Docker deployment guide for NetObserve SNMP is at this link:
You will also need a data store .. Elasticsearch, OpenSearch and associated dashboards.
Let us know if these are helpful or if you have any further specific questions.
Regards,
Dexter Turner
Hello dexter,
I am just trying to find a docker-compose.yml file that has both NetObserve Flow and SNMP. The one I have deployed has some issues. I am attaching the Docker-compose.yml which I used for my deployment. Secondly i have no issue seeing flow data but I cannot see SNMP working/ Simply the data isn’t reflecting on the dashboard. I have configured my firewall for v2 snmp using default community string.
docker-compose.yml:
version: ‘3’
services:
es_master1:
image: docker.elastic.co/elasticsearch/elasticsearch:8.17.0
restart: unless-stopped
hostname: es_master1
network_mode: host
environment:
- ES_JAVA_OPTS=-Xms2g -Xmx2g
- cluster.name=elastiflow
- node.name=es_master1
- discovery.type=single-node
- bootstrap.memory_lock=true
- http.port=9200
- xpack.security.enabled=false
ulimits:
memlock:
soft: -1
hard: -1
nofile:
soft: 131072
hard: 131072
volumes:
- /var/lib/elasticsearch:/usr/share/elasticsearch/data
kibana:
image: docker.elastic.co/kibana/kibana:8.17.0
restart: unless-stopped
network_mode: host
environment:
- SERVER_HOST=0.0.0.0
- SERVER_PORT=5601
- ELASTICSEARCH_HOSTS=http://127.0.0.1:9200
- XPACK_ENCRYPTEDSAVEDOBJECTS_ENCRYPTIONKEY=ElastiFlow_0123456789_0123456789_0123456789
flow-collector:
image: elastiflow/flow-collector:7.20.0
container_name: flow-collector
restart: unless-stopped
network_mode: host
volumes:
- /etc/elastiflow:/etc/elastiflow
- ./inventory.yml:/etc/elastiflow/inventory.yml:ro
environment:
# === LICENSE (REQUIRED) ===
- EF_LICENSE_ACCEPTED=true
- EF_ACCOUNT_ID=
- EF_LICENSE_KEY=
# === OUTPUT (Elasticsearch) ===
- EF_OUTPUT_ELASTICSEARCH_ENABLE=true
- EF_OUTPUT_ELASTICSEARCH_ADDRESSES=127.0.0.1:9200
- EF_OUTPUT_ELASTICSEARCH_ECS_ENABLE=true
- EF_OUTPUT_ELASTICSEARCH_INDEX_PERIOD=rollover
# If using username/password, uncomment below:
# - EF_OUTPUT_ELASTICSEARCH_USERNAME=elastic
# - EF_OUTPUT_ELASTICSEARCH_PASSWORD=changeme
# === INPUT: FLOW (NetFlow/IPFIX) ===
- EF_FLOW_SERVER_UDP_PORT=9995
# === INPUT: SNMP POLLING (The Interface Stats) ===
# This enables the collector to ask the router for CPU/RAM/Bandwidth stats
- EF_INPUT_SNMP_POLLER_ENABLE=true
- EF_INPUT_SNMP_POLLER_INVENTORY_PATH=/etc/elastiflow/inventory.yml
- EF_INPUT_SNMP_POLLER_PERIOD=60
# === ENRICHMENT (The "Magic" Link) ===
# This allows Flow records to show "GigabitEthernet1" instead of "Index 3"
- EF_PROCESSOR_ENRICH_NETIF_SNMP_ENABLE=true
- EF_PROCESSOR_ENRICH_NETIF_SNMP_INVENTORY_PATH=/etc/elastiflow/inventory.yml
- EF_PROCESSOR_ENRICH_NETIF_SNMP_REFRESH_RATE=3600
Thanks,
Ansh Joshi
Ansh,
SNMP polling for metrics is a separate image. The SNMP polling done by flow-collector is just for enrichment.
See the NetObserv SNMP document linked above. The image is shown as:
# ElastiFlow NetObserv SNMP
snmp-collector:
image: elastiflow/snmp-collector:7.21.0
container_name: snmp-collector
In addition, you will need to download and import the SNMP dashboards if you have not already.
Let me know if that helps.
Regards,
Dexter
Hello dexter,
This is the latest progress, I have attached the docker-compose.yml file which has snmp collector image. I can successfully see flow data but I still cannot see snmp data in dashboard.
I have added devices file in this path: elastiflow/snmp/devices/fortigate.yml
my-fortigate:
ip: 192.168.x.x
version: 2c
communities:
- public
device_groups:
- fortinet_fortigate
SNMP:
docker-compose.yml:
version: ‘3.3’
services:
elasticsearch:
image: docker.elastic.co/elasticsearch/elasticsearch:8.17.0
container_name: elastiflow-es
restart: unless-stopped
environment:
- discovery.type=single-node
- xpack.security.enabled=false
- bootstrap.memory_lock=true
- “ES_JAVA_OPTS=-Xms2g -Xmx2g”
ulimits:
memlock:
soft: -1
hard: -1
ports:
- “9200:9200” # REQUIRED for collectors to reach ES
volumes:
- ./es_data:/usr/share/elasticsearch/data
kibana:
image: docker.elastic.co/kibana/kibana:8.17.0
container_name: elastiflow-kibana
restart: unless-stopped
depends_on:
- elasticsearch
ports:
- “5601:5601”
environment:
- ELASTICSEARCH_HOSTS=http://elasticsearch:9200
- SERVER_MAXPAYLOADBYTES=8388608 # FIX: Allows GUI import of large dashboard files
flow-collector:
image: elastiflow/flow-collector:7.21.0
container_name: flow-collector
restart: unless-stopped
network_mode: host # REQUIRED for NetFlow processing
environment:
- EF_OUTPUT_ELASTICSEARCH_ENABLE=true
- EF_OUTPUT_ELASTICSEARCH_ADDRESSES=127.0.0.1:9200
- EF_OUTPUT_ELASTICSEARCH_ECS_ENABLE=true
# FIX: Forces data to appear in “Last 15 mins” regardless of device clock
- EF_OUTPUT_ELASTICSEARCH_TIMESTAMP_SOURCE=collect
- EF_LICENSE_ACCEPTED=true
- EF_ACCOUNT_ID=698d6
- EF_LICENSE_KEY=Key
snmp-collector:
image: elastiflow/snmp-collector:7.21.0
container_name: snmp-collector
restart: unless-stopped
network_mode: host
volumes:
- ./snmp/devices:/etc/elastiflow/snmp/devices:ro
environment:
- EF_OUTPUT_ELASTICSEARCH_ENABLE=true
- EF_OUTPUT_ELASTICSEARCH_ADDRESSES=127.0.0.1:9200
- EF_OUTPUT_ELASTICSEARCH_ECS_ENABLE=true
- EF_LICENSE_ACCEPTED=true
- EF_ACCOUNT_ID=698d6
- EF_LICENSE_KEY=Key
Can you validate this docker-compose.yml file and is there any other configuration needed for snmp?
It may be the result of copying/pasting, but be sure your fortigate.yml is formatted/indented properly:
my-fortigate:
ip: 192.168.x.x
version: 2c
communities:
- public
device_groups:
- fortinet_fortigate
Also, what does docker logs snmp-collector report? You can use docker logs tail -50 snmp-collector or similiar to get the most recent log messages, but it would be good to see what happens when the container starts so you could do:
docker restart snmp-collector
docker logs -f –-since 1s snmp-collector
Regards,
Dexter Turner
Hello Dexter,
The fortigate.yml has proper identation earlier it was due to copy paste.
These are the logs for snmp-collector when restarted.
root@ii-test:/home/ii-test/elastiflow# docker logs --tail 50 snmp-collector{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_KAFKA_TLS_CERT_FILEPATH=”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_KAFKA_TLS_KEY_FILEPATH=”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_KAFKA_TLS_KEY_PASSPHRASE=”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_KAFKA_TLS_SKIP_VERIFICATION=false”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_KAFKA_PRODUCER_MAX_MESSAGE_BYTES=1048576”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_KAFKA_PRODUCER_REQUIRED_ACKS=1”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_KAFKA_PRODUCER_TIMEOUT=10ns”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_KAFKA_PRODUCER_COMPRESSION=3”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_KAFKA_PRODUCER_COMPRESSION_LEVEL=-1000”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_KAFKA_PRODUCER_FLUSH_BYTES=1048576”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_KAFKA_PRODUCER_FLUSH_MESSAGES=1024”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_KAFKA_PRODUCER_FLUSH_FREQUENCY=2µs”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_KAFKA_PRODUCER_FLUSH_MAX_MESSAGES=0”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_KAFKA_PRODUCER_RETRY_MAX=3”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_KAFKA_PRODUCER_RETRY_BACKOFF=100ns”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_KAFKA_ECS_ENABLE=false”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_KAFKA_TIMESTAMP_SOURCE=collect”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_STDOUT_ENABLE=false”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_STDOUT_FORMAT=json_pretty”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_STDOUT_ALLOWED_RECORD_TYPES=as_path_hop,flow_option,flow,ifa_hop,telemetry,metric,log”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_TYPE=grpc”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_ADDR_HOST=0.0.0.0”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_ADDR_PORT=4317”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_BUFFER=128”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_COMPRESSOR=none”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_ENABLE=false”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_FAILURE_INIT_INTERVAL=1s”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_FAILURE_MAX_ELAPSED_TIME=1h”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_FAILURE_MAX_RETRY_INTERVAL=5s”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_HEADERS=”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_HTTP_ENDPOINT=/v1/traces”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_BATCH_TIMEOUT=5s”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_TLS_CERT_FILE=”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_TLS_ENABLE=false”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_TLS_KEY_FILE=”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_TLS_VERIFICATION_TYPE=NoClientCert”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_WORKERS=3”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_HEALTH_SERVER_TLS_ENABLE=false”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_HEALTH_SERVER_TLS_CERT_FILE=”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_HEALTH_SERVER_TLS_KEY_FILE=”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_HEALTH_SERVER_TLS_VERIFICATION_TYPE=NoClientCert”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_HEALTH_SERVER_ADDR_PORT=9412”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_HEALTH_SERVER_ADDR_HOST=0.0.0.0”}{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.httpserver”,“caller”:“httpserver/httpserver.go:31”,“msg”:“endpoint exposed”,“url”:“``http://0.0.0.0:8080/metrics”``}{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.httpserver”,“caller”:“httpserver/httpserver.go:31”,“msg”:“endpoint exposed”,“url”:“``http://0.0.0.0:8080/readyz”``}{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.httpserver”,“caller”:“httpserver/httpserver.go:31”,“msg”:“endpoint exposed”,“url”:“``http://0.0.0.0:8080/livez”``}{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.httpserver”,“caller”:“httpserver/httpserver.go:31”,“msg”:“endpoint exposed”,“url”:“``http://0.0.0.0:8080/api/v1/snmp/apply-definitions”``}{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.httpserver”,“caller”:“httpserver/httpserver.go:31”,“msg”:“endpoint exposed”,“url”:“``http://0.0.0.0:8080/api/v1/snmp/rediscover-device”``}{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.httpserver”,“caller”:“httpserver/httpserver.go:31”,“msg”:“endpoint exposed”,“url”:“``http://0.0.0.0:8080/support-bundle”``}{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.license”,“caller”:“lic/license.go:157”,“msg”:“license information”,“expiration”:“2027-02-12T00:00:00.000Z”,“level”:2,“flow_records_per_second”:4000,“telemetry_hosts”:25,“telemetry_objects”:0}
{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_FAILURE_MAX_ELAPSED_TIME=1h”}
{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_FAILURE_MAX_RETRY_INTERVAL=5s”}
{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_HEADERS=”}
{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_HTTP_ENDPOINT=/v1/traces”}
{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_BATCH_TIMEOUT=5s”}
{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_TLS_CERT_FILE=”}
{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_TLS_ENABLE=false”}
{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_TLS_KEY_FILE=”}
{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_TLS_VERIFICATION_TYPE=NoClientCert”}
{“level”:“info”,“ts”:“2026-02-19T05:33:50.237Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_WORKERS=3”}
{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_HEALTH_SERVER_TLS_ENABLE=false”}
{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_HEALTH_SERVER_TLS_CERT_FILE=”}
{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_HEALTH_SERVER_TLS_KEY_FILE=”}
{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_HEALTH_SERVER_TLS_VERIFICATION_TYPE=NoClientCert”}
{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_HEALTH_SERVER_ADDR_PORT=9412”}
{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_HEALTH_SERVER_ADDR_HOST=0.0.0.0”}
{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.httpserver”,“caller”:“httpserver/httpserver.go:31”,“msg”:“endpoint exposed”,“url”:“``http://0.0.0.0:8080/metrics”``}
{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.httpserver”,“caller”:“httpserver/httpserver.go:31”,“msg”:“endpoint exposed”,“url”:“``http://0.0.0.0:8080/readyz”``}
{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.httpserver”,“caller”:“httpserver/httpserver.go:31”,“msg”:“endpoint exposed”,“url”:“``http://0.0.0.0:8080/livez”``}
{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.httpserver”,“caller”:“httpserver/httpserver.go:31”,“msg”:“endpoint exposed”,“url”:“``http://0.0.0.0:8080/api/v1/snmp/apply-definitions”``}
{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.httpserver”,“caller”:“httpserver/httpserver.go:31”,“msg”:“endpoint exposed”,“url”:“``http://0.0.0.0:8080/api/v1/snmp/rediscover-device”``}
{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.httpserver”,“caller”:“httpserver/httpserver.go:31”,“msg”:“endpoint exposed”,“url”:“``http://0.0.0.0:8080/support-bundle”``}
{“level”:“info”,“ts”:“2026-02-19T05:33:50.238Z”,“logger”:“snmpcoll.license”,“caller”:“lic/license.go:157”,“msg”:“license information”,“expiration”:“2027-02-12T00:00:00.000Z”,“level”:2,“flow_records_per_second”:4000,“telemetry_hosts”:25,“telemetry_objects”:0}
{“level”:“info”,“ts”:“2026-02-19T05:33:56.819Z”,“logger”:“snmpcoll”,“caller”:“snmp/instance_registration.go:43”,“msg”:“instance created”}
{“level”:“info”,“ts”:“2026-02-19T05:33:56.819Z”,“caller”:“snmpdata/conf.go:88”,“msg”:"Field to Drop: "}
{“level”:“info”,“ts”:“2026-02-19T05:33:56.819Z”,“logger”:“snmpcoll.snmp.controller.scheduler”,“caller”:“scheduler/scheduler.go:76”,“msg”:“running”}
{“level”:“info”,“ts”:“2026-02-19T05:33:56.819Z”,“logger”:“snmpcoll.snmp.controller.opmanager”,“caller”:“opmanager/opmanager.go:92”,“msg”:“running”}
{“level”:“info”,“ts”:“2026-02-19T05:33:56.868Z”,“caller”:“cached/snmpenum.go:182”,“msg”:“SNMP bitmap enumerations loaded successfully: 1115 total Bitmap enumerated sets”}
{“level”:“info”,“ts”:“2026-02-19T05:33:57.315Z”,“caller”:“cached/snmpenum.go:219”,“msg”:“SNMP Integer enumerations loaded successfully: 10114 total Integer enumerated sets”}
{“level”:“info”,“ts”:“2026-02-19T05:33:57.411Z”,“caller”:“cached/snmpenum.go:256”,“msg”:“SNMP OID enumerations loaded successfully: 22821 total OIDs”}
{“level”:“info”,“ts”:“2026-02-19T05:33:57.419Z”,“logger”:“ipaddr_enricher.hostname_enricher”,“caller”:“hostname/hostname.go:73”,“msg”:“started”}
{“level”:“info”,“ts”:“2026-02-19T05:33:57.419Z”,“logger”:“ipaddr_enricher.netintel_threats”,“caller”:“netintel/enricher.go:123”,“msg”:“netintel not enabled”}
{“level”:“info”,“ts”:“2026-02-19T05:33:57.438Z”,“logger”:“ipaddr_enricher.memstore”,“caller”:“enrichipaddr/memstore.go:39”,“msg”:“listening for ips to delete”}
{“level”:“info”,“ts”:“2026-02-19T05:33:57.439Z”,“logger”:“ipaddr_enricher.memstore”,“caller”:“enrichipaddr/memstore.go:50”,“msg”:“store listening for entries to store”}
{“level”:“info”,“ts”:“2026-02-19T05:33:57.467Z”,“logger”:“ipaddr_enricher.custodian”,“caller”:“enrichipaddr/custodian.go:63”,“msg”:“listening for entries to store”}
{“level”:“info”,“ts”:“2026-02-19T05:33:57.468Z”,“logger”:“ipaddr_enricher.custodian”,“caller”:“enrichipaddr/custodian.go:73”,“msg”:“expiration checker is running”}
{“level”:“info”,“ts”:“2026-02-19T05:33:57.468Z”,“logger”:“ipaddr_enricher.custodian”,“caller”:“enrichipaddr/custodian.go:52”,“msg”:“listening for ips to delete”}
{“level”:“info”,“ts”:“2026-02-19T05:33:57.485Z”,“logger”:“netif_enricher”,“caller”:“enrichnetif/memstore.go:41”,“msg”:“in-memory store listening for IPs to delete”}
{“level”:“info”,“ts”:“2026-02-19T05:33:57.485Z”,“logger”:“netif_enricher”,“caller”:“enrichnetif/memstore.go:52”,“msg”:“in-memory store listening for entries to store”}
{“level”:“info”,“ts”:“2026-02-19T05:33:57.506Z”,“logger”:“netif_enricher.custodian”,“caller”:“enrichnetif/custodian.go:66”,“msg”:“listening for entries to store”}
{“level”:“info”,“ts”:“2026-02-19T05:33:57.506Z”,“logger”:“netif_enricher.custodian”,“caller”:“enrichnetif/custodian.go:76”,“msg”:“expiration checker is running”}
{“level”:“info”,“ts”:“2026-02-19T05:33:57.507Z”,“logger”:“snmpcoll.processor”,“caller”:“snmpprocessor/snmp.go:48”,“msg”:“snmp record processor is running”}
{“level”:“info”,“ts”:“2026-02-19T05:33:57.506Z”,“logger”:“netif_enricher.custodian”,“caller”:“enrichnetif/custodian.go:55”,“msg”:“listening for IPs to delete”}
{“level”:“info”,“ts”:“2026-02-19T05:33:57.507Z”,“logger”:“snmpcoll.processor”,“caller”:“snmpprocessor/snmp.go:48”,“msg”:“snmp record processor is running”}
{“level”:“info”,“ts”:“2026-02-19T05:33:57.507Z”,“logger”:“snmpcoll.processor”,“caller”:“snmpprocessor/snmp.go:48”,“msg”:“snmp record processor is running”}
{“level”:“info”,“ts”:“2026-02-19T05:33:57.507Z”,“logger”:“snmpcoll.processor”,“caller”:“snmpprocessor/snmp.go:48”,“msg”:“snmp record processor is running”}
{“level”:“info”,“ts”:“2026-02-19T05:33:57.507Z”,“logger”:“snmpcoll.processor”,“caller”:“snmpprocessor/snmp.go:48”,“msg”:“snmp record processor is running”}
{“level”:“info”,“ts”:“2026-02-19T05:33:57.507Z”,“logger”:“snmpcoll.processor”,“caller”:“snmpprocessor/snmp.go:48”,“msg”:“snmp record processor is running”}
{“level”:“info”,“ts”:“2026-02-19T05:33:57.507Z”,“logger”:“snmpcoll.processor”,“caller”:“snmpprocessor/snmp.go:48”,“msg”:“snmp record processor is running”}
{“level”:“info”,“ts”:“2026-02-19T05:33:57.507Z”,“logger”:“snmpcoll.processor”,“caller”:“snmpprocessor/snmp.go:48”,“msg”:“snmp record processor is running”}
And please let me know if you need anything else.
Thanks,
Ansh
I really can’t be sure from the portion of the log you shared, but I do not see any indication that there is any polling happening. My best guess is that it’s not finding your ‘fortigate.yml’ file. You say you have added the device file at “elastiflow/snmp/devices/fortigate.yml” but your docker-compose.yml shows the volume as:
`volumes:
- ./snmp/devices:/etc/elastiflow/snmp/devices:ro`
In our sample docker-compose.yml we show the volume entry as:
volumes:
- /etc/elastiflow:/etc/elastiflow
Let us know if you make any progress.
Thanks,
Dexter
I updated the docker-compose.yml with snmp collector having volume pointed to this
volumes:
- /etc/elastiflow:/etc/elastiflow
below are the logs, I am not sure where the issue lies.
root@ii-test:/home/ii-test/elastiflow# docker logs --tail 50 snmp-collector
{“level”:“info”,“ts”:“2026-03-09T05:15:26.581Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_ADDR_PORT=4317”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.581Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_BUFFER=128”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.581Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_COMPRESSOR=none”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.581Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_ENABLE=false”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.581Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_FAILURE_INIT_INTERVAL=1s”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.581Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_FAILURE_MAX_ELAPSED_TIME=1h”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.581Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_FAILURE_MAX_RETRY_INTERVAL=5s”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.581Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_HEADERS=
”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.581Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_HTTP_ENDPOINT=/v1/traces”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.581Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_BATCH_TIMEOUT=5s”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.581Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_TLS_CERT_FILE=”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.581Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_TLS_ENABLE=false”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.581Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_TLS_KEY_FILE=”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.581Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_SERVER_TLS_VERIFICATION_TYPE=NoClientCert”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.581Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_TRACE_WORKERS=3”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.581Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_HEALTH_SERVER_TLS_ENABLE=false”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.581Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_HEALTH_SERVER_TLS_CERT_FILE=”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.581Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_HEALTH_SERVER_TLS_KEY_FILE=”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.581Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_HEALTH_SERVER_TLS_VERIFICATION_TYPE=NoClientCert”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.581Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_HEALTH_SERVER_ADDR_PORT=9412”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.581Z”,“logger”:“snmpcoll.config[default]”,“caller”:“snmpcoll/app.go:63”,“msg”:“EF_OUTPUT_OTLP_HEALTH_SERVER_ADDR_HOST=0.0.0.0”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.582Z”,“logger”:“snmpcoll.license”,“caller”:“lic/license.go:157”,“msg”:“license information”,“expiration”:“2027-02-12T00:00:00.000Z”,“level”:2,“flow_records_per_second”:4000,“telemetry_hosts”:25,“telemetry_objects”:0}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.582Z”,“logger”:“snmpcoll.httpserver”,“caller”:“httpserver/httpserver.go:31”,“msg”:“endpoint exposed”,“url”:“http://0.0.0.0:8080/livez”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.582Z”,“logger”:“snmpcoll.httpserver”,“caller”:“httpserver/httpserver.go:31”,“msg”:“endpoint exposed”,“url”:“http://0.0.0.0:8080/api/v1/snmp/apply-definitions”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.582Z”,“logger”:“snmpcoll.httpserver”,“caller”:“httpserver/httpserver.go:31”,“msg”:“endpoint exposed”,“url”:“http://0.0.0.0:8080/api/v1/snmp/rediscover-device”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.582Z”,“logger”:“snmpcoll.httpserver”,“caller”:“httpserver/httpserver.go:31”,“msg”:“endpoint exposed”,“url”:“http://0.0.0.0:8080/support-bundle”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.582Z”,“logger”:“snmpcoll.httpserver”,“caller”:“httpserver/httpserver.go:31”,“msg”:“endpoint exposed”,“url”:“http://0.0.0.0:8080/metrics”}
{“level”:“info”,“ts”:“2026-03-09T05:15:26.582Z”,“logger”:“snmpcoll.httpserver”,“caller”:“httpserver/httpserver.go:31”,“msg”:“endpoint exposed”,“url”:“http://0.0.0.0:8080/readyz”}
{“level”:“panic”,“ts”:“2026-03-09T05:15:26.584Z”,“logger”:“snmpcoll”,“caller”:“snmp/instance_registration.go:40”,“msg”:“failed to initialize snmp input”,“error”:“failed reading definitions: failed to read and validate devices: failed to walk directory: error while walking directory ‘/etc/elastiflow/snmp/devices’ - lstat /etc/elastiflow/snmp/devices: no such file or directory”,“stacktrace”:“github.com/elastiflow/flowcoll/pkg/inputs/snmp.Build\n\t/app/pkg/inputs/snmp/instance_registration.go:40\ngithub.com/elastiflow/flowcoll/pkg/apps/appbuilder.(*Builder).buildModule\n\t/app/pkg/apps/appbuilder/builder.go:285\ngithub.com/elastiflow/flowcoll/pkg/apps/appbuilder.(*Builder).Run.func1\n\t/app/pkg/apps/appbuilder/builder.go:208\ngithub.com/elastiflow/flowcoll/pkg/apps/appbuilder.(*Builder).Run\n\t/app/pkg/apps/appbuilder/builder.go:227\ngithub.com/elastiflow/flowcoll/pkg/apps/snmpcoll.(*App).Run.func1\n\t/app/pkg/apps/snmpcoll/app.go:144”}
panic: failed to initialize snmp input
goroutine 167 [running]:
go.uber.org/zap/zapcore.CheckWriteAction.OnWrite(0x1?, 0x1e?, {0x0?, 0x0?, 0xc00197ef40?})
/go/pkg/mod/go.uber.org/zap@v1.27.0/zapcore/entry.go:196 +0x54
go.uber.org/zap/zapcore.(*CheckedEntry).Write(0xc001458340, {0xc001d75340, 0x1, 0x1})
/go/pkg/mod/go.uber.org/zap@v1.27.0/zapcore/entry.go:262 +0x22a
go.uber.org/zap.(*Logger).Panic(0xc00199fa00?, {0x2af87d9?, 0x0?}, {0xc001d75340, 0x1, 0x1})
/go/pkg/mod/go.uber.org/zap@v1.27.0/logger.go:285 +0x4b
github.com/elastiflow/flowcoll/pkg/inputs/snmp.Build({0x1, 0x10, {0x25cb74b, 0x1d}, {0x2611f63, 0x1c}, {0x263eb08, 0x22}, {0x263ec0b, 0x22}, …}, …)
/app/pkg/inputs/snmp/instance_registration.go:40 +0x225
github.com/elastiflow/flowcoll/pkg/apps/appbuilder.(*Builder).buildModule(0xc001cc7000, {0x27693a6, 0x4}, {0x277def2, 0x7}, 0xc0011c2a08)
/app/pkg/apps/appbuilder/builder.go:285 +0x45e
github.com/elastiflow/flowcoll/pkg/apps/appbuilder.(*Builder).Run.func1({0x277def2, 0x7}, {0x0, 0x0}, 0xc0011c2a08)
/app/pkg/apps/appbuilder/builder.go:208 +0x11c
github.com/elastiflow/flowcoll/pkg/apps/appbuilder.(*Builder).Run(0xc001cc7000, {0x3393ad0, 0xc0019616d0})
/app/pkg/apps/appbuilder/builder.go:227 +0x2d5
Thanks,
Ansh Joshi
Ansh,
The specific error causing the panic is:
{“level”:“panic”,“ts”:“2026-03-09T05:15:26.584Z”,“logger”:“snmpcoll”,“caller”:“snmp/instance_registration.go:40”,“msg”:“failed to initialize snmp input”,“error”:“failed reading definitions: failed to read and validate devices: failed to walk directory: error while walking directory ‘/etc/elastiflow/snmp/devices’ - lstat /etc/elastiflow/snmp/devices: no such file or directory”,“stacktrace”
It can’t find that directory. Do you have an /etc/elastiflow directory on the host file system? Basically the volume statement:
volumes:
- /etc/elastiflow:/etc/elastiflow
Is say “look in /etc/elastiflow on the host to find the files the application is expected to see in /etc/elastiflow in the container” … the first entry is for the “host” location:the second entry is for the “container” location.
Anything in your SNMP collector config that references a path or file must exist either on the host, and map it with a volumes statement to the container, or they must exist and be edited in the container. Most people put their configuration files on the host to make them more manageable.
Here are the default files/locations for the SNMP collector:
#EF_INPUT_SNMP_DEFAULTS_DIRECTORY_PATH: /etc/elastiflow/snmp/defaults
#EF_INPUT_SNMP_DEVICE_DEFINITIONS_DIRECTORY_PATH: /etc/elastiflow/snmp/devices
#EF_INPUT_SNMP_DEVICE_GROUP_DEFINITIONS_DIRECTORY_PATH: /etc/elastiflow/snmp/device_groups
#EF_INPUT_SNMP_OBJECT_DEFINITIONS_DIRECTORY_PATH: /etc/elastiflow/snmp/objects
#EF_INPUT_SNMP_OBJECT_GROUP_DEFINITIONS_DIRECTORY_PATH: /etc/elastiflow/snmp/object_groups
#EF_INPUT_SNMP_PERSIST_DIRECTORY_PATH: /usr/share/elastiflow/snmpcoll
I would be sure all of these exist on the host and that the user running the container has permission to access them.
Let us know if this helps.
Dexter
Hi Dexter,
I seemed to tackle the problem, It seems like I need higher license than free for snmp to work.
Can you give me a rough idea about the license cost for 30 firewalls snmp monitoring in elastiflow?
"error":"failed reading definitions: vendor-specific object \"FORTINET-CORE-MIB::fnSystem\" is only accessible with a Standard license level or higher"
Thanks and regards,
Ansh Joshi
Hi Ansh,
I don’t have any pricing, but I did notify our sales group of your question so you should be hearing from them. Let me know if you don’t.
Thanks,
Dexter