Network Devices¶

Network device monitoring provides a centralized view of the basic information, online status, interface status, and performance metrics of SNMP-enabled network devices such as routers and switches. It helps you understand the health of your network infrastructure and quickly locate problems when a device or interface is abnormal.

Data Source¶

Under the standard onboarding approach, devices are not manually created in the TrueWatch console. Device data is primarily collected from network devices via the SNMP protocol by DataKit deployed in your network environment, and then reported to the current Workspace.

The simplified data flow is as follows:

Using the MIB/OID exposed by a device, DataKit obtains the device name, IP address, type, vendor, uptime, interfaces, as well as CPU, memory, network traffic, dropped packets, and error packets. The basic device information is used to generate and update the device list, while the time-series metrics are used to display performance charts and operational status.

Different vendors and models expose different MIB/OID, so the actual fields and metrics displayed may vary. If the built-in Profile does not cover the device model or vendor-specific metrics, you can add a custom Profile based on the vendor's MIB/OID documentation.

For detailed configuration, see SNMP Collector.

Prerequisites¶

Before onboarding, confirm the following:

1. You have installed DataKit on a Host or in a Kubernetes environment that can access the network devices;
2. SNMP has been enabled on the target devices. DataKit supports SNMP v1, v2c, and v3; v3 is recommended when high security is required;

3. You have prepared the corresponding SNMP authentication information:

   • v1/v2c: a read-only community string is sufficient
   • v3: username, authentication protocol and password, privacy protocol and password, etc.

4. The Host where DataKit is located can access the device's SNMP service; the default port is UDP 161;

5. The device ACL, firewall, or access management policy allows the Host where DataKit is located to send SNMP requests.

Device Onboarding¶

DataKit supports two onboarding methods: "specified devices" and "auto discovery". The two methods can be used at the same time. When both methods are used together, the related devices must use the same SNMP version and authentication configuration.

Specified Devices¶

This method suits scenarios where the device IPs are clear and you want to control the collection scope. In the SNMP Collector configuration, specify one or more device IPs via specific_devices. DataKit sends SNMP requests directly to these IPs.

Auto Discovery¶

This method suits scenarios with a large number of devices or where you need to continuously discover newly added devices. In the SNMP Collector configuration, specify one or more CIDR ranges via auto_discovery. DataKit periodically probes the IPs within the ranges; when an IP responds to SNMP requests and the returned sysObjectID matches a corresponding Profile, that IP is recognized as a network device.

Auto discovery does not mean that TrueWatch scans arbitrary networks. It only scans the CIDR ranges explicitly configured in DataKit.

Complete Collection Configuration¶

Depending on how DataKit is deployed, configure the device IPs or auto-discovery CIDR ranges, SNMP version, and corresponding authentication information in the SNMP Collector, and then restart or update the DataKit configuration. Host installation and Kubernetes installation use different configuration methods. Follow the corresponding tab in SNMP Collector to complete the configuration.

After collection succeeds, devices automatically appear under Infrastructure > Network > Devices. There is no need to create them again in the console.

View the Device List¶

Go to Infrastructure > Network > Devices to view the network devices onboarded to the current Workspace through the DataKit SNMP Collector.

The device list displays:

• Device status;
• Device name;
• Device IP;
• Device type;
• Number of interfaces;
• CPU usage;
• Memory usage;
• Device uptime;
• Last update time.

Whether a device displays a field depends on the device model, SNMP Profile, and the MIB/OID actually exposed by the device.

A missing field value does not necessarily indicate a device anomaly. It may also indicate that the device does not provide that metric or that the current Profile has not been adapted for it.

Device Status¶

Device status is determined by the time TrueWatch last received data from the device:

• Active: last update within 5 minutes; data is being updated normally;
• Suspect: last update more than 5 minutes ago but no more than 10 minutes ago; there may be collection delay or a device anomaly;
• Offline: last update more than 10 minutes ago; TrueWatch has not received new device data.

Search, Filter, and Sort¶

• Search: enter a device name or IP to quickly locate a device;
• Filter: narrow the scope by conditions such as device name, IP, type, and uptime;
• Active devices: display only devices currently in the Active state with one click;
• Sort: click a column header to sort by the corresponding field in ascending or descending order.

View Device Topology¶

Go to Infrastructure > Network > Devices and switch to the Topology tab to view the physical topology of network devices generated from LLDP neighbor discovery data. Nodes in the topology represent network devices, and the lines between nodes represent physical connections between devices.

Node Status¶

Monitored devices follow the same status calculation rules as the device list. Neighbor devices that are discovered only by LLDP but do not report snmp_object data are marked as Unmonitored.

The topology uses different node styles to distinguish device status. Unmonitored neighbors are displayed as gray nodes, making it easy to quickly identify network devices that have not yet been included in monitoring.

Node Information¶

Hover over a monitored device node to view the device name, IP address, vendor, status, CPU usage, memory usage, and number of connections. You can also perform the following actions:

• View details: go to Device Information on the device detail page;
• Interface traffic: go to Interface Information on the device detail page to view interface status and traffic data.

Hover over an unmonitored neighbor node to view the device name discovered by LLDP, the available IP address, and the Unmonitored status.

Node Display Rules¶

Quick Actions¶

• Search: search and filter nodes by device name or IP address;
• Legend: view the meanings of different node statuses and styles;
• Canvas controls: zoom in, zoom out, or fit the topology to the canvas.

View Device Details¶

Click a device name to open the detail page and view device information, interface status, and performance metrics.

Device Information¶

The Device Information section displays the basic attributes of the current device, including:

• Uptime: the time the device has been continuously running since its last startup;
• Vendor OID: the vendor OID returned by the device;
• Average CPU usage: CPU utilization of the device;
• Average memory usage: memory utilization of the device;
• Number of interfaces: the total number of network interfaces collected from the device;
• Device description: descriptive information returned by the device, such as vendor, model, and software version;
• Extended attributes: tags and metadata of the device, searchable by field name or value.

If some information is empty, first confirm whether the device returns the corresponding OIDs via SNMP and whether the current device Profile includes these fields.

Interface Information¶

The Interface Information section displays the status and traffic statistics of the device's network interfaces, including:

• Total number of interfaces and the distribution of Up, Down, and Admin Down statuses;
• Interface names and statuses;
• Inbound and outbound traffic;
• Inbound and outbound error packets;
• Interface bandwidth limit.

You can filter by interface status to quickly locate abnormal ports. You can also use the settings entry in the upper-right corner of the page to configure Monitors for interface metrics.

If no traffic or error packet data is available for an interface, check whether the device exposes IF-MIB, whether the interface counters can be read, and whether the Profile includes the corresponding OIDs.

Performance Metrics¶

The Performance Metrics section displays time-series data for devices and interfaces in charts, including:

• Basic metrics: CPU Usage, Mem Usage, Interface IfOperStatus, TCP CurrEstab, etc.;
• Traffic metrics: Inbound Throughput, Outbound Throughput, etc.;
• Interface network: inbound and outbound network traffic for each interface;
• Interface packet loss and errors: dropped packet and error packet statistics for each interface.

You can use the time picker at the top to change the query range, or filter data by device IP or device name.

FAQ¶

No devices appear in the list

Check the following in order:

1. Whether DataKit is installed and running normally;
2. Whether the SNMP Collector is enabled and DataKit has been restarted after configuration changes;
3. Whether the correct device IPs or auto-discovery CIDR ranges are configured;
4. Whether SNMP is enabled on the devices;
5. Whether the SNMP version and authentication information match the device configuration;
6. Whether DataKit can access the device's UDP 161 port;
7. Whether snmpwalk can read the device OIDs when run on the Host where DataKit is located;
8. In auto discovery mode, whether the sysObjectID returned by the device can match a Profile;
9. Whether DataKit is reporting data to the Workspace you are currently viewing.

Devices are visible, but CPU, memory, or some interface metrics are missing

DataKit collects common baseline metrics from SNMP devices, but vendor-specific metrics depend on the corresponding MIB/OID and Profile. Confirm the following:

• Whether the device provides the metric via SNMP;
• Whether the current Profile supports the vendor and model;
• Whether the device account has read permission for the corresponding MIB;
• Whether a custom Profile needs to be added for the device.

A device suddenly shows as Suspect or Offline

In addition to a fault in the device itself, the following causes may also lead to this:

• DataKit stopped running or was restarted;
• The network between DataKit and the device is interrupted;
• The SNMP service is disabled;
• The SNMP authentication information has changed;
• The device ACL or firewall policy has changed;
• Collection task timeout or abnormal reporting link.

It is recommended to run snmpwalk on the Host where DataKit is located first, to determine whether the issue is with device access or data reporting.

How long does it take for a new device to appear in the list

In specified device mode, DataKit polls devices according to the configured collection interval. In auto discovery mode, the timing is also affected by the auto discovery interval. The current defaults for the SNMP Collector are: collect metrics every 10 seconds, collect device information every 5 minutes, and run auto discovery every 1 hour. These intervals can all be adjusted. The actual time a device appears depends on the user's Collector configuration.