Configure network monitoring with SNMP and Grafana dashboards for infrastructure visibility

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Global variables
SNMP_COMMUNITY="${1:-monitoring_read}"
SNMP_V3_USER="${2:-monitoruser}"
SNMP_V3_AUTH="${3:-monitoring123!}"
SNMP_V3_PRIV="${4:-encryption456!}"
TOTAL_STEPS=10

# Usage function
usage() {
    echo "Usage: $0 [snmp_community] [snmpv3_user] [snmpv3_auth_pass] [snmpv3_priv_pass]"
    echo "Example: $0 public_read netmon secretauth secretpriv"
    exit 1
}

# Error handling
cleanup_on_error() {
    echo -e "${RED}[ERROR] Installation failed. Cleaning up...${NC}"
    systemctl stop snmpd 2>/dev/null || true
    systemctl stop prometheus 2>/dev/null || true
    systemctl stop snmp_exporter 2>/dev/null || true
    exit 1
}

trap cleanup_on_error ERR

# Check if running as root
if [[ $EUID -ne 0 ]]; then
    echo -e "${RED}This script must be run as root${NC}"
    exit 1
fi

# Detect distribution
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update && apt upgrade -y"
            SNMP_PACKAGES="snmp snmpd snmp-mibs-downloader"
            ;;
        almalinux|rocky|centos|rhel|ol)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            SNMP_PACKAGES="net-snmp net-snmp-utils net-snmp-libs"
            ;;
        fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            SNMP_PACKAGES="net-snmp net-snmp-utils net-snmp-libs"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum update -y"
            SNMP_PACKAGES="net-snmp net-snmp-utils net-snmp-libs"
            ;;
        *)
            echo -e "${RED}Unsupported distribution: $ID${NC}"
            exit 1
            ;;
    esac
else
    echo -e "${RED}Cannot detect distribution${NC}"
    exit 1
fi

echo -e "${GREEN}Starting SNMP + Prometheus + Grafana monitoring setup${NC}"

# Step 1: Update system packages
echo -e "${YELLOW}[1/$TOTAL_STEPS] Updating system packages...${NC}"
$PKG_UPDATE

# Step 2: Install required system packages
echo -e "${YELLOW}[2/$TOTAL_STEPS] Installing system dependencies...${NC}"
if [[ "$PKG_MGR" == "apt" ]]; then
    $PKG_INSTALL wget curl tar systemd
else
    $PKG_INSTALL wget curl tar systemd firewalld
fi

# Step 3: Install SNMP packages
echo -e "${YELLOW}[3/$TOTAL_STEPS] Installing SNMP daemon and tools...${NC}"
$PKG_INSTALL $SNMP_PACKAGES

# Step 4: Configure SNMP daemon
echo -e "${YELLOW}[4/$TOTAL_STEPS] Configuring SNMP daemon...${NC}"
cat > /etc/snmp/snmpd.conf << EOF
# Basic SNMP configuration for network monitoring
rocommunity $SNMP_COMMUNITY default -V systemonly
rocommunity6 $SNMP_COMMUNITY default -V systemonly

# System information
sysLocation Network Operations Center
sysContact admin@example.com
sysServices 72

# Process monitoring
proc sshd
proc systemd

# Disk monitoring
disk / 10000
disk /var 5000

# Load monitoring
load 12 10 5

# Enable AgentX
master agentx
agentXSocket tcp:localhost:705

# Access control views
view systemonly included .1.3.6.1.2.1.1
view systemonly included .1.3.6.1.2.1.25.1
view systemonly included .1.3.6.1.2.1.2
view systemonly included .1.3.6.1.2.1.3
view systemonly included .1.3.6.1.2.1.4
view systemonly included .1.3.6.1.2.1.6
view systemonly included .1.3.6.1.2.1.10
EOF

chmod 644 /etc/snmp/snmpd.conf

# Step 5: Configure SNMPv3
echo -e "${YELLOW}[5/$TOTAL_STEPS] Configuring SNMPv3 security...${NC}"
systemctl stop snmpd 2>/dev/null || true
net-snmp-create-v3-user -ro -A "$SNMP_V3_AUTH" -X "$SNMP_V3_PRIV" -a SHA -x AES "$SNMP_V3_USER"

cat >> /etc/snmp/snmpd.conf << EOF

# SNMPv3 configuration
rouser $SNMP_V3_USER
group MyROGroup v3 $SNMP_V3_USER
view all included .1 80
access MyROGroup "" any auth exact all none none
EOF

# Step 6: Create system users
echo -e "${YELLOW}[6/$TOTAL_STEPS] Creating system users...${NC}"
useradd --no-create-home --shell /bin/false prometheus 2>/dev/null || true
useradd --no-create-home --shell /bin/false snmp_exporter 2>/dev/null || true

# Step 7: Install Prometheus
echo -e "${YELLOW}[7/$TOTAL_STEPS] Installing Prometheus...${NC}"
cd /tmp
wget -q https://github.com/prometheus/prometheus/releases/download/v2.48.0/prometheus-2.48.0.linux-amd64.tar.gz
tar -xzf prometheus-2.48.0.linux-amd64.tar.gz
mv prometheus-2.48.0.linux-amd64/prometheus /usr/local/bin/
mv prometheus-2.48.0.linux-amd64/promtool /usr/local/bin/
mkdir -p /etc/prometheus /var/lib/prometheus
chown prometheus:prometheus /var/lib/prometheus
chmod 755 /etc/prometheus /var/lib/prometheus

# Create Prometheus config
cat > /etc/prometheus/prometheus.yml << EOF
global:
  scrape_interval: 15s

scrape_configs:
  - job_name: 'snmp'
    static_configs:
      - targets:
        - 127.0.0.1  # SNMP target
    metrics_path: /snmp
    params:
      module: [if_mib]
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target
      - source_labels: [__param_target]
        target_label: instance
      - target_label: __address__
        replacement: 127.0.0.1:9116
EOF

chown prometheus:prometheus /etc/prometheus/prometheus.yml
chmod 644 /etc/prometheus/prometheus.yml

# Step 8: Install SNMP Exporter
echo -e "${YELLOW}[8/$TOTAL_STEPS] Installing SNMP Exporter...${NC}"
cd /tmp
wget -q https://github.com/prometheus/snmp_exporter/releases/download/v0.24.1/snmp_exporter-0.24.1.linux-amd64.tar.gz
tar -xzf snmp_exporter-0.24.1.linux-amd64.tar.gz
mv snmp_exporter-0.24.1.linux-amd64/snmp_exporter /usr/local/bin/
mkdir -p /etc/snmp_exporter
chown snmp_exporter:snmp_exporter /etc/snmp_exporter
chmod 755 /etc/snmp_exporter

# Create SNMP Exporter config
cat > /etc/snmp_exporter/snmp.yml << EOF
auths:
  public_v2:
    community: $SNMP_COMMUNITY
    security_level: noAuthNoPriv
    version: 2
  
  secure_v3:
    username: $SNMP_V3_USER
    security_level: authPriv
    auth_protocol: SHA
    auth_password: $SNMP_V3_AUTH
    priv_protocol: AES
    priv_password: $SNMP_V3_PRIV
    version: 3

modules:
  if_mib:
    walk:
      - 1.3.6.1.2.1.2.2.1.10
      - 1.3.6.1.2.1.2.2.1.16
      - 1.3.6.1.2.1.2.2.1.8
    auth:
      community: $SNMP_COMMUNITY
EOF

chown snmp_exporter:snmp_exporter /etc/snmp_exporter/snmp.yml
chmod 644 /etc/snmp_exporter/snmp.yml

# Step 9: Create systemd services
echo -e "${YELLOW}[9/$TOTAL_STEPS] Creating systemd services...${NC}"

cat > /etc/systemd/system/prometheus.service << EOF
[Unit]
Description=Prometheus
After=network.target

[Service]
User=prometheus
Group=prometheus
Type=simple
ExecStart=/usr/local/bin/prometheus \\
    --config.file /etc/prometheus/prometheus.yml \\
    --storage.tsdb.path /var/lib/prometheus/ \\
    --web.console.templates=/etc/prometheus/consoles \\
    --web.console.libraries=/etc/prometheus/console_libraries \\
    --web.listen-address=0.0.0.0:9090

[Install]
WantedBy=multi-user.target
EOF

cat > /etc/systemd/system/snmp_exporter.service << EOF
[Unit]
Description=SNMP Exporter
After=network.target

[Service]
User=snmp_exporter
Group=snmp_exporter
Type=simple
ExecStart=/usr/local/bin/snmp_exporter --config.file=/etc/snmp_exporter/snmp.yml

[Install]
WantedBy=multi-user.target
EOF

chmod 644 /etc/systemd/system/prometheus.service /etc/systemd/system/snmp_exporter.service

# Step 10: Start and enable services
echo -e "${YELLOW}[10/$TOTAL_STEPS] Starting and enabling services...${NC}"
systemctl daemon-reload
systemctl enable --now snmpd
systemctl enable --now prometheus
systemctl enable --now snmp_exporter

# Configure firewall if needed
if command -v firewall-cmd &> /dev/null; then
    firewall-cmd --permanent --add-port=9090/tcp --add-port=9116/tcp --add-port=161/udp
    firewall-cmd --reload
elif command -v ufw &> /dev/null; then
    ufw allow 9090/tcp
    ufw allow 9116/tcp
    ufw allow 161/udp
fi

# Verification
echo -e "${GREEN}Verifying installation...${NC}"
sleep 5

if systemctl is-active --quiet snmpd; then
    echo -e "${GREEN}✓ SNMP daemon is running${NC}"
else
    echo -e "${RED}✗ SNMP daemon failed to start${NC}"
fi

if systemctl is-active --quiet prometheus; then
    echo -e "${GREEN}✓ Prometheus is running${NC}"
else
    echo -e "${RED}✗ Prometheus failed to start${NC}"
fi

if systemctl is-active --quiet snmp_exporter; then
    echo -e "${GREEN}✓ SNMP Exporter is running${NC}"
else
    echo -e "${RED}✗ SNMP Exporter failed to start${NC}"
fi

echo -e "${GREEN}Installation completed successfully!${NC}"
echo -e "${YELLOW}Access Prometheus at: http://localhost:9090${NC}"
echo -e "${YELLOW}SNMP Exporter metrics at: http://localhost:9116${NC}"
echo -e "${YELLOW}Test SNMP: snmpwalk -v2c -c $SNMP_COMMUNITY localhost 1.3.6.1.2.1.1.5${NC}"