Technical Tip: FortiSIEM SNMP monitoring stops after OS-level service changes

Description

This article describes SNMP-based monitoring may stop functioning after a system reboot or maintenance activity even though the SNMP credentials configured in FortiSIEM are correct. This can occur when the operating system SNMP services disabled or not configured to start automatically during system boot.

Scope

FortiSIEM.

Solution

In FortiSIEM deployments, SNMP-based monitoring may stop functioning after a system reboot or maintenance activity, even though the SNMP credentials configured in FortiSIEM are correct.

Symptoms may include:

• SNMP Test Connectivity failures.

• No SNMP performance metrics are being collected.

• Device status changing to unreachable or unknown.

• Monitoring resumes temporarily after manually restarting the SNMP service.
  

Scope:

•  FortiSIEM Collectors.

•  FortiSIEM Supervisors.

•  FortiSIEM Worker Nodes.

•  Rocky Linux/CentOS-based FortiSIEM deployments.
  

Solutions:

Verify whether the SNMP service is running and enabled.

Check the current SNMP service status:

systemctl status snmpd

Verify whether the service is configured to start automatically after reboot:

systemctl is-enabled snmpd

Expected output:

enabled

If the output shows:

disabled

Enable the service:

systemctl enable snmpd

Start or restart the service:

systemctl restart snmpd

Confirm that SNMP is responding locally:

snmpwalk -v2c -c public localhost system

If the service is disabled, SNMP monitoring may work temporarily after a manual service restart, but will stop again following the next reboot because the service is not configured to start automatically.

To verify persistence across reboots:

systemctl is-enabled snmpd

Once the service is enabled, the operating system will automatically start SNMP after every reboot, ensuring uninterrupted SNMP-based monitoring within FortiSIEM.

Note:

Disabling the SNMP service is not recommended unless specifically required by administrative policy. For FortiSIEM environments utilizing SNMP monitoring, the service should remain enabled to ensure continuous metric collection and device monitoring after system restarts or upgrades.