SNMP & WMI evaluation

SNMP and WMI monitors both read a value from a device and turn it into a status. You pick how with an operator: compare the value to numeric thresholds, or match it against a regular expression.

The mechanism is the same for both monitor types — only the source of the value differs:

SNMP reads the value of an OID.
WMI reads the value returned by a WQL query (in a namespace, default root\CIMV2).

Each row on the monitor has an operator that decides how its value becomes a status, and which extra fields the form shows.

Operators

Operator	Extra fields	Behaviour
`number >`	Minor / Major / Critical	Status escalates as the value rises above each threshold
`number <`	Minor / Major / Critical	Status escalates as the value falls below each threshold
`regexp`	Pattern	Status depends on whether the value matches the regular expression

The thresholds follow the usual severity order: crossing Minor raises a minor status, Major a major one, Critical a critical one.

SNMP example

Monitor free memory on an OID and alert when it drops too low.

Field	Value
OID	`.1.3.6.1.4.1.2021.4.6.0`
Operator	`number <`
Minor	`2000000`
Major	`1000000`
Critical	`500000`

WMI example

Query CPU load via WQL and alert when it climbs.

Field	Value
Namespace	`root\CIMV2`
WQL	`SELECT LoadPercentage FROM Win32_Processor`
Operator	`number >`
Minor	`70`
Major	`85`
Critical	`95`

Regexp example

Match a status string (works the same on an SNMP OID or a WMI query result).

Field	Value
Operator	`regexp`
Pattern	`^running$`

Test before saving

Both forms provide a test action that runs the OID read or WQL query against the target through the selected probe and shows the returned value, so you can confirm the value and operator before the monitor goes live. WMI queries additionally require valid credentials — supply them inline or reference a credential configuration.

On SNMP devices, the ⚡ Test all button in the OID panel header runs every row’s test in one go (slightly staggered so the probe isn’t flooded) and fills all the Test Output cells.

Build the OID list faster (SNMP devices)

The OID panel of an SNMP device ships three assistants, all in the panel header. They only append rows to the table — nothing reaches the device until you review the thresholds and hit the panel’s save button.

Suggested OIDs

The 🪄 Suggest OIDs button proposes a curated set of OIDs for the selected device:

a generic base (sysUpTime restart detection, CPU load, process count, TCP sessions, interface count), plus
a vendor set derived from the device’s discovered sysObjectID (Cisco CPU/memory/temperature, Net-SNMP Linux agents, Fortinet, Palo Alto, Juniper, F5, MikroTik…).

Every candidate is verified live on the device through the probe: only OIDs the device actually answered are shown, each with its current value. The probe also enumerates the device’s interfaces and offers per-interface suggestions (ifOperStatus with the live up/down state, and an ifInOctets + ifOutOctets traffic expression). Tick the entries you want and click Add selected — rows already present in the table are marked already added and skipped. Each suggestion comes with a sensible operator and default thresholds; adjust them before saving.

OID browser

The 🌳 Browse device button walks any SNMP subtree on the device and lists every returned entry with its resolved MIB name, type, and current value. Pick a common subtree from the dropdown (system, interfaces, host-resources, net-snmp…) or type any root OID, then hit Walk. Use the filter box to narrow the result, and click + on a row to turn it into an OID row — the operator is chosen automatically from the value type (numeric types get number >, strings get regexp). This is the fastest way to instrument a device the suggestion catalog doesn’t know.

OID set templates

The 📑 OID set templates button saves and reuses whole OID sets across devices:

Perfect the OID rows on one device, open the panel, name the template and click Save current rows.
Select any other device, open the panel again and click Apply on the template: its rows are appended (entries already present are skipped), you review the thresholds and save.

Templates are stored centrally with author and date; the viewer role can apply but not save or delete.

Editing aids

While typing or pasting into an OID Value field, a hint under the input shows the resolved standard MIB name (sysUpTime, ifOperStatus.4, expression operands included) so you can spot a wrong OID at a glance.
Suggestions and walk results flag Counter32/Counter64 values with a ⚠ counter chip: an absolute threshold on a monotonically increasing counter rarely makes sense — prefer a delta-style expression.

The live verification, interface enumeration and OID browser require an up-to-date probe. Against an older probe the suggestions are still offered (marked unverified) and the browser explains that a probe update is needed.

The same assistants on WMI devices

The query panel of a WMI device carries the equivalent helpers:

🪄 Suggest queries — a catalog of proven WQL checks (CPU load, committed/free memory, processor queue, uptime restart-detect, process count, disk queue, TCP connections), verified live on the host through the probe. The probe also enumerates local disks (a free-space suggestion per drive, thresholds prefilled at 20/10/5 % of that disk’s size, live “free of total” shown) and auto-start services (a State regexp ^Running$ suggestion per service, current state shown).
🗂 WMI class browser — enumerate the namespace’s classes (prefix-filtered, or pick a common class from the quick list), open one to sample a live instance: every property is listed with its type and current value, and + turns it into a SELECT <property> FROM <class> query row with the operator picked from the type.
📑 Query set templates — save the current query rows under a name and apply them to any other Windows host, duplicates skipped.
⚡ Test all — runs every query row’s test in one click (1s stagger — WMI calls are serialized on the probe).

Same rules as SNMP: rows are only appended, you review thresholds and save; an older probe degrades to unverified suggestions.

The SNMP evaluator supports **math expressions** that combine several OIDs into one computed value (arithmetic with `+`, `-`, `*`, `/`, parentheses, and constants), then compares the result to the thresholds — useful for values like total interface traffic (`oidIn + oidOut`) or memory percentage (`(used / total) * 100`). On SNMP devices, an expression can be typed directly in the **OID Value** field of an OID row — the per-interface traffic suggestions insert exactly this kind of expression. The standalone SNMP *monitor* form still exposes only the operator list above.