.env file configuration

The .env file lives inside the docker_compose directory (the same directory extracted from docker_compose.zip). It controls all environment variables for the deployment - paths to configuration files, Splunk connection settings, image versions, and tuning parameters. Edit this file before running docker compose up. Variables in it can be divided into few sections.

Overview

Required variables

The following variables must be set before running docker compose up:

File paths:

• SCHEDULER_CONFIG_FILE_ABSOLUTE_PATH - absolute path to your scheduler-config.yaml
• TRAPS_CONFIG_FILE_ABSOLUTE_PATH - absolute path to your traps-config.yaml
• INVENTORY_FILE_ABSOLUTE_PATH - absolute path to your inventory.csv
• DISCOVERY_CONFIG_FILE_ABSOLUTE_PATH - absolute path to your discovery-config.yaml (required when using discovery)
• COREFILE_ABS_PATH - absolute path to the Corefile (a default Corefile is shipped inside the docker_compose package)

Splunk connection:

• SPLUNK_HEC_HOST - IP address or domain name of your Splunk instance
• SPLUNK_HEC_PROTOCOL - https or http
• SPLUNK_HEC_PORT - port of the HEC endpoint
• SPLUNK_HEC_TOKEN or SPLUNK_HEC_TOKEN_SECRET_FILE - HEC token, or path to a file containing the token

Once the required variables above are set, you can Deploy the app. The rest of this page covers optional and advanced parameters.

Sending container logs to Splunk

If you plan to use the Splunk logging feature, also set SPLUNK_LOG_INDEX - the Splunk event index where container logs will be sent. This cannot be configured after the fact without editing .env and restarting the stack.

Configuration

Deployment

Variable	Description
SC4SNMP_IMAGE	The registry and name of the SC4SNMP image to pull
SC4SNMP_TAG	SC4SNMP image tag to pull
SCHEDULER_CONFIG_FILE_ABSOLUTE_PATH	Absolute path to scheduler-config.yaml file
TRAPS_CONFIG_FILE_ABSOLUTE_PATH	Absolute path to traps-config.yaml file
INVENTORY_FILE_ABSOLUTE_PATH	Absolute path to inventory.csv file
DISCOVERY_CONFIG_FILE_ABSOLUTE_PATH	Absolute path to discovery-config.yaml file (required when using discovery)
COREFILE_ABS_PATH	Absolute path to Corefile used by coreDNS. Default Corefile can be found inside the docker_compose
LOCAL_MIBS_PATH	Absolute path to the directory containing local MIB files.
SECRET_FOLDER_PATH	Absolute path to the folder containing secrets.json
SC4SNMP_VERSION	Version of SC4SNMP

Network configuration

Variable	Description
COREDNS_ADDRESS	IP address of the coredns inside docker network. Should not be changed
COREDNS_ADDRESS_IPv6	IPv6 address of the coredns container. Default empty (IPv6 disabled). When enabling IPv6, set to an address within IPAM_SUBNET_IPv6 (e.g. fd02::1).
IPv6_ENABLED	Enable receiving traps and polling from IPv6 devices
IPAM_SUBNET	Subnet in CIDR format that represents a network segment
IPAM_GATEWAY	IPv4 gateway for the master subnet
IPAM_SUBNET_IPv6	Subnet in CIDR format that represents a network segment for IPv6
IPAM_GATEWAY_IPv6	IPv6 gateway for the master subnet

Info

In case of configuring more than one IPv4 and IPv6 subnet in IPAM, docker compose file should be edited.

Images of dependencies

Variable	Description
COREDNS_IMAGE	Registry and name of Coredns image
COREDNS_TAG	Coredns image tag to pull
MIBSERVER_IMAGE	Registry and name of Mibserver image
MIBSERVER_TAG	Mibserver image tag to pull
REDIS_IMAGE	Registry and name of Redis image
REDIS_TAG	Redis image tag to pull
MONGO_IMAGE	Registry and name of MongoDB image
MONGO_TAG	MongoDB image tag to pull
MONGO_GLIBC_TUNABLES	Value passed as GLIBC_TUNABLES to the mongo container. Defaults to glibc.pthread.rseq=1 to mitigate a MongoDB 8.x SIGSEGV observed on host kernels >= 6.19 (e.g. Ubuntu 26.04). Safe no-op on older kernels. See MongoDB 8.x crash on Linux kernel 6.19+.

Docker logging

Docker Compose applies bounded json-file logging by default. Existing json-file deployments receive rotation when their containers are recreated. To preserve local, journald, or another Docker daemon driver during an upgrade, set DOCKER_LOG_DRIVER before starting the upgraded deployment. See Docker logging for upgrade, switching, and verification procedures.

The default limits retain up to approximately 50 MB of uncompressed logs per container. Compression normally reduces the disk used by rotated files.

Variable	Description
DOCKER_LOG_DRIVER	Docker daemon logging driver reported by docker info --format '{{.LoggingDriver}}'. json-file, an empty value, or a missing value uses bounded json-file logging. Another driver name, or inherit, preserves daemon inheritance after running --configure_default_logging. Default: json-file
DOCKER_LOG_MAX_SIZE	Maximum size of each container log file. Use a positive size such as 100k, 10m, or 1g. Default: 10m
DOCKER_LOG_MAX_FILE	Maximum number of log files retained per container. Use a positive integer. Default: 5
DOCKER_LOG_COMPRESS	Compress rotated log files. Supported values: true or false. Default: true

These settings control Docker’s local retention when bounded json-file logging is selected and the local cache used by Docker-to-Splunk logging. They do not change SC4SNMP log levels, messages, or forwarding.

Splunk instance

Variable	Description
SPLUNK_HEC_HOST	IP address or a domain name of a Splunk instance to send data to
SPLUNK_HEC_PROTOCOL	The protocol of the HEC endpoint: https or http
SPLUNK_HEC_PORT	The port of the HEC endpoint
SPLUNK_HEC_TOKEN	Splunk HTTP Event Collector token. To keep it out of .env and docker inspect, use a Docker secret. The app then reads the token from the file path in SPLUNK_HEC_TOKEN_FILE.
SPLUNK_HEC_TOKEN_SECRET_FILE	Path on the host to the file used as the Docker secret for the HEC token (worker-sender only). The app reads the token from the mounted file. Only the path is in the container env.
SPLUNK_HEC_INSECURESSL	Whether to skip checking the certificate of the HEC endpoint when sending data over HTTPS
SPLUNK_SOURCETYPE_TRAPS	Splunk sourcetype for trap events
SPLUNK_SOURCETYPE_POLLING_EVENTS	Splunk sourcetype for non-metric polling events
SPLUNK_SOURCETYPE_POLLING_METRICS	Splunk sourcetype for metric polling events
SPLUNK_HEC_INDEX_EVENTS	Name of the Splunk event index
SPLUNK_HEC_INDEX_METRICS	Name of the Splunk metrics index
SPLUNK_HEC_PATH	Path for the HEC endpoint
SPLUNK_AGGREGATE_TRAPS_EVENTS	When set to true makes traps events collected as one event inside splunk
SPLUNK_METRIC_NAME_HYPHEN_TO_UNDERSCORE	Replaces hyphens with underscores in generated metric names to ensure compatibility with Splunk’s metric schema
IGNORE_EMPTY_VARBINDS	Details can be found in empty snmp response message issue
SPLUNK_LOG_INDEX	Event index in Splunk where logs from docker containers would be sent

Advanced configuration

Workers

General

Variable	Description
WALK_RETRY_MAX_INTERVAL	Maximum time interval between walk attempts
WALK_MAX_RETRIES	Maximum number of walk retries
METRICS_INDEXING_ENABLED	Details can be found in append oid index part to the metrics
POLL_BASE_PROFILES	Enable polling base profiles (with IF-MIB and SNMPv2-MIB)
IGNORE_NOT_INCREASING_OIDS	Ignoring occurred: OID not increasing issues for hosts specified in the array, ex: IGNORE_NOT_INCREASING_OIDS=127.0.0.1:164,127.0.0.6
WORKER_LOG_LEVEL	Logging level of the workers, possible options: DEBUG, INFO, WARNING, ERROR, CRITICAL, or FATAL
WORKER_DISABLE_MONGO_DEBUG_LOGGING	Disable extensive MongoDB debug logging when WORKER_LOG_LEVEL is set to DEBUG
UDP_CONNECTION_TIMEOUT	Timeout in seconds for SNMP operations
UDP_CONNECTION_RETRIES	Number of SNMP UDP retries per operation (default: 5)
MAX_OID_TO_PROCESS	Sometimes SNMP Agent cannot accept more than X OIDs per once, so if the error “TooBig” is visible in logs, decrease the number of MAX_OID_TO_PROCESS
MAX_REPETITIONS	The amount of requested next oids in response for each of varbinds in one request sent
CELERY_TASK_TIMEOUT	Timeout in seconds for a single Celery task (default: 2400)

Worker Poller

Variable	Description
WORKER_POLLER_CONCURRENCY	Minimum number of threads in the poller container
PREFETCH_POLLER_COUNT	How many tasks are consumed from the queue at once in the poller container
WORKER_POLLER_REPLICAS	Number of docker replicas of worker poller container
WORKER_POLLER_CPU_LIMIT	Limit of cpu that worker poller container can use
WORKER_POLLER_MEMORY_LIMIT	Limit of memory that worker poller container can use
WORKER_POLLER_CPU_RESERVATIONS	Dedicated cpu resources for worker poller container
WORKER_POLLER_MEMORY_RESERVATIONS	Dedicated memory resources for worker poller container
WORKER_POLLER_MAX_TASKS_PER_CHILD	Max number of tasks a poller worker child process can execute before being recycled. 0 (default) disables recycling. Useful to mitigate memory growth in long-running workers
WORKER_POLLER_MAX_MEMORY_PER_CHILD	Maximum resident memory per poller child in Celery kilobytes (1 unit = 1,024 bytes). 0 disables memory recycling
ENABLE_WORKER_POLLER_SECRETS	Enable usage of secrets for poller

Worker Sender

Variable	Description
WORKER_SENDER_CONCURRENCY	Minimum number of threads in the sender container
PREFETCH_SENDER_COUNT	How many tasks are consumed from the queue at once in the sender container
WORKER_SENDER_REPLICAS	Number of docker replicas of worker sender container
WORKER_SENDER_CPU_LIMIT	Limit of cpu that worker sender container can use
WORKER_SENDER_MEMORY_LIMIT	Limit of memory that worker sender container can use
WORKER_SENDER_CPU_RESERVATIONS	Dedicated cpu resources for worker sender container
WORKER_SENDER_MEMORY_RESERVATIONS	Dedicated memory resources for worker sender container
WORKER_SENDER_MAX_TASKS_PER_CHILD	Max number of tasks a sender worker child process can execute before being recycled. 0 (default) disables recycling. Useful to mitigate memory growth in long-running workers
WORKER_SENDER_MAX_MEMORY_PER_CHILD	Maximum resident memory per sender child in Celery kilobytes (1 unit = 1,024 bytes). 0 disables memory recycling

Worker Trap

Variable	Description
WORKER_TRAP_CONCURRENCY	Minimum number of threads in the trap container
PREFETCH_TRAP_COUNT	How many tasks are consumed from the queue at once in the trap container
RESOLVE_TRAP_ADDRESS	Use reverse dns lookup for trap IP address and send the hostname to Splunk
INCLUDE_UNRESOLVED_TRAP_VARBINDS	Include trap varbinds that could not be MIB-translated under sc4snmp::unresolved in Splunk events
MAX_DNS_CACHE_SIZE_TRAPS	If RESOLVE_TRAP_ADDRESS is set to true, this is the maximum number of records in cache
TTL_DNS_CACHE_TRAPS	If RESOLVE_TRAP_ADDRESS is set to true, this is the time to live of the cached record in seconds
WORKER_TRAP_REPLICAS	Number of docker replicas of worker trap container
WORKER_TRAP_CPU_LIMIT	Limit of cpu that worker trap container can use
WORKER_TRAP_MEMORY_LIMIT	Limit of memory that worker trap container can use
WORKER_TRAP_CPU_RESERVATIONS	Dedicated cpu resources for worker trap container
WORKER_TRAP_MEMORY_RESERVATIONS	Dedicated memory resources for worker trap container
WORKER_TRAP_MAX_TASKS_PER_CHILD	Max number of tasks a trap worker child process can execute before being recycled. 0 (default) disables recycling. Useful to mitigate memory growth in long-running workers
WORKER_TRAP_MAX_MEMORY_PER_CHILD	Maximum resident memory per trap child in Celery kilobytes (1 unit = 1,024 bytes). 0 disables memory recycling

Worker Discovery

Variable	Description
WORKER_DISCOVERY_CONCURRENCY	Minimum number of threads in the discovery worker container
PREFETCH_DISCOVERY_COUNT	How many tasks are consumed from the queue at once in the discovery worker container
WORKER_DISCOVERY_REPLICAS	Number of docker replicas of worker discovery container
WORKER_DISCOVERY_CPU_LIMIT	Limit of cpu that worker discovery container can use
WORKER_DISCOVERY_MEMORY_LIMIT	Limit of memory that worker discovery container can use
WORKER_DISCOVERY_CPU_RESERVATIONS	Dedicated cpu resources for worker discovery container
WORKER_DISCOVERY_MEMORY_RESERVATIONS	Dedicated memory resources for worker discovery container
WORKER_DISCOVERY_MAX_TASKS_PER_CHILD	Max number of tasks a discovery worker child process can execute before being recycled. 0 (default) disables recycling
WORKER_DISCOVERY_MAX_MEMORY_PER_CHILD	Maximum resident memory per discovery child in Celery kilobytes (1 unit = 1,024 bytes). 0 disables memory recycling
ENABLE_WORKER_DISCOVERY_SECRETS	Enable usage of SNMPv3 secrets for the discovery worker

Inventory

Variable	Description
INVENTORY_LOG_LEVEL	Logging level of the inventory, possible options: DEBUG, INFO, WARNING, ERROR, CRITICAL, or FATAL
CHAIN_OF_TASKS_EXPIRY_TIME	Tasks expirations time in seconds
ENABLE_FULL_WALK	Enable full OID tree walk for all devices. When disabled (default), only SNMPv2-MIB is walked

Discovery

Variable	Description
COMPOSE_PROFILES	Activate optional service groups. Set to discovery to start the discovery and worker-discovery services (e.g. COMPOSE_PROFILES=discovery). Combine with other profiles using commas (e.g. discovery,debug). Leave empty to disable.
DISCOVERY_LOG_LEVEL	Logging level of the discovery loader, possible options: DEBUG, INFO, WARNING, ERROR, CRITICAL, or FATAL
DISCOVERY_PATH	Absolute path on the host to the directory where the discovery worker writes discovered device CSV files

See Discovery configuration for full setup instructions.

Traps

Variable	Description
SNMP_V3_SECURITY_ENGINE_ID	SNMPv3 TRAPs require the configuration SNMP Engine ID of the TRAP sending application for the USM users table of the TRAP receiving application for each USM user, for example: SNMP_V3_SECURITY_ENGINE_ID=80003a8c04,aab123456
INCLUDE_SECURITY_CONTEXT_ID	Controls whether to add the context_engine_id field to v3 trap events
TRAPS_PORT	External port exposed for traps server
ENABLE_TRAPS_SECRETS	Enable usage of secrets for traps
DISCOVER_ENGINE_ID	Enable automatic engine ID discovery from incoming SNMPv3 trap datagrams. See Engine ID Discovery
TRAP_LOG_LEVEL	Logging level of the traps container, possible options: DEBUG, INFO, WARNING, ERROR, CRITICAL, or FATAL
TRAP_DISABLE_MONGO_DEBUG_LOGGING	Disable extensive MongoDB debug logging when TRAP_LOG_LEVEL is set to DEBUG
MAX_TRAP_VARBINDS_TO_DECODE	Maximum varbinds to decode per trap (0 = unlimited, default 0)

Scheduler

Variable	Description
SCHEDULER_LOG_LEVEL	Logging level of the scheduler, possible options: DEBUG, INFO, WARNING, ERROR, CRITICAL, or FATAL

Once all required variables are configured, proceed to Deploy the app.