Forum Discussion
Blue_whale
Cirrocumulus
Jul 22, 2026OID to monitor Device trust certificate
Hello Team , For device certificate expiry we use snmp OID - certsExpiration': '.1.3.6.1.4.1.3375.2.100.1.0 Do we have similar OID to monitor Device trust certificate ?
JRahm
Admin
Jul 22, 2026I couldn't find one, but you can create your own custom oid. Here's how:
- Use the script from K000151455 and place somewhere (I put it in /config/check_status.sh)
- chmod +x /config/check_status.sh (changing to executable file)
- chcon -t bin_t /config/check_trust.sh ( setting to a file type snmpd is allowed to execute)
- Create file /config/snmp/custom_mib.tcl (see below)
- Restart snmpd (bigstart restart snmpd)
- grep for the the mibs being registered in the log file (grep -i "custom mib" /var/log/snmpd.log)
- Test it out:
[root@bigip02:Active:In Sync] snmp # bigstart restart snmpd
[root@bigip02:Active:In Sync] snmp # grep -i "custom mib" /var/log/snmpd.log
custom mib initialization completed. total 2 custom mib entry registered
[root@bigip02:Active:In Sync] snmp # snmpget -v2c -c public localhost .1.3.6.1.4.1.3375.2.100.5.0
F5-BIGIP-COMMON-MIB::bigipTrafficMgmt.100.5.0 = STRING: "Certificate is valid until Sep 30 21:46:25 2031 GMT (1895 Days remaining)"
[root@bigip02:Active:In Sync] snmp # snmpget -v2c -c public localhost .1.3.6.1.4.1.3375.2.100.6.0
F5-BIGIP-COMMON-MIB::bigipTrafficMgmt.100.6.0 = STRING: "1895"
Here's the custom_mib.tcl file (notice I set to .5 and .6 since it looks like you're already using a custom mib space perhaps?)
# /config/snmp/custom_mib.tcl
# .1.3.6.1.4.1.3375.2.100.5.0 -> trust cert, full status string
# .1.3.6.1.4.1.3375.2.100.6.0 -> trust cert, days remaining (int)
register_mib ".5" trust_cert_status string
register_mib ".6" trust_cert_days int
proc trust_cert_status {} {
set status [catch {exec /config/check_trust.sh} result]
if {$status != 0 || $result eq ""} {
return "ERROR: check_trust.sh failed"
}
return [string trim $result]
}
proc trust_cert_days {} {
set status [catch {exec /config/check_trust.sh} result]
if {$status != 0} {
return -1
}
if {[regexp {\(([0-9]+) Days remaining\)} $result -> days]} {
return $days
}
return -1
}
(Tested on 21.x, but this has been possible for a long time. Here are details from 13.1 user guide)
Hope this helps!
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects