Monitoring UniFi switches and access points.

1. Turn on SNMP in UniFi Network

Do this in the UniFi Network application, not on the device. The application provisions every adopted device, so a setting made on a switch over SSH is overwritten at the next provision.

1. Open the UniFi Network application and go to Settings. Where SNMP lives depends on the version. In recent versions of the UniFi Network application it is under Settings › CyberSecure › Traffic Logging. Older versions put it under System › Advanced or Services. If it isn't in any of those, search Settings for “SNMP”.
2. Enable SNMP and choose v1/v2c, or v3 (see below).
3. Set a community string. Don't leave it as public. Pick something unguessable. It is read-only, but it is sent in clear text, so don't reuse a password.
4. Apply the change. The application pushes it to every adopted device. This can take a minute or two.

The setting is per site. If your UniFi Network application manages several sites, turn on SNMP in each site you want monitored.

UniFi also offers SNMPv3 (username and password), and NetRiva supports it. Choose the version in the Discover prompt (the default for all devices) or under Non-standard SNMP on a device, then enter the user name, the security level (none, authentication only, or authentication and encryption), the protocols and the passphrases, to match what you set in UniFi. The passphrases are stored with your other saved logins and are never shown again. v1/v2c still works unchanged if you prefer a community string.

2. Add the devices to NetRiva

Every UniFi switch and access point answers SNMP on its own IP address. You'll find those addresses in the UniFi Network application's device list.

• Discover: open the Map, click Discover topology and enter your community in the SNMP community box. NetRiva saves it as the default for future scans. UniFi switches report their neighbours over LLDP, so the map usually builds itself.
• Add manually: on Devices, add each switch or AP by IP and set the role to switch or ap. If this device uses a different community from your default, tick Non-standard SNMP for this device and enter the community (and port, if it isn't 161).

Set the default community once in the Map's Discover prompt. Per-device overrides are only for the odd device that differs.

Quick check from the NetRiva machine:

snmpwalk -v2c -c YOUR-COMMUNITY 192.0.2.10 sysDescr

3. Device SSH (for troubleshooting, optional)

UniFi sets one SSH username and password for all adopted devices in a site. Look for Device SSH Authentication (some versions call it Device Authentication) in the application's Settings. In most versions it is under the System or Advanced section.

• Turn it on and set a username and a strong, unique password. It's the same login on every device in the site, so treat it like an admin password.
• NetRiva uses this login for read-only troubleshooting: the assistant runs only the display commands in the UniFi switch command pack, never configuration commands. Save it on a device's SSH login in NetRiva (Settings, Device logins).
• You can switch it off again at any time. Monitoring works without it.

4. API access (Settings › Controllers & APIs)

NetRiva reads device, port and client information from the UniFi Network application's API. It only reads and never changes anything. To set it up:

• If your version offers API keys, use one. On a UniFi OS console or UniFi OS Server, recent versions of the UniFi Network application have Settings › Control Plane › Integrations, where an administrator can create an API key. The key is shown once, so copy it straight away.
• If it doesn't (older versions, or the self-hosted legacy Network Server), create a separate local admin account for NetRiva with the least access your version allows. Choose a view-only or read-only role where it exists.
• Never use the owner's ui.com account. A cloud login controls everything, often has two-factor authentication on it, and can't be revoked without locking yourself out. A dedicated key or local user can be deleted on its own.
• Give it a name you'll recognise, such as netriva, so you know what to revoke later.

Enter it in NetRiva under Settings › Controllers & APIs › Add a UniFi controller: the controller's address (https, add :8443 for a self-hosted one), the site (blank means default), and the API key or the local username and password. UniFi controllers use a self-signed certificate by default: press Read it from the controller, check the fingerprint, and choose Pin this certificate. Allow self-signed works but checks nothing. Press Test: it shows the devices found and which ones matched your NetRiva devices (by IP address, then name). Tick Let the AI use this if you want the assistant to ask it questions. An API key gives devices, ports, PoE and clients; events and alarms need the local user.

5. Firewall and ports

If the devices sit on a management VLAN, the NetRiva machine must be allowed to reach it. That includes the gateway's own firewall rules between VLANs.

6. When it doesn't work

1. Was the change provisioned? In the UniFi Network application, check that the devices are online and not still provisioning.
2. Right site? SNMP is set per site. A device in another site keeps its own setting.
3. Version matches? NetRiva must be set to the same SNMP version as UniFi: v1/v2c with the community, or v3 with the same user name, protocols and passphrases.
4. Community matches? Compare it with what NetRiva uses: the Discover default, or the per-device override. Watch for trailing spaces.
5. Reachable? Run the snmpwalk above from the NetRiva machine. A timeout means a wrong community or something blocking UDP 161, in that order of likelihood.
6. Device answers but some data is missing? “Does not implement” means the device answered but doesn't expose that value. Some UniFi models report less than others. It isn't a fault.

Still stuck? Open Help in the app for the in-product UniFi guide, or send us a diagnostic bundle.

← Back to the docs