What is model-driven telemetry, and why is it replacing SNMP polling?
Show the answer
Say this first
With SNMP the collector polls each device every few minutes, and the device walks MIB tables to answer. With model-driven telemetry the device pushes YANG-modeled data on a schedule or when it changes, over gRPC, gNMI or NETCONF. You get seconds instead of minutes, on-change events, structured data, and less CPU per data point. It does not remove SNMP overnight, because many tools and old devices still depend on it.
Go deeper
What changes
| SNMP polling | Model-driven telemetry | |
|---|---|---|
| Model | Pull | Push (or a long-lived subscription) |
| Typical interval | 1 to 5 minutes | 10 s or less, or on change |
| Data | MIB OIDs | YANG paths (OpenConfig or native) |
| Encoding | BER (ASN.1) | Protobuf (GPB, KV-GPB) or JSON |
| Transport | UDP 161, traps on 162 | gRPC, gNMI, NETCONF |
| Misses | Microbursts and short flaps between polls | Far fewer |
IOS-XE dial-out example
telemetry ietf subscription 101
encoding encode-kvgpb
filter xpath /process-cpu-ios-xe-oper:cpu-usage/cpu-utilization/five-seconds
source-address 10.0.0.1
stream yang-push
update-policy periodic 6000
receiver ip address 10.0.0.50 57000 protocol grpc-tcpupdate-policy periodic is in centiseconds, so 6000 is every 60 seconds. update-policy on-change
works for paths that support it. Newer releases also offer named receivers, configured separately.
A common collector stack
Telegraf receives the data (the cisco_telemetry_mdt input for Cisco dial-out, the gnmi input for
dial-in), writes it to InfluxDB or Prometheus, and Grafana draws it:
[[inputs.cisco_telemetry_mdt]]
transport = "grpc"
service_address = ":57000"Encodings
Compact GPB needs the matching .proto files on the collector. KV-GPB carries field names with the
values, so it is self-describing at the cost of size. JSON is easiest to read and largest.
They will ask next
Would you turn SNMP off once telemetry is in place?
Not straight away. I keep SNMP read-only (v3) for tools that need it and for devices that cannot stream, move dashboards to telemetry first, and retire polling per device class once the new data is trusted. Traps stay useful until the same events come from on-change subscriptions or syslog.
Traps
- Saying telemetry is "faster SNMP". It is a different model (push, YANG, gRPC), not a tuned poller.
- Forgetting that
update-policy periodicon IOS-XE is in centiseconds, not seconds.