Problem

Zabbix network discovery can find an SNMP device and automatically add the host, but administrators must manually create and maintain discovery actions that map returned SNMP values to specific templates.

Zabbix already has the two necessary parts:

• Network discovery can retrieve values such as sysObjectID, sysDescr and sysName.

• Discovery actions can link templates to discovered hosts.

The missing capability is a standardized fingerprint definition within templates that connects those parts.

In a large heterogeneous environment, every administrator currently has to independently build and maintain mappings such as:

• Cisco IOS/IOS-XE sysObjectID → Cisco IOS by SNMP

• ArubaOS-CX sysObjectID → Aruba CX by SNMP

• FortiGate sysObjectID → FortiGate by SNMP

• APC sysObjectID → APC UPS by SNMP

This duplicates vendor knowledge that is already known by the authors of the official templates. It is difficult to maintain, easy to configure incorrectly, and does not scale well across thousands of devices, many vendors, multiple proxies and changing hardware models.

Requested capability

Allow templates to include optional device fingerprint metadata. During network discovery, Zabbix should evaluate the SNMP identity of a discovered device against installed template fingerprints and recommend or automatically link the best matching template.

A fingerprint could include:

• sysObjectID exact match or prefix

• sysDescr regular expression

• sysName regular expression

• Optional existence or value test of a vendor-specific OID

• Manufacturer, product family and device class

• Match priority or specificity

• Minimum confidence or required conditions

Example concept:

template: Cisco IOS by SNMP
device_fingerprints:
 * sysObjectID_prefix: .1.3.6.1.4.1.9.1
priority: 100

 * sysDescr_regex: "(Cisco IOS|IOS-XE)"
priority: 50

Proposed workflow

A network discovery rule finds an SNMP-enabled device.

Zabbix retrieves sysObjectID.0, sysDescr.0 and sysName.0.

Zabbix compares those values against fingerprint metadata in installed templates.

The most specific valid match is selected.

Depending on the configured mode, Zabbix either:

automatically links the template;

recommends the matching template for approval; or

performs a dry run and records the proposed match.

Zabbix records which fingerprint matched and why.

If no reliable match exists, the host could receive a configurable generic SNMP template and be placed in an “Unclassified devices” group.

Configuration modes

The feature should support the following modes:

• Disabled — preserve current behavior.

• Recommend only — display the best template match without applying it.

• Automatic — link a template when one unambiguous match meets the configured threshold.

• Automatic with fallback — link a generic SNMP template when no specific match exists.

Administrators should be able to override a match, exclude templates, pin a manually selected template, and control whether automatic reassessment is performed later.

Conflict and safety handling

• Do not replace a manually linked or pinned template automatically.

• Do not apply a match when equally ranked templates conflict.

• Detect duplicate item keys before linking.

• Display all matching fingerprints and explain the selected result.

• Record automatic template changes in the audit log.

• Permit administrators to disable automatic matching globally, per proxy, discovery rule, host group or template.

• Do not probe vendor-specific OIDs until basic sysObjectID/sysDescr matching has narrowed the candidates, to avoid unnecessary SNMP load.

Existing industry implementation

This is an established and deterministic network-monitoring workflow, not an AI requirement.

Observium automatically detects a device operating system or family primarily through sysObjectID and sysDescr. When those values are insufficient, its detection definitions can require additional vendor-specific OIDs. It then activates the monitoring behavior appropriate for the detected device.

Zabbix already collects the same SNMP identity information and has a significantly larger template-driven monitoring system. Adding optional fingerprint metadata to Zabbix templates would allow the device knowledge maintained by template authors to be reused by every Zabbix installation.

Reference:
https://docs.observium.org/developing/add_os/

Why existing features are insufficient

Network discovery actions technically allow administrators to create individual matching rules, but every installation must recreate and maintain the complete vendor/model-to-template database independently.

The Host Wizard improves manual onboarding but still requires the user to select a template. It does not solve unattended discovery or onboarding at scale.

ZBXNEXT-5274 requests dynamic template linking based primarily on software, item values, triggers or LLD. This request is narrower and different: it proposes template-owned SNMP fingerprints used specifically during initial network-device discovery and classification.

 Benefits

• Meaningfully faster onboarding of large network estates

• Consistent results across Zabbix installations and proxies

• Less manual rule duplication and configuration error

• Immediate use of official templates after discovery

• Easier migration from other monitoring platforms

• Better classification, inventory and grouping of discovered hosts

• A community-maintained fingerprint library delivered with templates

• Lower barrier to adopting Zabbix for heterogeneous network monitoring

For environments containing tens of thousands of devices, this changes network discovery from “find the address and manually classify it” into a complete automated monitoring-onboarding workflow.

Suggested acceptance criteria

• Templates can declare one or more optional SNMP fingerprint definitions.

• Fingerprints are included in template YAML/XML/JSON import and export.

• Discovery can match sysObjectID prefixes and sysDescr regular expressions.

• More complex fingerprints can optionally test vendor-specific OIDs.

• Administrators can choose recommend-only, automatic or fallback behavior.

• Zabbix displays the matched template, fingerprint and reason.

• Ambiguous matches do not automatically link a template.

• Manual template selections can be pinned and protected.

• Matching works consistently through Zabbix server, proxy and proxy groups.

• Existing installations and discovery actions continue working unchanged.