The choice between agent-based and agentless monitoring decides what you can see on a Host, how much work it takes to keep that visibility, and how much load lands on your monitoring server. Nagios XI supports both, so the decision is about fit rather than product capability. This article covers what each method does, which Nagios XI wizards and agents implement it, and how to combine the two in one environment.
What Is Agent-Based Monitoring?
Agent-based monitoring installs a lightweight service on the target machine. The agent runs plugins locally and returns results to the monitoring server, which gives you access to metrics the operating system exposes only from the inside, such as per-process memory, disk I/O counters, and service state. Because the agent runs on the Host, it keeps collecting even when network conditions change, and it can execute scripts that take action on the machine.
What Is Agentless Monitoring?
Agentless monitoring collects data over a protocol the target already supports, with no separate Nagios software installed on it. Nagios XI queries the device using Simple Network Management Protocol (SNMP), Secure Shell (SSH), Windows Remote Management (WinRM), Internet Control Message Protocol (ICMP), or a direct TCP or UDP port check, and evaluates the result against thresholds you set. The available metrics are the ones the protocol exposes. SNMP is often grouped with agentless methods, though the SNMP daemon on the device is itself an agent. The distinction used here is whether a Nagios agent has to be installed.
Agent-Based vs. Agentless Monitoring: The Trade-Offs
| Consideration | Agent-based | Agentless |
|---|---|---|
| Metric depth | Anything a plugin can read on the Host, including custom checks you write | What the protocol exposes, plus custom plugins when using SSH |
| Deployment | Install and maintain software on every Host | Enable a protocol, open a port, and supply credentials |
| Ongoing maintenance | Agent updates and patching | Tied to operating system and firmware updates |
| Change approval | Often requires sign-off from the system owner | Usually faster to approve |
| Load placement | Check execution happens on the monitored Host | Check execution happens on the Nagios XI server |
| Check direction | Active and passive, depending on the agent | Active, plus passive through SNMP traps |
| Remediation | Event handlers and Actions can run scripts on the Host | Possible over SSH where a script is available |
Most environments end up mixed. Use agents on the systems where you need depth or automated remediation, and use native protocols everywhere else.
Agent-Based Monitoring Options in Nagios XI
NCPA, the Nagios Cross-Platform Agent
Nagios Cross-Platform Agent (NCPA) v3 is the recommended agent for new deployments. Ready-built packages cover Windows 8 and later, Windows Server 2016 and later, RHEL, CentOS, Oracle Linux and SUSE, Ubuntu and Debian, Mac OS X 10.11 and later, and Solaris 11.4. AIX and older Linux releases are served by NCPA v2. NCPA listens on port 5693 and authenticates with a token you set at install time, and the installer supports a silent mode with the token, bind address, port, and passive settings passed as arguments for scripted rollout.
- Check API and web GUI: Browse the API, view system information, and see real-time graphs in the NCPA interface.
- Scanning wizard: The NCPA wizard queries the Host for drives, Services, and processes and presents them for selection during configuration.
- Active and passive: Nagios XI can poll NCPA on a schedule, or NCPA can submit results upstream through Nagios Remote Data Processor (NRDP).
- Custom plugins: Plugins you write or download run through the agent with the arguments you define.
Documentation: NCPA Agent Installation Instructions | Using the NCPA Monitoring Wizard | Passive Checks with NCPA
NRPE for Existing Linux and Unix Deployments
Nagios Remote Plugin Executor (NRPE) consists of the check_nrpe plugin on the Nagios XI server and the NRPE agent on the remote Linux or Unix machine, communicating on port 5666. It suits environments that already run NRPE at scale or that include legacy operating systems, and Nagios XI can monitor those machines using your existing NRPE configuration. NRPE runs active checks, so results arrive when Nagios XI polls for them. Use the NRPE Wizard for custom check definitions, or the Linux Server (Legacy) Wizard for a simpler path. For new work, NCPA is the better choice.
Documentation: Monitoring Hosts Using NRPE and NRPE Monitoring Wizard | Installing The Linux Agent
NSClient++ for Deep Windows Checks
NSClient++ is the alternate Windows agent, useful for deep checks and for compatibility with older Windows versions. The NSClient++ wizard was moved to Legacy status in Nagios XI 2024R1, then updated to support check_nrpe and returned to Current status in Nagios XI 2024R2 and later. The check_nt method uses port 12489, and the agent can also submit passive results through NRDP or NSCA.
Documentation: Installing the Windows Agent NSClient++ | Monitoring Windows Using NSClient++
What an Agent Adds Beyond Status Checks
An agent gives Nagios XI a way to act on the Host rather than only report on it. Event handlers run a script automatically when a Service enters a given state, which is how a stopped Windows Service gets restarted without anyone being paged. The Actions component puts the same scripts behind an icon in the interface for an operator to trigger on demand. Both depend on something on the Host that can execute the script.
Documentation: Introduction to Event Handlers | Restarting Windows Services With NCPA | Restarting Linux Services With NCPA
Agentless Monitoring Options in Nagios XI
SNMP Monitoring for Servers and Network Devices
SNMP reaches almost anything attached to the network, which makes it the default for switches, routers, firewalls, printers, and appliances that cannot take an agent. The SNMP Wizard takes the device address, version, port, and community string, then lets you define each check by Object ID (OID), display name, data label, thresholds, and MIB. The SNMP Walk Wizard scans a device first so you can see which objects are available before writing checks. Nagios XI polls devices on UDP port 161. For a deeper treatment of device-level checks, see SNMP monitoring.
Documentation: How To Monitor SNMP OIDs with Nagios XI | Using The SNMP Walk Wizard and Walk Jobs Tool
SSH Monitoring for Linux, Unix, and Mac
SSH executes plugins on the remote machine over an encrypted session on port 22, which makes it the one agentless method that is not limited to a fixed metric set: if you can put a plugin on the target, you can check it. The trade-off is key management and the blast radius of the monitoring server itself, since every Host the Nagios XI server can reach over SSH is reachable by anyone who compromises that server. Harden the Nagios XI server accordingly and use a dedicated monitoring account with the narrowest permissions the checks need. Use <PASSWORD> placeholders in any runbook you circulate rather than real credentials. See agentless Linux monitoring for method-by-method coverage.
Documentation: Monitoring Hosts Using SSH
WinRM for Agentless Windows Monitoring
The WinRM Wizard in Nagios XI 2024 and 2026 monitors memory usage, CPU usage, disk usage, Windows Services, and Windows processes over the WinRM protocol. Setup runs on the target: initialize the service with winrm quickconfig, choose HTTP or HTTPS, and create the account Nagios XI will use. HTTP is the wizard default, so plan for HTTPS where traffic crosses untrusted segments. The account must belong to the local administrators group or to a local group granted Execute (Invoke) permission in the WinRM SDDL. The wizard validates credentials before it will advance, so a typo fails at step 1 rather than at first check. For the full set of Windows methods, see agentless Windows monitoring.
Documentation: How To Monitor Windows Using WinRM | How To Monitor Windows Using SNMP
Protocol and Availability Checks
ICMP ping, TCP and UDP port checks, HTTP and content checks, DNS resolution, and certificate expiry all run from the Nagios XI server against the target, with nothing installed anywhere. These checks answer the availability question for devices you have no other access to, and they are usually the first Services configured for a new Host.
Agentless Network Monitoring for Switches, Routers, and Appliances
Network hardware rarely accepts third-party software, so SNMP and ICMP carry most of the load. The Network Switch/Router Wizard in Nagios XI 2026 uses updated plugins and creates throughput checks compatible with Nagios Mod-Gearman (NMG) workers, which matters once port counts grow. Pair port status and bandwidth checks with SNMP traps so the device reports faults rather than waiting to be polled. Broader coverage of device, link, and service checks is on the agentless network monitoring page.
Flow-level questions sit outside this scope. Analysis of NetFlow, sFlow, J-Flow, and IPFIX data, including which conversations consume a link, belongs to Nagios Network Analyzer. Centralizing syslog from these devices for search and retention belongs to Nagios Log Server. Both are licensed separately from Nagios XI.
Documentation: Using the Network Switch/Router Wizard in XI 2026
Active and Passive Checks
Active and passive describe who initiates, and the distinction cuts across the agent question. With an active check, Nagios XI contacts the Host on a schedule. With a passive check, the Host or device submits the result and Nagios XI processes it on arrival.
Take a UPS that loses input power and switches to battery. An active check on a five-minute interval can take up to five minutes to notice. An SNMP trap from the device arrives as the event happens. Nagios XI receives traps on UDP port 162, and the Enterprise Edition adds the Nagios XI SNMP Trap Interface (NXTI), a web front end to the snmptrapd and snmptt workflow with trap reporting stored in a database. Traps received for objects that do not yet exist appear under Admin > Monitoring Config > Unconfigured Objects, where you can create the Service from what arrived. Trap handling in depth is covered on the SNMP trap management page.
On the agent side, NCPA submits passive results through NRDP over port 80 or 443, and NSCA uses TCP port 5667. Passive collection suits Hosts behind a firewall or without a static address, because the connection is outbound from the monitored machine.
Documentation: Integrating SNMP Traps in Nagios XI | Using NXTI | Configuring Passive Services In Nagios XI
Reducing Monitoring Server Load Across Many Hosts
Agentless methods execute every check on the Nagios XI server, so check volume, not Host count, is what eventually strains it. Three approaches address that.
- Move execution to the Host: Agents run their own checks, so the Nagios XI server handles results rather than work.
- Move execution to workers: Nagios Mod-Gearman (NMG) is a Nagios Event Broker module that hands host and Service checks to workers on other Linux servers. NMG is pre-loaded in Nagios XI 2024R2.1 and later. Workers connect inbound to the Nagios XI server to collect jobs and return results, so no inbound path to the worker is required for NMG itself.
- Switch to passive: Passive submission removes scheduling and execution from the monitoring engine entirely.
The Remote Workers management interface at Configure > Remote Workers is one of Nagios XI’s Premium features and requires active Maintenance & Support benefits. NMG can also be configured from the command line. To renew lapsed benefits, email [email protected].
Documentation: Managing Nagios Mod-Gearman In The Nagios XI Interface | Managing Nagios Mod-Gearman Queues and Workers
Ports and Access Requirements
| Method | Default port | What you configure on the target |
|---|---|---|
| NCPA | 5693 | Install the agent, set a token |
| NRPE | 5666 | Install the agent, allow the Nagios XI server address |
NSClient++ (check_nt) | 12489 | Install the agent, set allowed hosts and password |
| NSCA | 5667 | Configure the sender on the monitored machine |
| NRDP | 80 or 443 | Configure the sender with the NRDP URL and token |
| SNMP polling | 161 (UDP) | Enable the SNMP service, set version and credentials |
| SNMP traps | 162 (UDP) | Point the device at the Nagios XI server |
| SSH | 22 | Monitoring account, key, and any plugins to execute |
| WMI | 135, 445, plus dynamic ports in the 1024 to 1034 range | Running WMI service, user account, firewall rules |
Agentless does not mean untouched. Enabling a listener, creating an account, and opening a port are all changes to the monitored system. Community plugins from Nagios Exchange may use other ports and often need elevated privileges, so check each one against your environment before deployment.
Documentation: Nagios XI Ports and Protocols
Choosing Between Agent-Based and Agentless Monitoring
Start from what the Host has to tell you. If the answer includes process-level detail, custom application checks, or automated restarts, install an agent. If the answer is availability, interface throughput, resource usage, and Service state on a system you would rather not touch, a native protocol will get you there faster.
Then account for what changes underneath you. Agentless collection depends on the target vendor continuing to expose the same data. Windows monitoring has already moved once on this: SNMP support for DHCP server monitoring was withdrawn in 2016 and restored in 2019, and Microsoft has been hardening DCOM security, which WMI relies on as its transport. Systems using WMI-based collection may log Event ID 10036, with Event IDs 10037 and 10038 identifying monitoring tools that need updating. For agentless Windows monitoring in Nagios XI 2024 and 2026, WinRM and SNMP are the supported wizard paths, and NCPA covers the cases where a protocol no longer reaches far enough.
Ask the same questions of any agent you deploy, whether it comes from Nagios or elsewhere: what authenticates to it, how many levels of authentication exist, and how data is protected in transit. Standards-based mechanisms have been examined by security researchers in a way that proprietary schemes have not.
Frequently Asked Questions
NCPA vs. NRPE: Which Agent Should I Use?
Use NCPA. It covers Windows, Linux, macOS, and Solaris from one codebase, provides a check API and web GUI, supports active and passive checks, and its wizard scans the Host for drives, Services, and processes during configuration. NRPE remains the right choice for legacy operating systems and for environments with an established NRPE footprint that you are not ready to replace.
Is There a Free Nagios Agent for Windows?
Yes. NCPA is open source and free to download and use, on Windows and on every other supported platform. The agent is not licensed per Host.
Can Nagios XI Monitor Windows Without Installing Anything?
Yes, using the WinRM Wizard or the Windows SNMP Wizard. Both require configuration on the target: WinRM needs the service initialized and a user account with Execute permission, and SNMP needs the service enabled with credentials set. Neither requires Nagios software on the Windows machine.
What About WMI Monitoring?
WMI queries Windows through DCOM, which Microsoft has been tightening. Systems relying on WMI collection may see Event ID 10036 in their logs, indicating that the authentication level policy blocked a DCOM activation. WMI also needs ports 135 and 445 open plus dynamically assigned ports in the 1024 to 1034 range, which is a wider firewall exception than the alternatives. For Windows monitoring in Nagios XI 2024 and 2026, WinRM, SNMP, and NCPA are the paths Nagios documents and recommends.
Can I Mix Agent-Based and Agentless Monitoring in One Nagios XI Server?
Yes, and most deployments do. Method is chosen per Host and per Service, not per installation. A single Nagios XI server can poll switches over SNMP, query Windows Servers over WinRM, run NCPA on the database tier, and receive traps from the UPS, all feeding the same dashboards, notifications, and reports.
Does Agentless Monitoring Scale as Well as Agents?
Agentless checks execute on the Nagios XI server, so the server absorbs the cost as check counts rise. Agents distribute that work to the monitored Hosts. Where agentless coverage is required at scale, Nagios Mod-Gearman workers take check execution off the Nagios XI server, and passive submission removes it from the scheduler.
Which Method Supports Automated Remediation?
Event handlers and the Actions component execute scripts on the monitored Host, which requires something on that Host able to run them. An agent is the usual answer. Where SSH access and a script are already in place, the same pattern works without an agent.
Related Reading
By Platform
By Method
Watch
- Agent vs. Agentless: The Monitoring Showdown, the on-demand webinar version of this comparison
Try Both Methods in Your Own Environment
The fastest way to settle the question is to configure one Host each way and compare what you get. The Nagios XI trial is fully functional for 30 days, which is enough time to install NCPA on a server, point the WinRM or SNMP Wizard at another, and see which fits your change process and your metric requirements.
Start a Nagios XI trial or request a demo and we will walk through the options against your environment. Questions about licensing go to [email protected].
