Files are where most automated work leaves its evidence. Exports, backups, queue directories, partner transfers, and application logs all succeed or fail quietly, and a directory that has stopped changing looks identical to one that is working. Nagios XI checks the count, age, and size of the files and folders you depend on, compares each result against thresholds you set, and notifies you when a value crosses the line.

File monitoring is the scheduled checking of file and directory attributes, then alerting when a value falls outside an expected range. The attributes that carry the most operational signal are count, age, size, and presence. A spool directory that stops draining, an export that is 18 hours old instead of two, and a log that has stopped growing are all visible in metadata alone, which is what separates file monitoring from log analysis: file monitoring reads facts about the file, not the text inside it.

• Failed batch jobs surface immediately: A file that should be replaced every night and is now 30 hours old moves the Service to Critical instead of waiting for someone to notice missing data.
• Spool directories stay drained: A rising file count in a queue directory means the consuming process has stalled, which is measurable long before disk space runs out.
• Backups get verified, not assumed: Checking that the backup file exists, is recent, and exceeds a minimum size catches jobs that reported success while writing an empty archive.
• Storage growth becomes a trend instead of an outage: Directory size tracked over time shows which application is consuming the volume and when it will run out of room.
• Runaway processes get caught early: A log or temp file growing far faster than its normal rate points at a loop or a retry storm on the Host.
• Partner transfers get confirmed: File drops and EDI handoffs are verifiable by presence and age, so a silent upstream failure does not become your incident.

File and Folder Monitoring with the Folder Watch Wizard

The Folder Watch Wizard builds Services for a single directory. Navigate to Configure > Configuration Wizards and select the Folder Watch Wizard.

• File Count: Counts the entries matching your pattern, with thresholds written as greater than, less than, or equal to.
• File Age: Measures age in seconds against a Warning and Critical pair, an inside range, or an outside range.
• File Size: Measures size in bytes using the same comparison modes, so a minimum-size floor is as easy to set as a maximum-size ceiling.
• Regular Expression: Restricts each Service to matching names, so export-.*\.csv watches one job’s output rather than the whole directory.
• Query scope: Include subdirectories, include hidden files, and limit results to files, directories, or both.

Watching a remote directory requires passwordless SSH from the nagios user on the Nagios XI server to the nagios user on the target. Point the wizard at Linux and Unix paths, and use an agent for Windows directories. Full wizard steps and SSH key setup are covered in the documentation.

Documentation: Understanding And Using Configuration Wizards In Nagios XI | How To Monitor Hosts Using SSH In Nagios XI

Windows, Linux, and Unix File Monitoring with Agents

An agent runs the check on the Host that holds the files, which is the approach that scales and the only one that returns graphable performance data. The Nagios Cross-Platform Agent (NCPA) listens on 5693/tcp and runs on all three platforms: copy a check plugin into its plugins directory, then call it from the NCPA Wizard. NSClient++ with the Nagios Remote Plugin Executor (NRPE) listener on 5666/tcp is the alternative where NSClient++ is already deployed.

The check_file_age plugin ships with the Nagios Plugins package and checks one file at a time for age and minimum size, returning OK when the file is absent if you ask it to. It is written in Perl and targets Linux and Unix, so use a PowerShell check plugin through NCPA for Windows paths. Pair these checks with Windows server monitoring for CPU, memory, Services, and event logs on the same Host.

Directory-wide age and count plugins beyond what the Folder Watch Wizard creates are available as community plugins on the Nagios Exchange. Community plugins install separately, are maintained outside the Nagios XI release, and are not covered by Nagios support, so test them from the command line first.

Documentation: How To Monitor Devices Using NCPA In Nagios XI | How To Monitor Hosts Using The NRPE Wizard In Nagios XI | Managing Plugins In Nagios XI

File System Monitoring and Volume Capacity

Directory checks tell you what is inside a volume; capacity checks tell you how much room is left. The check_disk plugin ships with Nagios XI and reports used and free space per mount point, but the default Service checks the root filesystem only, so create a Service for every mounted volume that matters. Run these alongside disk space monitoring so a full volume and a stalled directory produce two distinct alerts instead of one ambiguous one.

File Server and Network Share Monitoring

Checking a network share from the Nagios XI server tells you very little, because a mount that has gone stale often still answers a path lookup. Mount the share on a Host that runs an agent and check the mount point from there, so the result reflects what the application sees. Add a TCP port check for SMB on 445 or NFS on 2049 to separate an unreachable share from a directory whose contents are wrong. For the array behind the share, capacity, controller state, and RAID status come from NAS and SAN monitoring.

File Change Monitoring

Nagios XI detects change by measuring modification time and size against the thresholds you defined. An edited file shows up as an age value that reset or a size value that moved, and a deleted file shows up as a count that dropped or a missing-path result. When the change you care about is inside the file rather than in its metadata, Swatchdog tails the file on the Host and submits a passive check result the moment a pattern matches.

Documentation: Log Monitoring With Swatchdog In Nagios XI

File Monitoring Thresholds and Alerting

Set thresholds from each directory’s normal working numbers rather than a round figure, so a quiet weekend does not page anyone. Age and size accept ranges as well as single values, which covers files that are suspicious for being too small as well as too large.

• State model: Services report OK, Warning, Critical, or Unknown. An Unknown on a file check points at a path the monitoring account could not read, not a value out of range.
• Escalations and downtime: Route a persistent Critical to a second contact group, and schedule downtime for windows when a directory is expected to empty or fill.
• Service dependencies: Make directory Services depend on the agent Service, so an agent outage produces one alert rather than one per watched folder.
• Event handlers: Trigger a script on a state change to clear a spool directory or restart the process that feeds it.

File Monitoring Security and Access

Give the monitoring account read access to the watched paths and nothing more. Do not run file checks as root, and do not grant write access to a directory the check only needs to count.

• SSH key permissions: The authorized_keys file on the target must not be readable or writable by any account other than nagios, or the connection will be refused.
• Scoped sudo: Where a protected path requires elevation, scope the sudoers entry to that one plugin path rather than to the plugins directory.
• Agent credentials: Set a distinct NCPA token per Host and reference it as <NCPA_TOKEN> in shared configuration.
• Role-based access: Restrict which users can see file Services, since a Service name and its output reveal directory structure and naming conventions.

Batch failures stop hiding. An age threshold closes the gap between a job failing and someone noticing to a single check interval, and the alert names the file, so the first responder knows which job to look at.

Capacity planning gets real numbers. File and directory metrics recorded over weeks turn a guess about storage growth into a dated projection.

One console instead of several. The same installation that watches your directories also watches the Hosts, Services, databases, and network devices around them, so a file alert lands next to the CPU spike that explains it.

Extension without replacement. Any script that returns a Nagios exit code and performance data becomes a Service, so an unusual requirement is a plugin to write rather than a tool to evaluate.

• Network path and ports: NCPA on 5693/tcp, NRPE on 5666/tcp, or SSH on 22/tcp from the Nagios XI server to the target. Local directories on the Nagios XI server need no agent.
• Read and traverse permission: The monitoring account must be able to list the directory, stat the files, and traverse every parent directory. This is the most common cause of an Unknown result on a first check.
• Consistent address form for SSH: Whether you authorize the key against an IP address or a DNS name, use the same one in the wizard. Mixing them breaks check_by_ssh.
• A known-good baseline: Record the normal count, age, and size for each directory before setting thresholds, and confirm any network share mount survives a reboot.

1. 1. Prepare access to the target. Install NCPA on the Host holding the files, or set up passwordless SSH for the nagios user if you plan to use the Folder Watch Wizard against a remote Linux or Unix path.
   2. Confirm the check works by hand. Run check_file_age or your chosen plugin on the target against a real path and read the output and exit code. A check that fails here will fail as a Service for the same reason.
   3. Run the wizard. Navigate to Configure > Configuration Wizards, choose the Folder Watch Wizard for directory count, age, and size, or the NCPA Wizard to call a plugin on the agent. Supply the path, the regular expression, and the query type.
   4. Set thresholds from the baseline. Enter Warning and Critical values taken from the directory’s normal numbers, then complete the remaining steps and click Finish to apply the configuration.
   5. Verify and tune. Confirm the new Services return OK, then watch them across a full business cycle including a weekend and a month end before attaching notifications to a contact group.

   Documentation: Understanding And Using Configuration Wizards In Nagios XI | How To Monitor Devices Using NCPA In Nagios XI

Nagios XI monitors file and directory attributes against thresholds you define: count, age, size, presence, and the capacity of the volume underneath. That answers the operational questions, meaning whether the file arrived, whether the queue is moving, and whether the volume has room.

Two adjacent layers work differently. Records of who opened, moved, or edited a file come from operating system audit logging, and those records are log data to collect, index, retain, and search with Nagios Log Server. The traffic carrying large transfers across the network is flow data, which Nagios Network Analyzer reports on. Both are licensed separately from Nagios XI.

Storage and Capacity

• Disk monitoring for volume capacity, mount points, and S.M.A.R.T. status on the storage holding your files.
• Filesystem monitoring for mounted volumes, inode usage, and mount state.
• Hard drive monitoring for drive-level health on the devices behind those volumes.
• NAS and SAN monitoring for the arrays and controllers serving your network shares.

Directories and File Content

• Directory monitoring for folder counts, sizes, and drain rates on spool and queue paths.
• Log file monitoring for alerting on patterns inside files rather than on their attributes.
• System and application log monitoring for operating system and application event streams.

Host and Operating System Monitoring

• Windows server monitoring for CPU, memory, Services, and event logs on the Hosts holding your files.
• Linux monitoring for load, memory, processes, and filesystems on Linux Hosts.
• Server monitoring for the wider Host and Service layer around your file checks.

Pick the three directories where a missing or stale file would cost you the most, record their normal count, age, and size, and set thresholds around those numbers. That is a working file monitoring deployment in an afternoon. If you would rather see it configured against your own directories first, the options below are the fastest way to get there.