How To Monitor Windows Server with Nagios XI and NSCLIENT++

NSClient++ is an open-source monitoring agent for Windows systems that enables Nagios XI and other monitoring tools to collect system performance data, check service statuses, and monitor event logs. It supports multiple communication protocols such as NRPE, NSCA, check_nt, and REST API, allowing remote monitoring of CPU usage, memory, disk space, and running services. NSClient++ can also execute custom scripts, monitor log files, and send alerts when predefined thresholds are exceeded. By acting as a bridge between Windows servers and Nagios XI, it ensures proactive system monitoring and alerting for critical infrastructure components.

Alternative Agents

NSClient++ is one of many agents that can be used to monitor Windows devices. This document will
go through the installation and use of NSClient++. However, for ease of use and greater functionality,
Nagios Enterprises recommend using a multi-platform agent called NCPA that can be downloaded for
Windows, Linux, and Mac devices. For more information on NCPA, view the documentation here:

For information on NCPA and Windows Server. See How To Monitor Windows Server with Nagios XI and NCPA

---

Step 1: Download the NSCLIENT++ Agent

The NSClient++ agent can be obtained through the following methods:

NSClient++ Official Downloads Page – The agent is available for download at https://github.com/mickem/nscp/releases/

Nagios XI Web Interface – The agent can be downloaded directly when using the NSClient++ Monitoring Wizard.

---

Step 2: Install the NSCLIENT++ Agent

Before Nagios can monitor system metrics, services, processes, or performance data on a Windows machine, the NSClient++ agent must be installed and properly configured on the target system.

1. Locate the downloaded .msi installer file and double-click it to launch the installation wizard.

Click Next on the welcome screen to proceed.

2. Select Typical for a standard installation or Custom if advanced configuration is needed.

Click Next to continue.

3. On the Setup Options screen,

In the Allowed Hosts field, enter the IP address of the Nagios XI server to allow communication:

In the Password field, enter a secure password that will be used to authenticate communication between Nagios XI and your Windows server.

Then check the following options:

Enable common check plugins

Enable NRPE Server (check_nrpe)

Enable NSClient Server (check_nt) (if using legacy Nagios monitoring)

Click Next

4. Click Install to finish:

---

Step 3: Configure Nagios XI to Monitor Windows Server via NSCLIENT++

1. Log into Nagios XI.

2. Go to Configure → Configuration Wizards.

3. Select NSCLIENT++ (Legacy)

4. Define the target Windows server:

Click Next to proceed

5. Configure Monitoring Options.

Enter the NSCLIENT++ password configured in Step 2.3

6. Select the system metrics you want to monitor (CPU, memory, disk usage, services, processes, etc)

Click Next.

7. Configure the Monitoring Settings:

The default is set to monitor every 5 minutes. When there is potential problem, it will recheck every one minute up to 5 times before sending a notification.

8. Configure the Notification Settings

Click Next

9. Add your Windows Server to any Host Groups, Service Groups, or Parent Host

Click Next.

10. Click Apply to finish configuration

---

Step 4: Verify Monitoring

1. Navigate to Views > Host Detail > Select your Windows Server

2. Confirm your windows machine and the services you’ve selected are being monitored:

---

Troubleshooting

Firewall

Make sure all ports that need to be open can be accessed from the Nagios XI server

• TCP port 12489 for NSClientServer (Nagios XI Server check_nt > Windows Machine)
• TCP port 5666 for NRPEServer (Nagios XI Server check_nrpe > Windows Machine)
• TCP port 5667 for NSCAClient (Windows Machine > Nagios XI Server)
• TCP port 80 or 443 for NRDPClient (Windows Machine > Nagios XI Server)

You can test if a port is accessible by using the nmap command from the Nagios XI server. Establish a terminal session to your Nagios XI server as root and run the following command:

nmap [windows_machine_ip_address] -p T:12489

If nmap command output shows the STATE as open, then you have a successful connection to the NSCLIENT++

If nmap command output shows the STATE as closed or filtered, then NSClient++ is NOT listening on that port or is being blocked by a firewall.

Log File

To troubleshoot issues, you can review the NSCLIENT++ log file nsclient.log typically located
in: C:\Program Files\NSClient++\nsclient.log

If you have additional questions or other support-related questions, please visit Nagios Support. The Nagios Support Knowledgebase is also a great support resource.