But I will often tell people not to forget business use cases. There are scenarios where it may make sense to create a grouping that doesn’t make technical sense, but it does make business sense. Let’s look at 3 examples of business-related use cases for using Host groups.

1. Compliance & Audit Readiness

Many industries, such as healthcare, finance, and e-commerce, require strict compliance with regulations such as HIPAA, PCI-DSS, SOC 2, and GDPR. Using Host groups in Nagios Solutions can help organizations meet these compliance requirements by:

• Grouping Compliance-Critical Servers
  • Example: A business handling credit card transactions can create a Host group for all PCI-DSS compliant servers to ensure continuous monitoring for security threats.
• Applying Security and Performance Policies
  • Assigning specific monitoring checks (e.g., intrusion detection, encryption verification, log integrity) only to the systems that require them.
• Audit and Reporting
  • Simplifying audits by generating reports focused only on compliance-related infrastructure, reducing the time needed for compliance verification.
• Automated Alerts for Violations
  • Setting up notifications when a compliance-related server goes out of the expected state, such as an expired SSL certificate or an unapproved software version.

2. Cost Optimization & Budgeting

Host groups can be used to track infrastructure costs and optimize resource allocation based on business needs:

• Tracking Infrastructure Usage by Cost Centers
  • Grouping cloud-based servers used by different business units (e.g., Marketing, Sales, Engineering) to identify high-cost areas.
• Identifying Underutilized Resources
  • Monitoring CPU, RAM, and disk usage trends in Host groups to detect over-provisioned resources that can be downsized.
• Budgeting for IT Expenses
  • IT teams can allocate specific Host groups to budget forecasting tools, helping to predict future scaling costs.
• Energy and Resource Savings
  • Monitoring data center power consumption per Host group (e.g., production vs. backup servers) to optimize energy usage and reduce costs.

3. Business Continuity & Disaster Recovery

Ensuring high availability and quick recovery from system failures is crucial for business continuity. Host groups in Nagios help by:

• Defining Critical vs. Non-Critical Systems
  • Example: Grouping mission-critical applications separately from non-essential services to prioritize restoration efforts during outages.
• Automating Disaster Recovery Monitoring
  • Monitoring failover systems and backup data centers to ensure they are always ready to take over in case of a primary system failure.
• Redundancy & Load Balancing
  • Grouping servers based on redundancy (e.g., active vs. standby nodes) to monitor load balancing effectiveness.
• Real-Time Alerts for Business Impact Analysis
  • If an entire Host group related to a key function (e.g., payment processing) fails, automated alerts can trigger business impact analysis procedures.
• Ensuring SLA (Service Level Agreement) Compliance
  • Monitoring downtime per Host group to ensure contractual SLAs with customers and partners are met.

Maximizing the Value of Host Groups with Nagios XI Visualizations

When considering business use cases for Host groups, don’t forget the visualizations in Nagios XI. You can create reports and dashboards showing the state of these groups to the interested parties. Doing so will enable Nagios XI to add value to the IT team by monitoring the environment and to the business team by allowing them to make better-informed decisions, faster.

Final Thoughts

When setting up Nagios XI, it’s crucial to think about how Host groups can be used beyond the technical scope. By considering business-related use cases, you can improve compliance management, cost optimization, and disaster recovery planning. The combination of flexible grouping, monitoring, and visualization tools in Nagios XI enables both IT and business teams to work together more effectively.

Happy monitoring!

Start Monitoring Nagios XI Servers

Monitoring your Nagios XI server is a breeze using the built-in Nagios XI Monitoring Wizard. It provides easy access a variety of key application metrics that you’ll want to keep an eye on, monitored via XI’s REST API :

• Nagios XI Web Interface – checks the availability of the web UI
• Monitoring Daemons – ensures that the monitoring engine and supporting daemons (nagios and npcd) are running
• Monitoring Jobs – ensures that core monitoring jobs are running
• Load – 1, 5, and 15 minute CPU load averages
• I/O Wait – measures disk read/write times

It’s also recommended to monitor standard items such as memory, drivespace, interface bandwidth, and CPU usage, as well as key system services such as mysqld/mariadb, crond, and apache (httpd). In this article we’ll use NCPA (the Nagios Cross Platform Agent) and built-in monitoring wizard to easily configure monitoring of these items.

It’s also worth using your production XI server to monitor the XI server you monitor your other Nagios servers with. This best practice will ensure that both servers are being checked for availability.

For Nagios Core servers, you’ll want to monitor the nagios service and httpd, along with the same server performance metrics.

Monitoring Nagios Log Server

In addition to standard performance metrics like CPU, memory, and drivespace, you’ll also want to monitor critical system services such as elasticsearch and logstash. For added power, you can create a BPI group for your cluster for intelligent monitoring and root cause analysis of issues.

If the NCPA agent is used, you’ll also notice a couple of built-in plugins at the bottom of Step 2 of the wizard that can be used to monitor cluster status and JVM heap data.

Monitoring Nagios Network Analyzer

In addition to key server performance checks, some critical Nagios Network Analyzer system services are nagiosna, mariadb/mysql, and httpd:

Monitoring Nagios Fusion

On your Fusion server, monitoring of mariadb/mysqld and httpd services is important, along with standard system performance metrics:

Use the Force: Set Up Custom Alerts and Dashboards

Once you’ve set up monitoring of your Nagios servers, the next step will be to set up alerts so you and your team will know when problems occur.

You can also set up custom Dashboards for a quick visual reference of how your Nagios deployment is running, such as this one:

Here’s a video from Mahad on creating Dashboards in Nagios XI in case you’re looking for details on setting them up:

Be Proactive: Capacity Planning, Automated Actions & Real-Time Insights

In addition to monitoring the current health of your Nagios servers, you can take things a step further by leveraging other great features of Nagios XI, such as Capacity Planning, Actions, Event Handlers, and the NCPA Web UI:

• Capacity Planning empowers you to project future usage based on the historical performance data you collect, and graph the results. Those results can be reviewed as needed, added to Dashboards for quick access to specific projections you want to keep tabs on, and even alerted on using the Capacity Planning Wizard. This powerful feature is part of the Enterprise Edition of XI. Here’s a video from Vadim that will help you quickly understand Capacity Planning:

• Actions enable you to set up clickable icons in the Host and Service Status Detail pages of XI, which can be set to do useful things like execute scripts (for example, to restart a system service) and direct users to URLs.
• Event Handlers are another option worth exploring, providing you with the ability to automatically execute scripted remediation actions when problems are detected.
• The NCPA Web UI provides access to real-time performance graphs and top processes data on each system you monitor with this powerful agent:

Nagios Licensing Considerations

One great option is the free 7 Node (Host)/ 100 Total Check (Hosts + Services) license of Nagios XI. To leverage this approach, simply set up a fresh install of Nagios XI, then navigate to Admin -> System Config -> License Information and select the Free (self supported) option.

We also offer smaller licenses like the 50 Node if your requirements exceed the limits of the free license.

Whatever licensing approach you choose, taking the time to set up monitoring of your Nagios servers is an important best practice that will help make sure your Nagios deployment is ready and running when you need it most, and by extension keep the rest of your environment spinning like a top.

But did you know that Nagios XI also provides a built-in way to execute scripts and navigate to URLs by clicking on icons in the Quick Actions section of your Hosts Status and Service Status Detail pages? In this article we’ll take a look at the powerful Nagios XI Actions component.

Setting Up Your Actions

To begin setting up your custom Actions, navigate to Admin -> System Extensions -> Manage Components -> Actions, and click the gear icon:

Here you can view, create, and edit your Actions. You’ll notice that a couple of simple example Actions are already present, designed to run a Google search for your Host Names or Service Names, and a button at the bottom of the menu to add a row (+ Add Row), which you’ll click to add a new Action.

In this article we’ll use the example of Actions which will start and stop the spooler service on a Windows host we’re monitoring with NCPA (the Nagios Cross Platform Agent):

For Object Type, we’ve selected ‘Service’, so that our icon will appear on any Nagios services that match our other settings. For Host, we’ve selected a Windows host, placing the Host Name between forward slashes. For Service, we’ve selected the ‘Spooler’ Service Name on the Windows host, also between forward slashes. Note that you can also choose to apply the Action to entire Hostgroups and Servicegroups to quickly add an icon and function to many objects.

Action Text defines how our icon will be labelled in Status Detail pages it appears on. For Action Type we’ve selected ‘Command’, so that XI knows we wish to execute a command when our Action icon is clicked. Just below in the URL/Command field, we’ve added: /usr/local/nagios/libexec/check_ncpa.py -H 192.168.123.45 -P 5693 -t sometoken -M 'plugins/start_service.bat' -a spooler

This command executes the check_ncpa.py plugin with all of the arguments that follow. Of course in your commands, you’ll want to include your own Windows IP address after -H, your own token after -t, the name of the plugin you wish to execute via check_ncpa.py after -M, and the name of the system service to restart after -a in the event that you’re executing the plugin via NCPA. You can also restart Windows services with NRPE on NSClient++, Linux services with NCPA or NRPE, or with no agent at all using methods like SSH, so there are many options.

The restart_service.bat script we wish to execute lives in: C:\Program Files\Nagios\NCPA\plugins on our Windows host, and contains the following text:

@echo off
net start %1
@exit 0

@echo off
net start %1
@exit 0

The -a argument we pass when XI executes the check_ncpa.py plugin will take the place of the %1 portion of our script, in this case spooler.

Finally, in the Code section on the far right of our Action settings, we’ve pared down the example code as follows:

if ('%servicestateid%'!='0') {
    $img = '/nagiosxi/images/wizardwand.png';
    $showlink = true;
} else {
    $showlink = false;
}

if ('%servicestateid%'!='0') {
    $img = '/nagiosxi/images/wizardwand.png';
    $showlink = true;
} else {
    $showlink = false;
}

We removed the leading and trailing /* and */ to uncomment the code, and set it so that if the state of the service (the %servicestateid% macro, see pages 12 and 13 of the guide for a complete list) is either warning or critical, the icon will appear. However, if the state of the service is OK, the icon will be hidden. In Nagios, an OK state returns a 0, a Warning state a 1, and a Critical state a 2. So, !='0' means any state other than 0/OK will make our icon appear.

Alternately, to make the icon appear if the system service is in an OK state (for example if you wanted an option to stop one that was currently running), you would use ('%servicestateid%'=='0'). For our icon, we’ve chosen wizardwand.png. There are a wide variety of icons you can choose from in the following directory: /usr/local/nagiosxi/html/images

Some that are well-suited for use in your custom Actions are:

d_restart.gif, d_start.gif, d_stop.gif, editsettings.png (a wrench), eye.png, server_go.png,
transmit.png, transmit_add.png, transmit_go.png, transmit_delete.png, wizardwand.png,
lightning.png

Although many are sized correctly to work as Actions icons, the following are too large and will cause issues, so should be avoided:

apple-touch-icon.png, apple-touch-icon-precomposed.png, close_large.png,
close_large_hover.png, config_wizard.png,favicon-32.32.png, footer_lodyas.png,
footer_lodyas_dark.png, glyphicons-halflings.png, glyphicons-halflings-white.png,
loginsplash.png, nagios_critial_larg.png, nagios_logo_white.transbg.png, nagios_ok_large.png,
nagios_pending_large.png, nagios_unknown_large.png,nagios_warning_large.png,nagiosxi-logo
small.png, pending_medium.png, shattered.png, tacdisabled,png, tacdisabledi.png,
tacdisabledu.png, tacenabled.png, tacenabledu.png, techsupport-splash.png, techsupport
splash2.png

Simply replace wizardwand.png in the above snippet with the name of whichever icon you’d like to use to customize your Actions icon. Once your settings are in place, make sure that the Enable custom actions in Nagios XI checkbox is clicked at the top of the menu, that the Enabled checkbox is clicked for your new Action, and then click Apply Settings at the bottom of the menu.

Take Action!

Now that we’ve set up our Action, let’s see it…in action! Here’s a look at the ‘Spooler’ Service Status Detail page when the Windows service is found to be stopped. As you can see, a ‘Start Spooler’ action with a wizard wand icon is now available in the Quick Actions section:

To restart spooler, all we need to do is click the icon. This will execute our service_restart.sh script, and a new tab will open showing us the output:

Adding to this example, we’ve also set up a second Action to stop spooler when it is running. The Code section of our Stop Spooler action is much like our Start Spooler code, but is looking for a an OK/running state, and is using the lightning.png icon:

if ('%servicestateid%'=='0') {
$img = '/nagiosxi/images/lightning.png';
$showlink = true;
} else {
$showlink = false;
}

if ('%servicestateid%'=='0') {
$img = '/nagiosxi/images/lightning.png';
$showlink = true;
} else {
$showlink = false;
}

Our Command is almost identical, but is calling a stop_service.bat script rather than a start_service.bat script which contains:

@echo off
net stop %1
@exit 0

@echo off
net stop %1
@exit 0

Actions URLs

The Actions component can also be used to add a clickable link to any URL you wish in your Status Detail pages. For example, linking to internal Knowledge Base resources related to the monitored object, a ticketing interface, or the webpage being monitored in the case of website monitoring. This guide explains how to set up Actions URLs, a quick and easy process.

Since Actions can execute anything you can script for, and link to external URLs, the possibilities are virtually endless! The Nagios XI Actions component is sure to prove valuable by helping you carry out common management and remediation tasks on your monitored systems and applications with the click of a button.

Being the victim of a cyberattack may seem like something that only happens in the news, but it can happen to anyone. Many companies have suffered cyberattacks this year, such as AT&T and Ticketmaster, according to CBS News, and yours could be next if you don’t fortify your systems for the holiday season.

While Nagios Monitoring Solutions aren’t cybersecurity tools, they can help you strengthen your IT infrastructure against malicious attacks. For a deeper look into how Nagios can support your cybersecurity efforts, read our other article Supporting Cybersecurity with Nagios Monitoring Solutions.

Supporting Cybersecurity with Nagios Monitoring Solutions During the Holiday Season

Nagios XI

Nagios XI, our enterprise-grade IT infrastructure monitoring solution, can help protect you against cyberattacks through its ability to monitor and alert on nearly anything. XI can alert you when there are indicators of a possible attack, including unexpected file updates or changes in file size. With Configuration Wizards, you can also easily configure XI to monitor website defacement and operating system error logs. For example, when you monitor your website for defacement, you can input specific strings you do not want to appear on your website. If XI finds one of those strings on your website, it will notify you so you can quickly jump into action and resolve the issue.

Nagios Log Server

Nagios Log Server, our log monitoring solution, also helps with cybersecurity because it can store large amounts of log data and provides you with the ability to audit, report, and alert on it. These capabilities are important for your cybersecurity because they enable you to inspect your log data to identify or prevent security issues.

For instance, if you want to view the activity logs on an individual workstation to check data on access or permission attempts, Log Server can create an audit trail for you with its reporting feature. With near-instant alerting, Log Server also enables you to react quickly to any issues arising in your log data to speed up the time it takes to resolve an issue.

Log Server can also integrate with Nagios XI so you, or rather XI, can take action based on the log data it receives. By using this integration, you can create event handlers in XI to auto-remediate certain issues in your IT infrastructure based on log data it receives from Log Server. One example of how you can utilize this integration is if Log Server detects suspicious login attempts on a server, it can trigger an alert as well as an event handler in XI to will stop a running Service. As a result, you are able to prevent your IT environment from being compromised by someone who is trying to access your system.

Nagios Network Analyzer

Nagios Network Analyzer can help with cybersecurity as well because it monitors your network traffic and bandwidth and alerts you when critical thresholds for them are breached. With insight into both of these important parts of your network, you have the power to expose potential threats if they arise.

Whether abnormal activity is happening in your network or bandwidth usage is exceeding thresholds, you will be aware of whenever it happens because Network Analyzer will alert you and enable you to start investigating what’s happening. It’s essential you are aware of when these kinds of activity happen because these can indicate a malicious actor is inside your network. With an alert from Network Analyzer, however, the malicious actor won’t be in there long.

By integrating Nagios solutions into your cybersecurity strategy, you will have greater insight into what is happening in your IT infrastructure so you can avoid being part of the 86% during this holiday season.

How To Configure Custom Variables

Custom variables can be created on an individual host or service, or they can be configured in a host or service template.

To start off, let’s look at how to create custom variables. In this example, we will add them to a host in Nagios XI interface.

1. Hover over the gear icon on the left menu, and select the Core Config Manager.
2. In the Core Config Manager, click on Hosts.
3. Select a host you want to give custom information. This will bring you to the Host Management screen.
4. In this screen, select the Misc Settings tab, and then click on the Manage Custom Variables button in the right column. This will bring up a Manage Custom Variables window.
5. Here you have a Name field and a Value field.
   • Things to keep in mind when filling out the Name field
     • The beginning of the variable name should always be an underscore ( _ )
     • It is best practice for the variable names to be all lower case, or all upper case
     • Avoid special characters like spaces, and ampersands
6. With those in mind, let’s create a variable named _ncpa_token.
   • You can see here I used an underscore in place of a space.
7. For the Value, we’ll want whatever the host’s NCPA token actually is. In my case, I use a super secure token, ‘ASecretToken’.

Ideas For Using Custom Variables

Custom Variables can be referenced in host or service checks, Event Handlers, and through Nagios XI’s API. Any piece of information you think is relevant to the host or service can be placed via a custom variable. It might be a Dell service tag ID for a server or maybe the Windows service name of a service you are monitoring, for use with an Event Handler to attempt to restart the service.

Custom variables can be assigned to hosts or services. Personally, I’m a fan of assigning variables to hosts, because you can create a generalized service check referenced by multiple hosts (typically known as Hostgroup Inheritance). Then when Nagios runs a service check for any host with the specific custom variable, it will pull the custom variable from the host and insert it into the service check.

Note: In the previous image, the variables were defined like, _ncpa_port, lower case, with an underscore in front. When referencing the variables, it’s _HOSTNCPA_PORT, capitalized with underscore host in front denoting it is a custom variable defined at the host level.

This type of setup will add a ton of value for:

• Customers who need a different secret token for each system running NCPA
• Customers who are utilizing Hostgroup Inheritance
• Customers who need or want certain data to be available at a couple of clicks

When looking at dashboards in Nagios XI, you may find a host has gone down. Depending on the dashlet you are looking at, you can click into the host and see all of the custom variables you have defined for the host. This can be very useful for network operation centers where you may have a process for ordering replacement hardware for your servers. Not having to access another application to get the system’s manufacturer ID number could help System Administrators get parts ordered faster.

Additionally, automating workflows based around the status of a given host or its service checks could be created by pulling custom variable information from Nagios XI’s API. For example, host variables for Ansible could be defined as custom variables in Nagios XI. Then Ansible could use Nagios XI as an Ansible inventory source, and have connection information centralized in Nagios XI.

With custom variables, the only limitation is your imagination!

This document is intended for use by Nagios XI Administrators that have unsecured Active Directory component working but want to transition to using SSL.

Using SSL with Nagios XI Active Directory – 2024 & 2026

Using SSL with Nagios XI 2026 Active Directory

Using SSL with Nagios XI Active Directory – v5 (Legacy)

Using SSL with XI 5 Active Directory

This document is intended for use by Nagios XI Administrators who want to automate restarting of problematic services on their Windows machines. A basic knowledge of NCPA is recommended.

Restarting Windows Services with NCPA in Nagios XI – 2024 & 2026

Restarting Windows Services With NCPA in XI 2026

Restarting Windows Services with NCPA in Nagios XI – v5 (Legacy)

Restarting Windows Services With NCPA in XI 5