To see how this is done in Nagios Log Server, check out this tutorial:

Step 1: Add a Log Source in Nagios Log Server

1. Log in to your Nagios Log Server web interface.

2. On the Home page, locate the section for adding log sources.

3. Click the + Windows button to begin the configuration process.

Step 2: Install NXLog CE on Windows Server

1. On the Nagios Log Server Windows Source page, find the Getting Started section and download NXLog CE from the provided link.

2. Run the installer on your Windows Server.

3. Click Next to the Welcome Screen.

3. Accept the License Agreement and click Next

4. Pick the destination folder to install Nagios Log Server (Default C:\Program Files\nxlog\)

5. Click Install:

5. Click Finish after a successful installation.

Step 3: Configure NXLog CE

1. On the Nagios Log Server Windows Source page, locate the Configuration Setup section.

2. Copy the provided configuration code:

Right-click and select Copy.

Click the Select All button in the top-right of the code block.

3. On your Windows Server, open Notepad as an administrator.

4. Open the NXLog configuration file:

• Navigate to C:\Program Files\nxlog\conf\
• Select All Files (.) in the file type dropdown.
• Open nxlog.conf.

5. Paste the copied configuration into the file.

6. Save and close Notepad.

Step 4: Confirm the NXLog Service is running

1. In the Windows Services App. Locate the NXLog service and confirm it’s running.

If not, you can manually start it by right-clicking on NXLog and select Start:

2. You can also run sc query NXLog. Confirm the value of STATE is RUNNING

If needed, you can manually start the service by running net start NXLog.

Step 5: Verify Logs in Nagios Log Server

1. You can verify a successful connection by going back in the Nagios Log Server > Add Log Source > Windows. In the Verify Incoming Logs section. Add the IP Address of your Windows Server and click Verify

2. Now navigate to Home. Under Unique Hosts > select View

3. Select the IP Address/Hostname of your windows server.

4. Confirm Event logs are being received:

Troubleshooting

Check NXLog Configuration File

1. Open C:\Program Files\nxlog\conf\nxlog.conf in Notepad.

2. Ensure the configuration matches the one provided by Nagios Log Server.

3. Look for syntax errors: Run NXLog manually to check for issues:

"C:\Program Files (x86)\nxlog\nxlog.exe" -v

"C:\Program Files (x86)\nxlog\nxlog.exe" -v

4. If any errors appear, correct them in nxlog.conf and restart the service.

Verify Firewall

If logs are not reaching Nagios Log Server, try:

1. On your Windows Server, confirm outbound port 3515 is open by running:

Get-NetFirewallRule -Direction Inbound, Outbound | Get-NetFirewallPortFilter | Where-Object { $_.LocalPort -eq 3515 }

Get-NetFirewallRule -Direction Inbound, Outbound | Get-NetFirewallPortFilter | Where-Object { $_.LocalPort -eq 3515 }

2. To Allow traffic for NXLog on your windows server, which uses by default outbound port 3515:

netsh advfirewall firewall add rule name="Allow NXLog" dir=out action=allow protocol=tcp localport=3515

netsh advfirewall firewall add rule name="Allow NXLog" dir=out action=allow protocol=tcp localport=3515

Enable Debugging in NXLog

If issues persist, enable debugging in NXLog:

1. Open C:\Program Files\nxlog\conf\nxlog.conf

2. Add:

LogLevel DEBUG

3. Restart NXLog:

4. Check logs in: C:\Program Files\nxlog\data\nxlog.log

If you have additional questions or other support-related questions, please visit Nagios Support. The Nagios Support Knowledgebase is also a great support resource.

Alternative Agents

NSClient++ is one of many agents that can be used to monitor Windows devices. This document will
go through the installation and use of NSClient++. However, for ease of use and greater functionality,
Nagios Enterprises recommend using a multi-platform agent called NCPA that can be downloaded for
Windows, Linux, and Mac devices. For more information on NCPA, view the documentation here:

For information on NCPA and Windows Server. See How To Monitor Windows Server with Nagios XI and NCPA.

Step 1: Download the NSCLIENT++ Agent

The NSClient++ agent can be obtained through the following methods:

NSClient++ Official Downloads Page – The agent is available for download at https://github.com/mickem/nscp/releases/.

Nagios XI Web Interface – The agent can be downloaded directly when using the NSClient++ Monitoring Wizard.

Step 2: Install the NSCLIENT++ Agent

Before Nagios can monitor system metrics, services, processes, or performance data on a Windows machine, the NSClient++ agent must be installed and properly configured on the target system.

1. Locate the downloaded .msi installer file and double-click it to launch the installation wizard.

Click Next on the welcome screen to proceed.

2. Select Typical for a standard installation or Custom if advanced configuration is needed.

Click Next to continue.

3. On the Setup Options screen.

In the Allowed Hosts field, enter the IP address of the Nagios XI server to allow communication:

In the Password field, enter a secure password that will be used to authenticate communication between Nagios XI and your Windows server.

Then check the following options:

Enable common check plugins.

Enable NRPE Server (check_nrpe).

Enable NSClient Server (check_nt) (if using legacy Nagios monitoring).

Click Next.

4. Click Install to finish:

Step 3: Configure Nagios XI to Monitor Windows Server via NSClient++

1. Log into Nagios XI.

2. Go to Configure → Configuration Wizards.

3. Select NSClient++ (Legacy):

4. Define the target Windows server:

Click Next to proceed.

5. Configure Monitoring Options.

Enter the NSClient++ password configured in Step 3.

6. Select the system metrics you want to monitor (CPU, memory, disk usage, services, processes, etc):

Click Next.

7. Configure the Monitoring Settings:

The default is set to monitor every 5 minutes. When there is potential problem, it will recheck every one minute up to 5 times before sending a notification.

8. Configure the Notification Settings:

Click Next

9. Add your Windows Server to any Host Groups, Service Groups, or Parent Host:

Click Next.

10. Click Apply to finish configuration:

Step 4: Verify Monitoring

1. Navigate to Views > Host Detail > Select your Windows Server:

2. Confirm your windows machine and the services you’ve selected are being monitored:

Troubleshooting

Firewall

Make sure all ports that need to be open can be accessed from the Nagios XI server

• TCP port 12489 for NSClientServer (Nagios XI Server check_nt > Windows Machine)
• TCP port 5666 for NRPEServer (Nagios XI Server check_nrpe > Windows Machine)
• TCP port 5667 for NSCAClient (Windows Machine > Nagios XI Server)
• TCP port 80 or 443 for NRDPClient (Windows Machine > Nagios XI Server)

You can test if a port is accessible by using the nmap command from the Nagios XI server. Establish a terminal session to your Nagios XI server as root and run the following command:

nmap [windows_machine_ip_address] -p T:12489

nmap [windows_machine_ip_address] -p T:12489

If nmap command output shows the STATE as open, then you have a successful connection to the NSClientT++

If nmap command output shows the STATE as closed or filtered, then NSClient++ is NOT listening on that port or is being blocked by a firewall.

Log File

To troubleshoot issues, you can review the NSCLIENT++ log file nsclient.log typically located
in: C:\Program Files\NSClient++\nsclient.log

If you have additional questions or other support-related questions, please visit Nagios Support. The Nagios Support Knowledgebase is also a great support resource.

SNMP vs. NCPA

Summary:

• Use SNMP if you need basic monitoring without installing an agent.
• Use NCPA if you need in-depth Windows monitoring with strong Nagios integration.

For information on NCPA and Windows Server. See How To Monitor Windows Server with Nagios XI and NCPA.

Step 1: Install SNMP on Windows Server

Method 1: Install SNMP via PowerShell

For a quicker installation, use PowerShell:

Open PowerShell as Administrator.

1. Run the following command:

Add-WindowsFeature SNMP-Service

Add-WindowsFeature SNMP-Service

To install SNMP Tools (optional):

Add-WindowsFeature RSAT-SNMP

Add-WindowsFeature RSAT-SNMP

2. Verify installation with:

Get-WindowsFeature | Where-Object { $_.Name -like "*SNMP*" }

Get-WindowsFeature | Where-Object { $_.Name -like "*SNMP*" }

Method 2: Install SNMP via Server Manager

1. Click on Start, then open Server Manager.

2. Click Add Roles and Features.

3. For Installation Type, choose Role-based or feature-based installation → Click Next.

4. For Destination Server, choose your server → Click Next.

5. Skip the Roles Section, Click Next (SNMP is a feature, not a role).

6. In Features, scroll down to SNMP Service. Check the box for SNMP Service.

(Optional) Select SNMP Tools if you want SNMP utilities for management.

7. Confirm Installation, click Next, then Install.

Wait for the installation to complete.

8. Verify Installation.

Click on Start, then open the Services App.

Look for SNMP Service in the list.

If not running, right-click SNMP Service → Click Start.

Step 3: Configure Windows Server SNMP

Right-click on SNMP Service and select Properties, then the Security tab:

Click Add under Accepted community names.

In the Community Name field, enter nagios (or your preferred community string).

Select Read-Only for minimal access (or Read-Write if needed).

Click OK to save the community string.

Under “Accept SNMP packets from these hosts”, click Add.

Enter the IP Address of the Nagios XI server.

Click Add to save the IP entry.

Click Apply, then OK

Right-click SNMP Service → Click Restart.

Step 4: Configure Nagios XI to Monitor Windows Server via SNMP

1. Log into Nagios XI.

2. Go to Configure → Configuration Wizards.

3. Select Windows SNMP

4. Enter Windows Server SNMP Details.

IP Address: The IP of your Windows Server.

Operating System: If you’re Windows Server is higher than 2019, then select Windows Server 2019.

SNMP Version: Select SNMP v2c (or v3 if configured).

Port: Leave as 161 (default).

SNMP Community String: The same string configured on Windows (e.g., nagios or public).

Click Next.

5. Enter SNMP Monitoring Details.

Choose the metrics you want to monitor, such as:

CPU Usage

Memory Usage

Disk Usage

Network Interface Traffic

Click Next.

6. Configure the Monitoring Settings:

The default is set to monitor every 5 minutes. When there is potential problem, it will recheck every one minute up to 5 times before sending a notification.

Click Next.

7. Configure the Notification Settings:

Click Next.

8. Add your Windows Server to any Host Groups, Service Groups, or Parent Host.

Click Next.

10. Click Finish & Apply to apply configuration.

Step 4: Verify Monitoring

1. Navigate to Views > Host Detail > Select your Windows Server.

2. Confirm your windows machine and the services you’ve selected are being monitored:

Troubleshooting

Confirm SNMP firewall port 161 is open

Confirm SNMP Firewall is open on the Windows Server by running the below command in Powershell:

Get-NetFirewallRule | Where-Object { $_.Name -eq "SNMP-In-UDP" } | 
Select-Object Name, DisplayName, @{Name="LocalPort";Expression={(Get-NetFirewallPortFilter -AssociatedNetFirewallRule $_.Name).LocalPort}}, Enabled, Direction, Action

Get-NetFirewallRule | Where-Object { $_.Name -eq "SNMP-In-UDP" } | 
Select-Object Name, DisplayName, @{Name="LocalPort";Expression={(Get-NetFirewallPortFilter -AssociatedNetFirewallRule $_.Name).LocalPort}}, Enabled, Direction, Action

Confirm that the Enabled is True and Action is Allowed.

If it’s closed, you can enable it by running:

New-NetFirewallRule -DisplayName "Allow SNMP" -Direction Inbound -Protocol UDP -LocalPort 161 -Action Allow

New-NetFirewallRule -DisplayName "Allow SNMP" -Direction Inbound -Protocol UDP -LocalPort 161 -Action Allow

You can also confirm in the Windows Defender Firewall with Advanced Security Setting here:

Wizard detected that server does not have snmpwalk permission

This alert can occur when changes are made the SNMP Service Properties on the Windows Server and a restart of the SNMP service was never performed.

Restart the SNMP Service on the Windows server to see if the issue still occurs.

Please know alerts like this won’t stop a successful configuration.

If you have additional questions or other support-related questions, please visit Nagios Support. The Nagios Support Knowledgebase is also a great support resource.

What is NCPA?

NCPA (Nagios Cross-Platform Agent) is a powerful and flexible monitoring agent that allows Nagios to gather performance metrics from Windows, Linux, and MacOS systems. It helps administrators monitor CPU usage, memory, disk space, processes, and much more with minimal configuration.

Active vs. Passive

NCPA can be used for both Active and Passive monitoring:
• Active = Nagios is responsible for performing the check on a schedule.
• Passive = NCPA is responsible for submitting check results in Nagios.

The NCPA installer may prompt you for settings for active and passive. Active is the most common
method used. If you are not using passive monitoring, then you do not need to configure those
settings.

Graphical vs. Silent

The key differences between a Graphical (GUI) Install and a Silent Install of NCPA lie in user interaction, customization, deployment efficiency, and installation speed. A GUI install involves a step-by-step wizard requiring manual input, making it ideal for users who prefer an interactive approach. It allows customization during installation but is not suitable for large-scale deployments. In contrast, a silent install runs automatically via command-line execution with predefined parameters, making it the best option for mass deployment across multiple servers. While the GUI install is slower due to manual input, the silent install is faster and more efficient, though it requires careful pre-configuration to avoid misconfigurations.

Step 1: Download NCPA

1. Open a web browser and go to the official Nagios NCPA download page.
2. Click on “Download”, then select the Windows version of NCPA.
3. Save the ncpa-latest.exe installer to your preferred location on the Windows Server.

Step 2: Install NCPA

Option A: Graphical Install (Recommended)

To see how this is done in Nagios XI, check out this tutorial:

Follow these steps for a straightforward installation using the graphical interface:

1. Locate the downloaded ncpa-latest.exe file on your machine.

2. Double-click the installer to begin the installation process.

3. The Welcome screen will appear. Click Next to proceed.

4. License Agreement:

• Review the license agreement.
• Click I Agree to accept the terms and continue.

5. Listener Configuration:

• Token: Enter a strong token (e.g., Str0ngTok3n) for API calls, which Nagios will use to connect.
• Bind IP: Leave as 0.0.0.0 to bind to all available IPv4 addresses on the Windows machine.
• Bind Port: By default, it binds to port 5693.
• SSL Version: Choose the version (TLSv1.0–1.2). Default is TLSv1.2.
• Log Level: Set this to warning unless you need additional details for debugging.
  

Click Next to proceed.

6. Setup the Passive Configuration (Optional):

• URL: The URL on your Nagios Host that accepts passive check results.
• NRDP Token: This token will be used for passing passive checks to Nagios. It’s different from the active check token.
• Hostname: Specify the hostname for the passive checks on the Nagios Server.
• Check Interval: How often the passive checks will be sent.

Click Next to proceed.

7. Select Passive Service Checks (Optional):

Default passive service checks will be displayed. You can modify them as required.

Click Next to proceed.


8. Choose User Installation:

Decide whether to install NCPA for just the user account performing the installation or for all users.

Click Next to continue.

9. Choose Installation Directory:

The default installation directory is C:\Program Files (x86)\Nagios\NCPA. You can modify the installation path if needed.

Click Install to proceed.

10. Finish the Installation:

• Once installation is complete, click Finish.

Option B – Silent Install

To perform a silent installation, you’ll use the installer with specific arguments. These arguments are added to the command line to configure the installation.

Arguments Explained

Silent Installation Example Command

In order to use the silent install, you must pass the /S value to the install as shown below.

The /D value is optional, but if included, it must be the last argument, cannot contain quotes, and must be an absolute path.

The below command will set the token in your ncpa.cfg to mytoken. The silent install will start the
NCPA listener and passive services. That’s all you need to do. Below is a reference for all available
configuration options for the silent install.

ncpa-latest.exe /S /TOKEN='mytoken' /<variable>='<value>' /D=<base directory> 

ncpa-latest.exe /S /TOKEN='mytoken' /<variable>='<value>' /D=<base directory> 

Here’s an example command using the arguments above:

ncpa-latest.exe /S /TOKEN='Str0ngT0k3n' /NRDPURL='http://10.25.5.12/nrdp/' /NRDPTOKEN='NRDP_T0k3n' /NRDPHOSTNAME='S1601'

ncpa-latest.exe /S /TOKEN='Str0ngT0k3n' /NRDPURL='http://10.25.5.12/nrdp/' /NRDPTOKEN='NRDP_T0k3n' /NRDPHOSTNAME='S1601'

Step 3: Verify Installation

1. Check the Nagios Cross-Platform Agent:

Press Windows Key + R, type services.msc, and press Enter.

Scroll through the list and locate Nagios Cross-Platform Agent to confirm it’s running.

Alternatively, use Command Prompt:

Open a command prompt and run sc query ncpa

Confirm the STATE of ncpa is RUNNING:

> sc query ncpa

If the service is running, you should see output like this:

SERVICE_NAME: ncpa

TYPE               : 10  WIN32_OWN_PROCESS

STATE              : 4  RUNNING

 (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)

WIN32_EXIT_CODE    : 0  (0x0)

SERVICE_EXIT_CODE  : 0  (0x0)

CHECKPOINT         : 0x0

WAIT_HINT          : 0x0

> sc query ncpa

If the service is running, you should see output like this:

SERVICE_NAME: ncpa

TYPE               : 10  WIN32_OWN_PROCESS

STATE              : 4  RUNNING

 (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)

WIN32_EXIT_CODE    : 0  (0x0)

SERVICE_EXIT_CODE  : 0  (0x0)

CHECKPOINT         : 0x0

WAIT_HINT          : 0x0

Step 4: Test NCPA Installation

1. Open a web browser and navigate to: https://<NCPA_IP_Address>:5693/

2. Bypass the security warning due to self-signed certificates by clicking More Information and selecting Go onto the webpage.

3. On the NCPA login page, enter the API token you configured in Step 2-6 and click Log In.

4. Upon successful login, you will be directed to the NCPA Dashboard.

Step 5: Adding your NCPA to Nagios XI

1. Log into Nagios XI.

2. Go to Configure → Configuration Wizards.

3. Select Windows Server from the list.

4. Enter the Windows Server’s IP Address and the NCPA API Token (from Step 2-6).

5. Select the services to monitor (e.g., CPU, Memory, Disk, Services).

NOTE: The default thresholds for the disk and memory space are a bit low, we recommended changing them to reflect your usage.

Click Next.

6. Configure the Monitoring Settings:

The default is set to monitor every 5 minutes. When there is potential problem, it will recheck every one minute up to 5 times before sending a notification.

Click Next.

7. Configure Notification Settings:

Click Next.

8. Add your Windows Server to any Host Groups, Service Groups, or Parent Host:

Click Next.

9. Click Finish and Apply to finalize the configuration, or select Save as Template to use the same settings for future Windows servers:

Step 6: Confirm Monitoring of Windows Server on Nagios XI

1. On Nagios XI. Navigate to View > Host Detail.

2. Select the Host in question:

3. Confirm services are being monitored:

Troubleshooting

Confirm firewall ports are open

NCPA by default uses port 5693. You can confirm this port is open by running netstat -an | findstr :5693

If port 5693 is open and listening, you will see output like:

NCPA expected to open this port during installation. If needed, the below command can be used to open it manually:

netsh advfirewall firewall add rule name="Allow Port 5693 Inbound" dir=in action=allow protocol=TCP localport=5693

netsh advfirewall firewall add rule name="Allow Port 5693 Inbound" dir=in action=allow protocol=TCP localport=5693

Error opening file (servicemanager.pyd)

Example of Error:

This issue can occur if NCPA was previously uninstalled, but a reboot was never performed. Reboot your Windows server and retry the install.

NCPA Installs, but fails to start after reboot

Check if Windows Event view for:

A timeout was reached (30000 milliseconds) while waiting for the Nagios Cross-Platform Agent service to connect.

The Nagios Cross-Platform Agent service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

If so, then set the Nagios Cross-Platform Agent to Startup Type of Automatic (Delayed Start)

Press Windows Key + R, type services.msc, and press Enter.

Right-click on Nagios Cross-Platform Agent and select Properties

Select the Startup type drop down box and select Automatic (Delayed Start).

Click OK.

If you have additional questions or other support-related questions, please visit Nagios Support. The Nagios Support Knowledgebase is also a great support resource.