On March 14, 1999, Ethan Galstad released NetSaint 0.0.1. He thought about a dozen people would care. The thing pinged hosts, ran plugins, sent email and pager alerts when a service went down — and again when it came back. In 2002 the name became Nagios: “Nagios Ain’t Gonna Insist On Sainthood,” hagios = saint, because NetSaint ran into a trademark issue. Twenty-seven years later, Nagios Core 4.5.14 (August 5, 2026) is still GPLv2, still C, still the way an entire generation of Linux admins learned to watch over machines. The handwritten N on the cover is the same crooked design as always.
1996: a ping in DOS and a pager
Galstad, in the USA, wrote a small MS-DOS program to ping Novell NetWare servers and trigger numeric pagers. The check and the notification already came from a third-party tool — the seed of the plugin model. In 1998 he considered hosted monitoring and rewrote it for Linux. In March 1999 he opened the source. The plugins left the tarball shortly afterward and became a separate project: today it is still nagios-plugins / Monitoring Plugins. Without that separation — a simple binary that only schedules, and an army of check_* — Nagios would not have become a standard.
2002: the saint that did not insist
A similar trademark, a lawyer, an agreement. Galstad changed the name anyway. Nagios is pronounced “nah-gee-oss.” The architecture stayed: a C daemon, text files as the source of truth (nagios.cfg, hosts.cfg, services.cfg), Perl/C CGI on Apache, OK / WARNING / CRITICAL / UNKNOWN states, hard/soft states, flap detection, per-contact notifications. NRPE to check Linux from the inside. NSCA for passive checks (the host pushes them). Anyone who has manually configured 400 hosts remembers the point: Nagios does not draw graphs. Nagios shouts.
In June 2005 it was SourceForge's Project of the Month. In 2006 eWeek put it on its list of enterprise “must have” tools. There was no company yet. There was Ethan and the mailing list.
2.0, 3.0, 4.0: NEB, scale, Core
Nagios 2.0 (February 2006): a new interface and the Event Broker (NEB) — an API allowing modules to inspect internal structures. NDOUtils came out of that (state in MySQL), followed by what XI and Centreon built on. Nagios 3.0 (March 2008): adaptive monitoring and capacity for large installations. Nagios 4 (2014) rewrote the scheduler: less CPU for the same number of checks.
Around 2007 Galstad founded Nagios Enterprises. Core remained GPLv2. The paid product — Nagios XI, followed by Log Server, Network Analyzer, Fusion — stacks interfaces, wizards, reports, and support on top of the same engine. Open core before the trend had a name. In 2024 the company turned 25. XI, Log Server, Analyzer, and Fusion are already on the 2026R1 line. World Conference 2026 is in St. Paul, Minnesota, September 14–17, at headquarters.
The split: Icinga, Naemon, Checkmk
In 2009 part of the community — tired of the pace and the dividing line between what was free and what went into XI — forked it. That created Icinga. Then came Naemon (2014), a fork of Core 4. Mathias Kettner's Check_MK (now Checkmk) started as a set of plugins and became a product. Centreon, Shinken, Opsview. The plugin API was so simple that the entire ecosystem fits in a check_disk -w 20% -c 10%. The cost: file-based configuration that does not scale without tooling. The solution is NagiosQL.
What Nagios taught us
- Hosts and services are objects. Dependencies (parents) prevent an alert storm when a switch goes down.
- A check is an external process. Any language. Timeout. Exit code 0/1/2/3.
- Notifications have time windows, escalation, downtime, and acknowledgement.
- The CGI status map — the little green and red boxes — is the look of an era. Grafana did not exist.
The Zabbix took the other route: items in a database, an agent that collects, triggers that evaluate, native graphs. Prometheus, on this blog, is the third way: pull, metrics, Node Exporter.
2026: Core 4.5.14, XI 2026R1
Core 4.5.14 came out on August 5, 2026. GitHub NagiosEnterprises/nagioscore. NRPE 4.x is still the classic way to talk to Linux. Distros package 4.4/4.5. XI 2026R1.4 gained Nutanix and switch wizards. It is not the engine of the cloud — Zabbix and Prometheus took that territory — but in the NOC of a company that already has a thousand .cfg, the N is not going anywhere.
Nagios in practice, in five minutes
History aside, the engine still installs and runs with two commands. On Debian or Ubuntu:
sudo apt update
sudo apt install nagios4 monitoring-plugins nagios-nrpe-plugin
The configuration is what the whole series taught us to hate and love: text files are the source of truth. Everything lives in /etc/nagios4/, and every monitored thing is an object. A new host fits in eight lines:
define host {
use generic-host
host_name servidor-web
address 192.168.0.20
max_check_attempts 3
}
define service {
use generic-service
host_name servidor-web
service_description Espaco em disco
check_command check_disk!20%!10%!/
}
That check_disk!20%!10%!/ is the soul of the project: Nagios does not know what a disk is. It just calls an external program, passes arguments separated by ! and checks the exit code — 0 is OK, 1 is WARNING, 2 is CRITICAL, 3 is UNKNOWN. Anything that respects that contract becomes a check, in any language:
# rodando um plugin na mão, como o daemon faria
/usr/lib/nagios/plugins/check_disk -w 20% -c 10% -p /
echo $? # 0 = OK, 1 = WARNING, 2 = CRITICAL, 3 = UNKNOWN
# um "plugin" seu funciona igual: escreva o arquivo abaixo em
# /usr/lib/nagios/plugins/check_meu e marque como executavel
#
# #!/bin/bash
# if pgrep -x meu-daemon >/dev/null; then
# echo "OK - rodando"; exit 0
# fi
# echo "CRITICAL - parado"; exit 2
sudo chmod +x /usr/lib/nagios/plugins/check_meu
/usr/lib/nagios/plugins/check_meu; echo $?
Before reloading, validate — Nagios refuses to start with a broken configuration, and the validator points to the file and line:
sudo nagios4 -v /etc/nagios4/nagios.cfg
sudo systemctl reload nagios4
To check from inside a remote server — load, memory, processes, things ping cannot see — install NRPE on the target and call it from outside with check_nrpe. That is the active model. When the target is behind NAT or a firewall and needs to initiate communication itself, reverse the flow with NSCA: the host pushes the result to the server. Two mechanisms, the same exit-code idea.
Timeline
- 1996 — Ethan Galstad writes an MS-DOS program that pings NetWare servers and triggers numeric pagers.
- 1998 — the idea becomes hosted monitoring and is rewritten for Linux.
- 14/03/1999 — NetSaint 0.0.1 is released as open source.
- 2002 — a trademark conflict forces a name change: Nagios is born, “Nagios Ain’t Gonna Insist On Sainthood.”.
- Jun/2005 — Project of the Month on SourceForge.
- Feb/2006 — Nagios 2.0 introduces the Event Broker (NEB), the API that would pave the way for NDOUtils, XI, and Centreon.
- 2007 — Galstad founds Nagios Enterprises; Core remains GPLv2 and XI emerges as a paid product.
- Mar/2008 — Nagios 3.0: adaptive monitoring and capacity for large installations.
- 2009 — part of the community forks the project and creates Icinga.
- 2014 — Nagios 4 rewrites the scheduler; around the same time Naemon appears, a fork of Core 4.
- 2024 — Nagios Enterprises turns 25.
- 05/08/2026 — Nagios Core 4.5.14 is released, still in C and still GPLv2.
Wrap-up
A ping in DOS, a saint that lost its trademark, and a daemon that only schedules plugins. The next generation forked it. The company made XI. Core, GPLv2, still responds nagios -v /etc/nagios/nagios.cfg. 4.5.14, St. Paul, pager at the beginning, webhook at the end. The underlined N is still crooked on purpose.
The GUI that writes the cfg: NagiosQL. The Latvian rival: Zabbix.