AgentVsAgentless BlogHeader

Agent-Based and Agentless Monitoring with Nagios

June 21, 2024

Using agent-based or agentless methods for monitoring has been a debate for IT administrators for an exceedingly long time. Both options provide advantages that can change the way you understand your infrastructure, network, and devices.

One of the key strengths of Nagios XI is that it supports a wide array of approaches for monitoring various operating systems, featuring both agentless and agent-based options.

This flexibility often leads to the natural question, “When should I use an agent-based or agentless monitoring method?” When it comes down to it, there is no absolute right or wrong solution when it comes to monitoring and tracking your data. In the end, the best method for you will depend on a variety of factors that are unique to your deployment and requirements.

In this article, we’ll explore the pros and cons of each option so that you can make an informed decision on the monitoring approach you choose.

Agent-Based Monitoring

Agent-based monitoring is a method of monitoring that requires you to install a lightweight client, or “agent,” on a device, which enables a monitoring solution to run plugins on it to check a variety of granular metrics. These agents help make it easier for businesses to assess a system’s efficiency by executing checks, tracking data, and monitoring the overall health of specific systems, such as Windows or Linux.

XI supports agents covering many different operating systems, including long-running options such as Nagios Remote Plugin Executor (NRPE) and Nagios Cross-Platform Agent (NCPA) which is a modern option that supports Linux, OSX, AIX, and Solaris monitoring.

Nagios Cross-Platform Agent dahsboard and GUI screenshots

The agent-based method is ideal for when you want to collect more granular data about the device being monitored and have more visibility and control over that device. Agent-based monitoring is also more resilient to connectivity issues since they are installed locally instead of being a remote plugin.  

Depending on your resources, this method may not work for your setup, though, because the agent will always require software updates, patches, and overall requires more maintenance than an agentless solution. It also takes up more space on your device which can increase the resource consumption of said device. 

Pros: 

  • Greater monitoring depth with XI may be possible with an agent since you are able to leverage the thousands of free plugins on the Nagios Exchange as well as custom plugins you write to extend the default capabilities. 
  • In addition to running status checks, agents provide a way to run custom remediation scripts on your monitored Hosts for processes such as restarting a stopped Service. These can run either automatically when XI detects a specific status (known as “event handlers“) or proactively by clicking an icon you’ve associated with the action in the Actions component.
  • Both active and passive checks are available with agents. Some agents, like NCPA, support both active and passive checks, which means you can either configure XI to actively check the system on a schedule or configure the system to check itself and send the results upstream back to XI. There are also agents that only support one type of check. For instance, NRPE does not support passive checks.

Cons: 

  • Agents require that you install them on your system, so there would be an additional item to install, manage, and secure. 
  • Since they require something to be installed, it may be more difficult to gain approval from system teams to implement agents. 
  • With the exception of NCPA, which includes a Configuration Wizard to scan your Host for unique characteristics, most agents require that you manually define the drives, Services, and interfaces you wish to monitor.

Agentless Monitoring

Agentless monitoring is a method of monitoring in which you don’t have to install an agent on a Host to monitor its Services. Instead, you utilize a native protocol that the Host supports to run checks. Aside from regular software and firmware updates, this method doesn’t require direct updates. Agentless monitoring can also reduce your deployment time as well as your administrative overhead. One possible drawback to this method, though, is that it is limited to the specific metrics that the native protocol can produce. 

XI supports agentless options such as Secure Shell (SSH), Windows Management Instrumentation (WMI), and Simple Network Management Protocol (SNMP).

Configuration Wizards page in Nagios XI (Neptune Theme)

SSH is a common agentless monitoring option. It is a secure communication protocol that you can use to log in and execute commands on remote servers. Because of these unique characteristics, SSH can be used across multiple operating systems including Windows, MacOS, and Linux.

WMI is an agentless monitoring method that is useful for when you want to run queries on various aspects of your Windows Servers. This popular agentless monitoring method relies on a feature known as the Distributed Component Object Model to communicate from a network to a server since WMI doesn’t have that capability. Since WMI is rarely used nowadays, Nagios XI has a Wizard that utilizes SSH called the Windows SSH Wizard.  

SNMP is highly regarded for its flexibility and durability to monitor nearly anything that’s connected to a network. Some would correctly argue that SNMP should be considered an agent, but for the purposes of this article, we’ll consider “agentless” monitoring to be any method that doesn’t require you to install a separate Nagios agent. 

ICMP ping checks, TCP/UDP port checks, and website checks are other examples of agentless monitoring. 

Pros: 

  • Agentless approaches can help reduce administrative overhead since there is no separate agent to install or manage. 
  • Agentless methods may be easier to get approval to use for system teams since no third-party utilities need to be installed. 
  • XI includes Configuration Wizards for SNMP and SSH that scan Hosts for things like drives and running Services, providing context on the unique characteristics of the Host during monitoring configuration.
  • SNMP traps provide a passive monitoring option, meaning the device will send results upstream to XI, as opposed to an active check where XI contacts the system for data. Traps can also provide real-time results when problems occur. 

Cons: 

  • You will likely still need to take some action on the monitored Host. For example, these actions might include verifying that the WMI Service is running, enabling the SNMP listener, defining credentials, or loading plugins you wish to execute via SSH.
  • With the exception of SSH checks, which can use customized plugins, the available checks would only be those metrics that the native protocol supports. 
  • Agentless methods can introduce a higher load on your Nagios server, so they may not scale as well as agents. Passive agents, however, can significantly reduce the load on the monitoring engine.

As you can see, there are a lot of considerations to take into account when deciding which approach is best for your requirements. In your environment, you can also use a combination of agentless and agent-based techniques. For example, if only a few systems needed custom checks, the others could make use of the options that a native protocol has to offer.  

Choosing a monitoring method that works best for you will require you to ask some tough questions, know your infrastructure well, and keep in mind that the future is always changing. Today’s best practices could become tomorrow’s red flags. Hopefully, the information we provided above will help you as you decide which approach to take in your own environment. 

If you’re more of a visual learner, check out our webinar on this subject.