How to monitor a Windows host with NCPA in Nagios Core

Windows servers can expose CPU, memory, disk, and service metrics to Nagios Core through NCPA without enabling Windows remote management. Active checks keep scheduling and alerting on the Nagios server while the Windows agent answers token-protected HTTPS API requests.

The Nagios side uses check_ncpa.py to call the NCPA listener on port 5693. The Windows side must already have NCPA installed, a non-default token set during install, and a firewall rule that allows the monitoring server to reach the listener from the monitoring network.

Store the NCPA token in a Nagios resource macro so object definitions can reference it without repeating the secret in every host and service file. The finished check should pass manually as the nagios user, load the Windows objects without pre-flight errors, and show the memory service result in the web UI after reload.

Steps to monitor a Windows host with NCPA active checks:

Install Python 3 and curl on the Nagios server.
```
$ sudo apt-get update && sudo apt-get install --assume-yes python3 curl
```
check_ncpa.py runs with Python 3. curl downloads the plugin from the upstream NCPA repository.
Download check_ncpa.py into the Nagios plugin directory.
```
$ sudo curl --fail --location --silent --show-error \
  --output /usr/lib/nagios/plugins/check_ncpa.py \
  https://raw.githubusercontent.com/NagiosEnterprises/ncpa/master/client/check_ncpa.py
```
Package installs on Ubuntu and Debian normally use /usr/lib/nagios/plugins. Source installs often use /usr/local/nagios/libexec; place the file in the directory referenced by the local $USER1$ resource macro.

Make the plugin executable.

$ sudo chmod 755 /usr/lib/nagios/plugins/check_ncpa.py

Run a memory check from the Nagios server as the nagios user.

$ sudo -u nagios python3 /usr/lib/nagios/plugins/check_ncpa.py -H win01.example.net -t 'strong-ncpa-token' -P 5693 -M memory/virtual -u G -w 80 -c 90
OK: Used memory was 43.20 % (Available: 9.09 GB, Total: 16.00 GB, Free: 9.09 GB, Used: 6.91 GB) | 'percent'=43.20%;80;90; 'used'=6.91GB;;; 'available'=9.09GB;;; 'total'=16.00GB;;;

Replace win01.example.net and strong-ncpa-token with the Windows host name and NCPA token. Add -s only when the Windows NCPA certificate chains to a CA trusted by the Nagios server.
Related: How to run a Nagios plugin manually

Store the NCPA token in a Nagios resource macro.
```
$ sudoedit /etc/nagios4/resource.cfg
```
resource.cfg
```
$USER9$=strong-ncpa-token
```
Resource macros are still secrets. Limit read access to /etc/nagios4/resource.cfg and avoid exposing the token in screenshots, tickets, or shared transcripts.
Create a command definition for NCPA active checks.
```
$ sudoedit /etc/nagios4/conf.d/ncpa-command.cfg
```
Add the check_ncpa command object.
```
define command{
    command_name            check_ncpa
    command_line            /usr/bin/python3 $USER1$/check_ncpa.py -H $HOSTADDRESS$ -t $USER9$ $ARG1$
}
```
The explicit /usr/bin/python3 interpreter avoids failures on current distributions where /usr/bin/python is not installed. Use a different resource macro if separate NCPA hosts use different tokens.
Create an object file for the Windows host and service.
```
$ sudoedit /etc/nagios4/conf.d/win01-ncpa.cfg
```
Use an existing host object when win01.example.net is already defined elsewhere. Do not define the same host_name in two object files.
Related: How to add a host in Nagios Core

Add the host and memory service objects.

define host{
    use                     generic-host
    host_name               win01.example.net
    alias                   Windows Server 01
    address                 win01.example.net
    check_command           check_ncpa!-P 5693 -M system/agent_version
    max_check_attempts      3
    check_interval          5
    retry_interval          1
    check_period            24x7
    contact_groups          admins
}
 
define service{
    use                     generic-service
    host_name               win01.example.net
    service_description     Memory Usage
    check_command           check_ncpa!-P 5693 -M memory/virtual -u G -w 80 -c 90
}

Use a site-specific Windows host template only when it is already loaded with its host groups and contact settings. For disk checks on the system drive, quote the NCPA metric as -M 'disk/logical/C:|' because the Windows drive path contains a pipe character.

Validate the Nagios configuration before applying it.

$ sudo nagios4 -v /etc/nagios4/nagios.cfg
Nagios Core 4.4.6
Reading configuration data...
   Read main config file okay...
   Read object config files okay...

Running pre-flight check on configuration data...

Checking objects...
	Checked 9 services.
	Checked 2 hosts.
	Checked 1 host groups.
	Checked 0 service groups.
	Checked 1 contacts.
	Checked 1 contact groups.
	Checked 181 commands.
	Checked 5 time periods.
##### snipped #####
Total Warnings: 0
Total Errors:   0

Things look okay - No serious problems were detected during the pre-flight check

Fix every reported object, command, template, or contact error before reloading Nagios Core.
Related: How to validate the Nagios Core configuration

Reload the nagios4 service.
```
$ sudo systemctl reload nagios4
```
Use the service name and control method from the local installation when Nagios Core was installed from source.
Related: How to manage the Nagios Core system service
Check the Windows service result in the Nagios Core web UI.
```
http://monitor.example.net/nagios4/
```
Open Services and confirm the Memory Usage row for win01.example.net shows OK with plugin output that starts with OK: Used memory.