How to monitor a Windows host with NCPA in Nagios Core

Windows servers can expose CPU, memory, disk, and service metrics to Nagios Core through NCPA without enabling Windows remote management. Active checks keep scheduling and alerting on the Nagios server while the Windows agent answers token-protected HTTPS API requests.

The Nagios side uses check_ncpa.py to call the NCPA listener on port 5693. The Windows side must already have NCPA installed, a non-default token set during install, and a firewall rule that allows the monitoring server to reach the listener from the monitoring network.

Store the NCPA token in a Nagios resource macro so object definitions can reference it without repeating the secret in every host and service file. The finished check should pass manually as the nagios user, load the Windows objects without pre-flight errors, and show the memory service result in the web UI after reload.

1. Install Python 3 and curl on the Nagios server.

   $ sudo apt-get update && sudo apt-get install --assume-yes python3 curl

   check_ncpa.py runs with Python 3. curl downloads the plugin from the upstream NCPA repository.

2. Download check_ncpa.py into the Nagios plugin directory.

   $ sudo curl --fail --location --silent --show-error \
     --output /usr/lib/nagios/plugins/check_ncpa.py \
     https://raw.githubusercontent.com/NagiosEnterprises/ncpa/master/client/check_ncpa.py

   Package installs on Ubuntu and Debian normally use /usr/lib/nagios/plugins. Source installs often use /usr/local/nagios/libexec; place the file in the directory referenced by the local $USER1$ resource macro.

3. Make the plugin executable.

   $ sudo chmod 755 /usr/lib/nagios/plugins/check_ncpa.py

4. Run a memory check from the Nagios server as the nagios user.

   $ sudo -u nagios python3 /usr/lib/nagios/plugins/check_ncpa.py -H win01.example.net -t 'strong-ncpa-token' -P 5693 -M memory/virtual -u G -w 80 -c 90
   OK: Used memory was 43.20 % (Available: 9.09 GB, Total: 16.00 GB, Free: 9.09 GB, Used: 6.91 GB) | 'percent'=43.20%;80;90; 'used'=6.91GB;;; 'available'=9.09GB;;; 'total'=16.00GB;;;

   Replace win01.example.net and strong-ncpa-token with the Windows host name and NCPA token. Add -s only when the Windows NCPA certificate chains to a CA trusted by the Nagios server.
   Related: How to run a Nagios plugin manually

5. Store the NCPA token in a Nagios resource macro.

   $ sudoedit /etc/nagios4/resource.cfg

   resource.cfg

   $USER9$=strong-ncpa-token

   Resource macros are still secrets. Limit read access to /etc/nagios4/resource.cfg and avoid exposing the token in screenshots, tickets, or shared transcripts.

6. Create a command definition for NCPA active checks.

   $ sudoedit /etc/nagios4/conf.d/ncpa-command.cfg

7. Add the check_ncpa command object.

   define command{
       command_name            check_ncpa
       command_line            /usr/bin/python3 $USER1$/check_ncpa.py -H $HOSTADDRESS$ -t $USER9$ $ARG1$
   }

   The explicit /usr/bin/python3 interpreter avoids failures on current distributions where /usr/bin/python is not installed. Use a different resource macro if separate NCPA hosts use different tokens.

8. Create an object file for the Windows host and service.

   $ sudoedit /etc/nagios4/conf.d/win01-ncpa.cfg

   Use an existing host object when win01.example.net is already defined elsewhere. Do not define the same host_name in two object files.
   Related: How to add a host in Nagios Core

9. Add the host and memory service objects.

   define host{
       use                     generic-host
       host_name               win01.example.net
       alias                   Windows Server 01
       address                 win01.example.net
       check_command           check_ncpa!-P 5693 -M system/agent_version
       max_check_attempts      3
       check_interval          5
       retry_interval          1
       check_period            24x7
       contact_groups          admins
   }
    
   define service{
       use                     generic-service
       host_name               win01.example.net
       service_description     Memory Usage
       check_command           check_ncpa!-P 5693 -M memory/virtual -u G -w 80 -c 90
   }

   Use a site-specific Windows host template only when it is already loaded with its host groups and contact settings. For disk checks on the system drive, quote the NCPA metric as -M 'disk/logical/C:|' because the Windows drive path contains a pipe character.

10. Validate the Nagios configuration before applying it.

    $ sudo nagios4 -v /etc/nagios4/nagios.cfg
    Nagios Core 4.4.6
    Reading configuration data...
       Read main config file okay...
       Read object config files okay...
    
    Running pre-flight check on configuration data...
    
    Checking objects...
    	Checked 9 services.
    	Checked 2 hosts.
    	Checked 1 host groups.
    	Checked 0 service groups.
    	Checked 1 contacts.
    	Checked 1 contact groups.
    	Checked 181 commands.
    	Checked 5 time periods.
    ##### snipped #####
    Total Warnings: 0
    Total Errors:   0
    
    Things look okay - No serious problems were detected during the pre-flight check

    Fix every reported object, command, template, or contact error before reloading Nagios Core.
    Related: How to validate the Nagios Core configuration

11. Reload the nagios4 service.

    $ sudo systemctl reload nagios4

    Use the service name and control method from the local installation when Nagios Core was installed from source.
    Related: How to manage the Nagios Core system service

12. Check the Windows service result in the Nagios Core web UI.

    http://monitor.example.net/nagios4/

    Open Services and confirm the Memory Usage row for win01.example.net shows OK with plugin output that starts with OK: Used memory.