Free and open-source monitoring software worth downloading

This page is a directory, not a download mirror. We host no files. Every name below links to the project's own home page, with current releases, install guides and signing keys. Get software from there or from your operating system's repositories, never from a third-party "download portal" that wraps an installer around someone else's work.

The sixteen projects below turn up again and again in real networks, from a two-switch office to a regional ISP, grouped by the job they do. Few people run only one: a typical small setup pairs an all-in-one monitor with a log collector and a latency grapher, then adds dashboards later. If you are still deciding what the monitor must do, read what a network monitoring system should do first.

Descriptions reflect each project at the time of writing. Projects change licenses, rename editions and rewrite components, so check the home page before you plan around a detail.

All-in-one network monitoring systems

These try to do the whole job: find or accept hosts, poll them, keep history, draw graphs, raise alarms and tell someone.

Zabbix

Zabbix is a large, mature platform with its own agents, SNMP and IPMI polling, templates, and trigger expressions as simple or as clever as you need. It suits mixed estates where servers and network gear should live in one place, and teams willing to spend time on templates up front. Server and agent are written in C, the web front end in PHP, with MySQL, MariaDB or PostgreSQL behind it. License: GNU GPL family.

LibreNMS

LibreNMS is an SNMP-first network monitor with strong auto-discovery: seed it with one device and it follows CDP and LLDP neighbors, identifies the hardware and graphs ports, sensors and processors without hand-written templates. It suits teams with many switches, routers and firewalls who want useful graphs on the first day. Written mainly in PHP, with some Python for polling; GNU GPL v3.

Checkmk

Checkmk began as an add-on for Nagios and grew into a full system with its own agent, automatic discovery of the services on each host, and a web interface for nearly all configuration. It suits admins who want Nagios-style checks without editing object files by hand. Written mostly in Python. A free open-source edition sits alongside commercial ones, so compare them before you build on a feature.

Icinga

Icinga started in 2009 as a fork of Nagios and has since been rebuilt: Icinga 2 is a C++ core with its own configuration language, an API and built-in clustering with satellites for remote sites, and Icinga Web provides the PHP interface. Nagios-compatible plugins still work. It suits teams that like the plugin model but need distributed polling. GNU GPL v2.

Nagios Core

Nagios Core is the long-running check scheduler whose plugin convention still shapes the field: a check is any program that prints a status line and exits 0 for OK, 1 for warning, 2 for critical or 3 for unknown. Configuration lives in plain text object files and the classic web interface is CGI-based. It suits small, stable environments and anyone who wants to learn the model many tools copied. Written in C; GNU GPL v2. Commercial products are also sold under the Nagios name, so check which one a guide means.

JFFNMS

JFFNMS is an older PHP and SNMP network management system from the 2000s, still on SourceForge. It polls devices over SNMP, keeps graphs in RRDtool, stores events and alarms in a SQL database, and turns traps and syslog lines into events. It is worth a look if you maintain an existing install or want to see how a web NMS of that era was built. For a new deployment, the projects above see far more current development.

Metrics and graphs

Prometheus

Prometheus is a monitoring system and time-series database that pulls metrics over HTTP from exporters, labels every series with key and value pairs, and queries them with PromQL. The node exporter covers Linux hosts, the SNMP exporter covers switches and routers, and Alertmanager groups and routes alerts. It suits dynamic environments (containers, cloud instances) and teams comfortable writing queries. Written in Go; Apache License 2.0.

Grafana

Grafana draws dashboards. Rather than collecting data itself, it queries data sources such as Prometheus, a SQL database, a log store or Zabbix through a plugin, so it often sits on top of whatever already gathers your numbers. It suits wall displays and anyone combining several tools on one screen. Go backend, TypeScript front end; the open-source edition is under the GNU AGPL v3.

Cacti

Cacti is a web front end for RRDtool with SNMP polling built in: add a device, pick graph templates, and it collects and draws interface traffic, CPU and similar values on a fixed interval. A separate poller written in C, Spine, helps as the device count grows. It suits teams who mainly want clear traffic graphs rather than a full alarm workflow. Written in PHP with MySQL or MariaDB; GNU GPL.

RRDtool

RRDtool is the round-robin database and graphing engine under a long list of monitoring tools. Each file has a fixed size chosen at creation: recent data at full resolution, older data consolidated into averages or maxima at coarser steps, so disk use never grows. It grew out of MRTG, the 1990s traffic grapher many network engineers met first. You will find it inside Cacti and Smokeping. Written in C; GNU GPL.

Logs

rsyslog

rsyslog is the syslog daemon shipped by default on many Linux distributions, so you may already run it. It receives syslog over UDP 514, TCP and RELP, filters and rewrites messages, writes a file per host or facility, and forwards to databases or other collectors. It suits a central log server for a small or mid-sized network. Written in C.

syslog-ng

syslog-ng does the same core job with a configuration built from named sources, filters, parsers and destinations, and it is good at parsing structured messages. An open-source edition sits alongside a commercial one. Written in C.

Uptime and ping

Uptime Kuma

Uptime Kuma is a self-hosted uptime monitor with a friendly web interface: HTTP and keyword checks, TCP ports, ping, DNS, certificate expiry warnings, public status pages and many notification channels. It suits home labs and small businesses that want "is it up, and tell me when it is not" running within minutes, often as a single container. Written in JavaScript on Node.js; MIT license.

Smokeping

Smokeping sends a burst of probes to each target every interval and graphs the spread of round-trip times as gray "smoke" around the median, with packet loss shown in color. A link that is up but jittery stands out at once. It suits WAN links, ISP uplinks and VPN tunnels, and settling arguments about whether the network really was slow last Tuesday. Written in Perl with RRDtool storage; GNU GPL.

Building blocks

Net-SNMP

Net-SNMP is the toolkit behind most SNMP work on Unix-like systems: snmpget, snmpwalk, snmpbulkwalk and snmptranslate for asking questions, snmptrap and snmptrapd for traps, and snmpd, an agent that lets a Linux or BSD server answer SNMP itself. Nearly every tool on this page expects you to test with its commands. Written in C with Perl and Python bindings; BSD-style license.

Network UPS Tools

Network UPS Tools (NUT) talks to uninterruptible power supplies over USB, serial or SNMP, shares their state across the network, and shuts machines down cleanly before the battery runs out. Your monitor can then read charge, load and runtime from it. It suits home racks and small server rooms where one UPS protects several machines. Written in C; GNU GPL.

Picking a starting point

Two tools running side by side for a week against the same ten devices will teach you more than any feature list. Use a spare virtual machine, follow the notes on setting up a monitoring server, and keep the one whose alarms you understand without opening its manual. For a longer comparison, see choosing an open-source monitor.

Verifying what you download

In rough order of preference:

1. Your distribution's repositories (apt, dnf). Packages are signed with the distribution's keys and get security fixes, though they may trail the newest release.
2. The project's own package repository, added exactly as its install guide says. Fetch the signing key over HTTPS and compare its fingerprint with the one the project publishes.
3. A release tarball, checked before you unpack it.
4. A container image from the project's official namespace, pinned to a specific tag rather than latest.

For a tarball, compare its SHA-256 hash with the one on the project's site, then import the project's public key and check the detached signature:

sha256sum monitor-x.y.z.tar.gz
gpg --verify monitor-x.y.z.tar.gz.asc monitor-x.y.z.tar.gz

Skip installers that pipe a script from an unfamiliar host into a root shell: a monitor holds credentials for every device you own.

Whichever project you choose, test SNMP by hand first. If snmpget from the monitoring server cannot reach a device, no tool on this page will either, and the help page walks through what to try next.