Server Monitoring Software for Linux: Tools Compared

Applies to: Linux servers; Debian 13 packages tested: Prometheus 2.53.3, node_exporter 1.9.0, Nagios Core 4.4.6 with Monitoring Plugins 2.4.0, Icinga 2 2.14.6, Zabbix agent 2 7.0.22, Monit 5.34.3, htop 3.4.1; Netdata, Grafana, Checkmk and Uptime Kuma from their own documentation

There is no single best server monitoring software. The right tool depends on what you need to know. For a live view of one server, start with htop and Netdata. For alerts across many servers with ready-made templates, look at Zabbix, Checkmk or Nagios Core and Icinga. For metrics and dashboards, especially with containers, the usual stack is Prometheus with node_exporter and Grafana. To check from outside that a website or port answers, use Uptime Kuma. To restart a crashed service automatically, use Monit. All of these have a free, open-source version that runs on your own server. The sections below describe each one neutrally, in no particular order, with the parts we tested.

What to monitor on a Linux server

• Availability: does the server answer ping, do the website (HTTP status and a keyword on the page) and other ports respond, and when does the SSL certificate expire.
• Resources: CPU and load, memory and swap, disk space and inodes, disk I/O and network traffic.
• Services: are the web server, database and mail server running.
• Hardware on dedicated servers: disk health (see monitoring disks with smartd) and RAID status.

Watch the server from a second location too. A tool on the server cannot send an alert when the server itself is down.

Start with the built-in tools

For a quick look, no extra software is needed: top or htop for processes, free -h for memory, df -h and df -i for disk space and inodes, vmstat 1 5 for CPU, memory and I/O over time. The sysstat package adds iostat, mpstat and sar, which can keep a history. Our guides cover ps, top and htop, vmstat, sar and network traffic tools. These show the present moment; they do not alert you.

Netdata

• What it does: an agent that collects metrics every second and shows them in a web dashboard, with built-in alerts. It detects many applications (web servers, databases, containers) automatically.
• Licence: according to Netdata's README, the agent is GPL v3 or later, while the dashboard UI is closed-source but free to use, and Netdata Cloud is closed-source with free and paid tiers.
• Install: Netdata's kickstart.sh script. Debian 13 has no netdata package. On Debian 13 we ran the script with --dry-run --stable-channel --disable-telemetry: it planned to add Netdata's own apt repository (the netdata-repo package) and install from there. Read the script before running it. Our Netdata guide shows the install and how to open the dashboard safely.

Zabbix

• What it does: a central server with a database and web interface that collects data from agents or agentless checks, with ready-made templates, problem detection, maps and notifications. Its README describes it as monitoring network devices, servers, services and other IT resources.
• Licence: AGPL-3.0-only, according to its repository.
• Install: packages from Zabbix's own repository, or the distribution packages: Debian 13 ships Zabbix 7.0.22. You test what an agent will report with -t. Lab output from Zabbix agent 2 on Debian 13 (free space on / in percent):

  $ zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf -t 'vfs.fs.size[/,pfree]'
  vfs.fs.size[/,pfree]                          [s|71.489990]

  See how to install Zabbix Agent 2.

Prometheus, node_exporter and Grafana

• What they do: Prometheus collects metrics by fetching them over HTTP from "exporters" at set intervals (a pull model), stores them as time series and evaluates rules written in its query language, PromQL. node_exporter provides the machine metrics and listens on port 9100 by default. Alerts go through Alertmanager, which deduplicates, groups and routes them to receivers such as email or a webhook. Grafana draws the dashboards and can read Prometheus and many other data sources.
• Licences: Prometheus, node_exporter and Alertmanager are Apache-2.0; Grafana is AGPL-3.0, according to their repositories.
• Install: upstream binaries, Docker images or distribution packages. Distribution packages can be old: Debian 13 installed Prometheus 2.53.3, while the project's latest release was 3.15.0 when we checked. Always validate the configuration before a restart (lab output):

  $ promtool check config /etc/prometheus/prometheus.yml
  Checking /etc/prometheus/prometheus.yml
   SUCCESS: /etc/prometheus/prometheus.yml is valid prometheus config file syntax

• Good to know: node_exporter has no login by default. Its README describes TLS through a web configuration file (--web.config.file); otherwise keep port 9100 closed to everyone except your Prometheus server.

Nagios Core

• What it does: checks hosts and services on a schedule by running small programs called plugins, and sends notifications when a state changes. Its README describes it as a host, service and network monitoring program written in C.
• Licence: GPL version 2.
• Install: from source (the project's latest release was 4.5.14 when we checked) or packages: Debian 13 has 4.4.6. Check the configuration with a pre-flight run (lab output, end of the report):

  $ nagios4 -v /etc/nagios4/nagios.cfg
  Total Warnings: 0
  Total Errors:   0
  
  Things look okay - No serious problems were detected during the pre-flight check

• Plugins: the Monitoring Plugins package provides checks such as check_disk, check_load, check_procs, check_http and check_ssh. A plugin prints one status line and returns 0 (OK), 1 (Warning), 2 (Critical) or 3 (Unknown), as defined in the Monitoring Plugins guidelines. Lab output with thresholds set so high that the check must fail:

  $ /usr/lib/nagios/plugins/check_disk -w 99% -c 98% -p /
  DISK CRITICAL - free space: / 33333MiB (71.5% inode=92%);| ...
  $ echo $?
  2

  To check remote servers, see NRPE and Nagios.

Icinga 2

• What it does: a monitoring server that uses the same plugin interface as Nagios, with its own configuration language, a REST API, and Icinga Web 2 as the web interface. According to its README it can monitor large, complex environments across multiple locations.
• Licence: GPL version 3 or later in the current upstream repository (Debian 13 packages version 2.14.6).
• Test the configuration with icinga2 daemon -C; on Debian 13 the default configuration ended with Finished validating the configuration file(s).

Checkmk

• What it does: infrastructure and application monitoring with agent-based and agentless checks and a web interface.
• Editions: according to its repository, Checkmk Community is free and open source (GPL v2); Checkmk Pro and Ultimate are commercial editions, and Checkmk Cloud is the hosted version.
• Install: official DEB and RPM packages for Ubuntu, Debian, Red Hat based systems and SUSE, or a Docker container. We did not test Checkmk.

Uptime Kuma

• What it does: checks websites and services from the outside: HTTP(s) status and keywords, TCP ports, ping, DNS records, Docker containers and more, with status pages and notifications through 90+ services (email, Telegram, Slack, Discord and others), according to its README.
• Licence: MIT.
• Install: Docker or Docker Compose (image louislam/uptime-kuma:2, web interface on port 3001), or Node.js. Its README warns that NFS storage is not supported for the data folder. Publish the port as 127.0.0.1:3001:3001 and put a reverse proxy with HTTPS in front if you want it on the internet.
• Good to know: run it on a different server from the ones it watches, so it can still alert you when they go down.

Monit

• What it does: watches processes, files and file systems on one server and can act by itself, for example restarting a service that stopped or alerting when a disk passes a limit.
• Licence: AGPL-3 or later with an OpenSSL exception (Debian copyright file).
• Example (tested on Debian 13 with monit -t, which printed Control file syntax OK):

  check filesystem rootfs with path /
      if space usage > 90% then alert

How to choose

• One or two servers, quick insight: htop and sysstat, then Netdata or Monit.
• Many servers and devices with templates and an admin interface: Zabbix or Checkmk Community.
• A plugin-based setup you configure in text files: Nagios Core or Icinga 2.
• Metrics, dashboards and containers: Prometheus with node_exporter, Alertmanager and Grafana.
• "Is my site up?" checks and a public status page: Uptime Kuma on a separate machine.

Whichever you pick, protect the dashboards: bind them to 127.0.0.1 and use an SSH tunnel, or allow only your own IP in the firewall. Start with a few alerts that matter (disk space, a service down, the website not answering, certificate expiry) and add more later, so that alerts stay worth reading.

If you would rather not run this yourself, Ucartz offers a 24/7 server monitoring service with alerts for disk space, memory, server load and web and mail server status, and Linux server management.

Official documentation: Prometheus, Netdata, Uptime Kuma, Nagios Core and the Monitoring Plugins guidelines.