Crisp answer: Nagios is a legacy open-source monitoring system that checks whether hosts and services are up, running, and within defined thresholds. It alerts via email, SMS, or PagerDuty when checks fail.
What Nagios does:
Nagios runs checks on a schedule. A check is a script or plugin that returns one of four exit codes:
| Exit code | State | Meaning |
|---|---|---|
| 0 | OK | Everything is fine |
| 1 | WARNING | Approaching threshold |
| 2 | CRITICAL | Threshold breached, alert required |
| 3 | UNKNOWN | Check could not run |
Types of checks:
Host checks: Is this server up? (ICMP ping)
Service checks: Is this service healthy?
- check_http: Is the web server returning 200?
- check_tcp: Is port 443 accepting connections?
- check_disk: Is disk usage below 80%?
- check_cpu: Is CPU below threshold?
- check_nrpe: Run a check on a remote host via the NRPE agent
How it works in practice:
Nagios server (polls)
→ runs check_http against web01:443
→ gets exit code 0 (OK)
→ stores result, no alert
→ runs check_disk against db01 via NRPE
→ gets exit code 2 (CRITICAL: disk 95% full)
→ sends alert email/PagerDuty to on-call
→ continues checking at interval
Key concepts:
Host: A server or device being monitored
Service: A specific check on a host (HTTP, disk, CPU)
Contact: Who gets alerted and when
Notification: Alert sent when state changes to CRITICAL/WARNING
Check interval: How often the check runs (e.g. every 5 minutes)
Retry interval: How often to re-check before alerting (reduces false positives)
Downtime: Scheduled maintenance window — alerts suppressed
Acknowledgement: "I know about this alert, I am working on it"
Why Nagios is still around:
Nagios has been around since 1999. Many enterprises still run it because it is stable, well-understood, and integrates with everything. Modern alternatives include Prometheus + Alertmanager, Datadog, and Zabbix. Mimecast likely runs Nagios for legacy infrastructure checks alongside newer tools.
What to say in the interview:
"Nagios is a classic host and service monitoring system. It runs checks on a schedule and alerts when something returns CRITICAL or WARNING. I know the model well: checks return exit codes, notifications go to on-call contacts, and you acknowledge alerts to suppress repeat pages while you fix the issue. It is older technology but extremely stable and still widely used for infrastructure health checks on servers and network devices."