Most check commands share a set of common command-line options and filter keywords, they are documented on the common options page.

Queries

Module	Command	OS	Description
CheckDisk	check_disk_health		Combined per-drive health check (free space + I/O metrics).
CheckDisk	check_disk_io		Check disk I/O performance metrics (throughput, IOPS, queue length, busy time).
CheckDisk	check_disk_write		Verify that a disk is writable by creating a test file, writing to it, reading it back and deleting it.
CheckDisk	check_drivesize		Check the size (free-space) of a drive or volume.
CheckDisk	check_files		Check various aspects of a file and/or folder.
CheckDisk	check_mount		Check that a filesystem is mounted with the expected fstype and options.
CheckDisk	check_shadowcopy		Check VSS shadow-copy (Volume Shadow Copy) recency, count and shadow-storage usage per volume. Windows only.
CheckDisk	check_share		Check Windows SMB shares: list them, or verify that specific required shares exist. Windows only.
CheckDisk	check_single_file		Check various aspects of a single file (size, age, line count, version, …). Simpler alternative to check_files when you only need to inspect one specific file.
CheckDisk	check_storagepool		Check Storage Spaces pool health and capacity. Windows only.
CheckDisk	check_uncpath		Check free space on a UNC path (server share), with optional alternate credentials.
CheckDocker	check_docker		Check the state of docker containers, optionally requiring specific containers to be running.
CheckDocker	check_docker_df		Check docker disk usage: images, containers, volumes, build cache and reclaimable space.
CheckDocker	check_docker_info		Check that the docker daemon is healthy: version plus container and image counts.
CheckDocker	check_docker_restarts		Detect container restart loops and out-of-memory kills.
CheckDocker	check_docker_stats		Check per-container resource usage: CPU percent and memory versus limit.
CheckEventLog	check_eventlog		Check for errors in the event log.
CheckHelpers	check_always_critical		Run another check and regardless of its return code return CRITICAL.
CheckHelpers	check_always_ok		Run another check and regardless of its return code return OK.
CheckHelpers	check_always_warning		Run another check and regardless of its return code return WARNING.
CheckHelpers	check_and_forward		Run a check and forward the result as a passive check.
CheckHelpers	check_critical		Just return CRITICAL (anything passed along will be used as a message).
CheckHelpers	check_multi		Run more then one check and return the worst state.
CheckHelpers	check_negate		Run a check and alter the return status codes according to arguments.
CheckHelpers	check_ok		Just return OK (anything passed along will be used as a message).
CheckHelpers	check_timeout		Run a check and timeout after a given amount of time if the check has not returned.
CheckHelpers	check_version		Just return the NSClient++ version.
CheckHelpers	check_warning		Just return WARNING (anything passed along will be used as a message).
CheckHelpers	filter_perf		Run a check and filter performance data.
CheckHelpers	render_perf		Run a check and render the performance data as output message.
CheckHelpers	xform_perf		Run a check and transform the performance data in various (currently one) way.
CheckLogFile	check_logfile		Check for errors in log file or generic pattern matching in text files.
CheckMKClient	check_mk_query		Request remote information via check_mk.
CheckMSSQL	check_mssql		Check SQL Server connectivity and health (version, edition, uptime).
CheckMSSQL	check_mssql_backup		Check the age of the last full/differential/log backup per database.
CheckMSSQL	check_mssql_databases		Check database state, recovery model and data/log size.
CheckMSSQL	check_mssql_jobs		Check SQL Server Agent job status.
CheckMSSQL	check_mssql_query		Run a custom T-SQL query and apply thresholds to the returned rows.
CheckMySQL	check_mysql		Check MySQL/MariaDB server connectivity and health (version, flavor, uptime, connections).
CheckMySQL	check_mysql_query		Run a custom SQL query and apply thresholds to the returned rows.
CheckNet	check_apache_status		Check an Apache httpd server via its mod_status page (server-status?auto).
CheckNet	check_connections		Count active TCP/UDP connections and report counts per protocol and TCP state.
CheckNet	check_dns		Resolve a host name and check the response time and resulting addresses.
CheckNet	check_http		Send an HTTP/HTTPS request and check the response status, time, size and body.
CheckNet	check_nginx_status		Check an NGINX server via its stub_status page.
CheckNet	check_nsclient_web_online		Query the REST API of a remote NSClient++ agent (reachability or a remote check).
CheckNet	check_ntp_offset		Query an NTP server and check the offset between the local clock and the server.
CheckNet	check_phpfpm_status		Check a PHP-FPM pool via its status page.
CheckNet	check_ping		Ping another host and check the result.
CheckNet	check_ssh		Connect to an SSH port and verify the server presents a valid SSH banner.
CheckNet	check_tcp		Connect to a TCP port and optionally send/expect data to check that a service is reachable.
CheckNet	check_tomcat_status		Check an Apache Tomcat server via the manager status page (XML).
CheckNSCP	check_nscp		Check the internal health of NSClient++.
CheckNSCP	check_nscp_update		Check if there is a newer version of NSClient++ available on GitHub. The result is cached (default 24 hours) to avoid hitting the GitHub API rate limit.
CheckNSCP	check_nscp_version		Check the version of NSClient++ which is used.
CheckSecurity	check_activation		Check the Windows activation/licensing state: license status, remaining grace or KMS renewal period and genuineness. Windows only.
CheckSecurity	check_antivirus		Check registered antivirus products’ enabled/up-to-date state (Windows Security Center). Windows only.
CheckSecurity	check_bitlocker		Check BitLocker drive-encryption protection status per volume. Windows only.
CheckSecurity	check_certificate		Check X.509 certificate expiry/validity/hygiene from files (all platforms) or the Windows certificate store.
CheckSecurity	check_defender		Check Microsoft Defender status: signature/scan age, real-time and tamper protection, engine/signature versions. Windows only.
CheckSecurity	check_file_security		Check the owner and DACL of files, folders or service binaries; alerts on world-writable paths and unexpected owners. Windows only.
CheckSecurity	check_firewall		Check the Windows firewall profile (Domain/Private/Public) enabled state. Windows only.
CheckSecurity	check_firewall_rules		Check individual Windows firewall rules: assert that specific rules exist and are enabled, and find inbound allow rules that restrict neither address nor port. Windows only.
CheckSecurity	check_group_members		Check local group membership (default Administrators) and alert on members not on an expected allow-list. Windows only.
CheckSecurity	check_local_accounts		Check local user account hygiene: enabled/disabled, locked, password-required/expires, built-in admin/guest. Windows only.
CheckSecurity	check_nla		Check the Network Location Awareness profile (public/private/domain) per network. Windows only.
CheckSecurity	check_secureboot		Check whether UEFI Secure Boot is enabled. Windows only.
CheckSecurity	check_users		Check the count and detail of logged-on / RDP sessions (Windows and Linux).
CheckSystem	check_battery		Check battery status including charge level, power source, and battery health.
CheckSystem	check_cpu		Check that the load of the CPU(s) are within bounds.
CheckSystem	check_cpu_frequency		Check CPU clock frequency (current vs max) per processor.
CheckSystem	check_cpu_utilization		Check CPU utilization broken down by user/system/iowait/steal/guest.
CheckSystem	check_hardware		Check hardware inventory (vendor, model, serial, chassis type, memory modules) with pinned-expectation alerting: serial changed, DIMM dropped, laptop in a server fleet.
CheckSystem	check_hostname		Check host identity: hostname, FQDN, DNS domain and domain-join state, with drift detection for the name mismatches that silently break auth and monitoring.
CheckSystem	check_installed_software		Check installed software from the registry Uninstall hives (64-bit, 32-bit and per-user views): inventory, unwanted/EOL software policy and recent-install detection.
CheckSystem	check_kernel_memory		Check kernel memory-manager health: paged/nonpaged pool bytes, file-cache bytes and page-fault rates — the pool-exhaustion and hard-fault-storm signals free-RAM thresholds miss.
CheckSystem	check_kernel_stats		Check system-wide kernel activity: context-switch and system-call rates plus live process and thread counts.
CheckSystem	check_load		Check the system load average (1/5/15 minutes), synthesised from the processor queue length plus busy cores.
CheckSystem	check_memory		Check free/used memory on the system.
CheckSystem	check_network		Check network interface status.
CheckSystem	check_os_updates		Check for available Windows updates via the Windows Update Agent (WUA) API.
CheckSystem	check_os_version		Check the version of the underlying OS.
CheckSystem	check_pagefile		Check the size of the system pagefile(s).
CheckSystem	check_patch_age		Check installed-hotfix hygiene: how long since the newest hotfix was installed and whether specific required hotfixes are present.
CheckSystem	check_pdh		Check the value of a performance (PDH) counter on the local or remote system.
CheckSystem	check_pending_reboot		Check whether the system is waiting for a reboot, aggregating the servicing, Windows Update, file-rename, computer-rename and domain-join signals.
CheckSystem	check_printjobs		Check individual Windows print jobs: document, owner, size, pages, age and spooler status of every queued job.
CheckSystem	check_printqueue		Check Windows print queues: queue depth, oldest-job age, offline and error states plus the driver, port and sharing of each printer.
CheckSystem	check_process		Check state/metrics of one or more of the processes running on the computer.
CheckSystem	check_process_history		Check the history of processes that have been running since NSClient++ started. Useful for verifying if certain applications have been executed.
CheckSystem	check_process_history_new		Check for new processes that appeared within a specified time window. Useful for detecting unexpected or unauthorized applications.
CheckSystem	check_registry_key		Check existence, last-write time, and child counts of one or more Windows registry keys.
CheckSystem	check_registry_value		Check the type, content, and size of one or more Windows registry values.
CheckSystem	check_service		Check the state of one or more of the computer services.
CheckSystem	check_swap_io		Check system paging (swap) I/O rates: pages/bytes paged in and out per second.
CheckSystem	check_temperature		Check ACPI thermal zone temperatures.
CheckSystem	check_uptime		Check time since last server re-boot.
CheckSystem	check_w32time		Check the Windows Time service: whether the machine is following a time source at all, which one, the computed clock offset and the configured peers.
CheckTaskSched	check_tasksched		Check status of scheduled jobs.
CheckWindowsApps	check_iis_app_pools		Check IIS application pools (state, uptime, recycles).
CheckWindowsApps	check_iis_request_queues		Check HTTP.sys request queues (length, rejections, age).
CheckWindowsApps	check_iis_sites		Check IIS web sites (state, connections, traffic).
CheckWindowsApps	check_iis_worker_processes		Check IIS worker processes (active and served requests per w3wp).
CheckWindowsApps	check_rds_broker		Check the Remote Desktop Connection Broker counterset (failed/pending connections).
CheckWindowsApps	check_rds_licenses		Check Remote Desktop licensing (CAL key packs: issued versus available licenses).
CheckWindowsApps	check_rds_session_load		Check per-session resource usage (CPU, working set, protocol bytes).
CheckWindowsApps	check_rds_sessions		Check session counts on a session host (active, inactive, total).
CheckWMI	check_wmi		Check a set of WMI values and return rows which are matching criteria.
GraphiteClient	submit_graphite		Submit information to the remote Graphite server.
IcingaClient	submit_icinga		Submit information to the remote Icinga 2 Server.
NRDPClient	submit_nrdp		Submit information to the remote NRDP Server.
NRPEClient	check_nrpe		Request remote information via NRPE.
NRPEClient	exec_nrpe		Execute remote script via NRPE. (Most likely you want nrpe_query).
NRPEClient	nrpe_forward		Forward the request as-is to remote host via NRPE.
NRPEClient	nrpe_query		Request remote information via NRPE.
NRPEClient	submit_nrpe		Submit information to remote host via NRPE. (Most likely you want nrpe_query).
NSCAClient	submit_nsca		Submit information to the remote NSCA server.
NSCANgClient	submit_nsca_ng		Submit information to the remote NSCA-NG server. Custom relay commands defined under [/settings/NSCA-NG/client/handlers] are registered automatically using the same submit_<alias> naming convention.
NSCPClient	check_remote_nscp		Request remote information via NSCP.
NSCPClient	exec_remote_nscp		Execute remote script via NSCP.
NSCPClient	remote_nscp_query		Request remote information via NSCP.
NSCPClient	remote_nscpforward		Forward the request as-is to remote host via NSCP.
NSCPClient	submit_remote_nscp		Submit information to remote host via NSCP.
Scheduler	run_schedules		Run configured schedules now instead of waiting for their interval and submit the results as passive checks.
SimpleCache	check_cache		Fetch results from the cache.
SimpleCache	list_cache		List all keys in the cache.
SMTPClient	submit_smtp		Submit information to the remote SMTP server.
SyslogClient	submit_syslog		Submit information to the remote syslog server.

Modules

Type	Module	OS	Description
check	CheckDisk		CheckDisk can check various file and disk related things.
check	CheckDocker		Check docker containers (state, health) and the docker daemon itself.
windows	CheckEventLog		Check for errors and warnings in the event log.
check	CheckExternalScripts		Module used to execute external scripts
check	CheckHelpers		Various helper function to extend other checks.
check	CheckLogFile		File for checking log files and various other forms of updating text files
client	CheckMKClient		check_mk client can be used both from command line and from queries to check remote systems via check_mk
client	CheckMKServer		A server that listens for incoming check_mk connection and processes incoming requests.
windows	CheckMSSQL		Check Microsoft SQL Server: connectivity, databases, backups, agent jobs and custom queries.
check	CheckMySQL		Check MySQL, MariaDB, Percona and other MySQL-compatible servers: connectivity, health and custom queries.
check	CheckNet		Network related checks such as check_ping, check_tcp, check_dns, check_http, check_connections and check_ntp_offset.
check	CheckNSCP		Use this module to check the health and status of NSClient++ it self
check	CheckSecurity		CheckSecurity checks host security posture: certificate expiry and (on Windows) the firewall profile state.
check	CheckSystem		Various system related checks, such as CPU load, process state, service state memory usage and PDH counters.
windows	CheckTaskSched		Check status of your scheduled jobs.
windows	CheckWindowsApps		Checks for applications and server roles on Windows: IIS (web sites, application pools, worker processes, HTTP.sys request queues) and Remote Desktop Services (CAL licensing, session host load, Connection Broker).
windows	CheckWMI		Check status via WMI
client	CollectdClient		CollectD client can be used to submit metrics to a collectd server
generic	CommandClient		A command line client, generally not used except with “nscp test”.
client	ElasticClient		Elastic sends metrics, events and logs to elastic search
client	GraphiteClient		Graphite client can be used to submit graph data to a graphite graphing system
client	IcingaClient		Icinga 2 client submits passive check results to an Icinga 2 server via the REST API
generic	LUAScript		Loads and processes internal Lua scripts
client	NRDPClient		NRDP client can be used both from command line and from queries to check remote systems via NRDP
client	NRPEClient		NRPE client can be used both from command line and from queries to check remote systems via NRPE as well as configure the NRPE server
client	NRPEServer		A server that listens for incoming NRPE connection and processes incoming requests.
client	NSCAClient		NSCA client can be used both from command line and from queries to submit passive checks via NSCA
client	NSCANgClient		NSCA-NG client can be used both from command line and from queries to submit passive checks via NSCA-NG (TLS-based NSCA next generation)
client	NSCAServer		A server that listens for incoming NSCA connection and processes incoming requests.
windows	NSClientServer		A server that listens for incoming check_nt connection and processes incoming requests.
client	NSCPClient		NSCP client can be used both from command line and from queries to check remote systems via NSCP (REST)
client	Op5Client		Client for connecting nativly to the Op5 Nortbound API
generic	PythonScript		Loads and processes internal Python scripts
generic	Scheduler		Use this to schedule check commands and jobs in conjunction with for instance passive monitoring through NSCA
generic	SimpleCache		Stores status updates and allows for active checks to retrieve them
generic	SimpleFileWriter		Write status updates to a text file (A bit like the NSCA server does)
client	SMTPClient		SMTP client can be used both from command line and from queries to check remote systems via SMTP
client	SyslogClient		Forward information as syslog messages to a syslog server
generic	WEBServer		A server that listens for incoming HTTP connection and processes incoming requests. It provides both a WEB UI as well as a REST API in addition to simplifying configuration of WEB Server module.