Most check commands share a set of common command-line options and filter keywords, they are documented on the common options page.

Queries

Module	Command	OS	Description
CheckActiveDirectory	check_ad_replication (experimental)		Check inbound Active Directory replication links on a domain controller (last success, consecutive failures). Windows only.
CheckActiveDirectory	check_kdc (experimental)		Check that Kerberos KDCs answer an AS-REQ probe on port 88 (a real Kerberos exchange, not just a port check). Windows only.
CheckActiveDirectory	check_secure_channel (experimental)		Verify the machine-account secure channel to the domain via netlogon. Windows only.
CheckDisk	check_disk_health (experimental)		Combined per-drive health check (free space + I/O metrics).
CheckDisk	check_disk_io (experimental)		Check disk I/O performance metrics (throughput, IOPS, queue length, busy time).
CheckDisk	check_disk_write (experimental)		Verify that a disk is writable by creating a test file, writing to it, reading it back and deleting it.
CheckDisk	check_drivesize		Check the size (free-space) of a drive or volume.
CheckDisk	check_files		Check various aspects of a file and/or folder.
CheckDisk	check_mount (experimental)		Check that a filesystem is mounted with the expected fstype and options.
CheckDisk	check_shadowcopy (experimental)		Check VSS shadow-copy (Volume Shadow Copy) recency, count and shadow-storage usage per volume. Windows only.
CheckDisk	check_share (experimental)		Check Windows SMB shares: list them, or verify that specific required shares exist. Windows only.
CheckDisk	check_single_file (experimental)		Check various aspects of a single file (size, age, line count, version, …). Simpler alternative to check_files when you only need to inspect one specific file.
CheckDisk	check_storagepool (experimental)		Check Storage Spaces pool health and capacity. Windows only.
CheckDisk	check_uncpath (experimental)		Check free space on a UNC path (server share), with optional alternate credentials.
CheckDocker	check_docker		Check the state of docker containers, optionally requiring specific containers to be running.
CheckDocker	check_docker_df (experimental)		Check docker disk usage: images, containers, volumes, build cache and reclaimable space.
CheckDocker	check_docker_info (experimental)		Check that the docker daemon is healthy: version plus container and image counts.
CheckDocker	check_docker_restarts (experimental)		Detect container restart loops and out-of-memory kills.
CheckDocker	check_docker_stats (experimental)		Check per-container resource usage: CPU percent and memory versus limit.
CheckEventLog	check_eventlog		Check for errors in the event log.
CheckHelpers	check_always_critical		Run another check and regardless of its return code return CRITICAL.
CheckHelpers	check_always_ok		Run another check and regardless of its return code return OK.
CheckHelpers	check_always_warning		Run another check and regardless of its return code return WARNING.
CheckHelpers	check_and_forward		Run a check and forward the result as a passive check.
CheckHelpers	check_critical		Just return CRITICAL (anything passed along will be used as a message).
CheckHelpers	check_multi		Run more then one check and return the worst state.
CheckHelpers	check_negate		Run a check and alter the return status codes according to arguments.
CheckHelpers	check_ok		Just return OK (anything passed along will be used as a message).
CheckHelpers	check_timeout		Run a check and timeout after a given amount of time if the check has not returned.
CheckHelpers	check_version		Just return the NSClient++ version.
CheckHelpers	check_warning		Just return WARNING (anything passed along will be used as a message).
CheckHelpers	filter_perf		Run a check and filter performance data.
CheckHelpers	render_perf		Run a check and render the performance data as output message.
CheckHelpers	xform_perf		Run a check and transform the performance data in various (currently one) way.
CheckHyperV	check_hyperv_cpu (experimental)		Check hypervisor logical processor load (guest, hypervisor and total run time) on the host.
CheckHyperV	check_hyperv_host (experimental)		Check the Hyper-V host: virtual machine health summary and hypervisor capacity (logical/virtual processors, partitions).
CheckHyperV	check_hyperv_vms (experimental)		Check virtual machines (state, health, heartbeat, uptime, memory, processors, snapshots, replication).
CheckKubernetes	check_kubernetes (experimental)		Check that the Kubernetes API server is reachable and ready: version, readiness and node counts.
CheckKubernetes	check_nodes (experimental)		Check node readiness, pressure conditions, schedulability and capacity.
CheckKubernetes	check_pods (experimental)		Check the state of pods: phase, the kubectl STATUS column, readiness and restarts.
CheckKubernetes	check_workloads (experimental)		Check that deployments, statefulsets and daemonsets have their desired replicas available.
CheckLogFile	check_logfile		Check for errors in log file or generic pattern matching in text files.
CheckMKClient	check_mk_query		Request remote information via check_mk.
CheckMSSQL	check_mssql (experimental)		Check SQL Server connectivity and health (version, edition, uptime).
CheckMSSQL	check_mssql_availability_groups (experimental)		Check Always On availability group replica and database health.
CheckMSSQL	check_mssql_backup (experimental)		Check the age of the last full/differential/log backup per database.
CheckMSSQL	check_mssql_blocking (experimental)		Check for blocked sessions and blocking chains.
CheckMSSQL	check_mssql_counters (experimental)		Check engine performance counters: buffer cache, page life expectancy, batch and lock rates.
CheckMSSQL	check_mssql_databases (experimental)		Check database state, recovery model and data/log size.
CheckMSSQL	check_mssql_integrity (experimental)		Check suspect pages and the age of the last successful DBCC CHECKDB.
CheckMSSQL	check_mssql_jobs (experimental)		Check SQL Server Agent job status.
CheckMSSQL	check_mssql_query (experimental)		Run a custom T-SQL query and apply thresholds to the returned rows.
CheckMSSQL	check_mssql_sessions (experimental)		Check session and connection counts per database and login.
CheckMSSQL	check_mssql_tempdb (experimental)		Check tempdb space usage by consumer and volume headroom.
CheckMSSQL	check_mssql_transactions (experimental)		Check for old or leaked open transactions and long-running requests.
CheckMSSQL	check_mssql_waits (experimental)		Check wait statistics by category and scheduler pressure.
CheckMySQL	check_mysql (experimental)		Check MySQL/MariaDB server connectivity and health (version, flavor, uptime, connections).
CheckMySQL	check_mysql_query (experimental)		Run a custom SQL query and apply thresholds to the returned rows.
CheckNet	check_apache_status (experimental)		Check an Apache httpd server via its mod_status page (server-status?auto).
CheckNet	check_connections (experimental)		Count active TCP/UDP connections and report counts per protocol and TCP state.
CheckNet	check_dns (experimental)		Resolve a host name and check the response time and resulting addresses.
CheckNet	check_domain (experimental)		Check registered domain expiration over RDAP with optional WHOIS fallback.
CheckNet	check_http (experimental)		Send an HTTP/HTTPS request and check the response status, time, size and body.
CheckNet	check_nginx_status (experimental)		Check an NGINX server via its stub_status page.
CheckNet	check_nsclient_web_online (experimental)		Query the REST API of a remote NSClient++ agent (reachability or a remote check).
CheckNet	check_ntp_offset (experimental)		Query an NTP server and check the offset between the local clock and the server.
CheckNet	check_phpfpm_status (experimental)		Check a PHP-FPM pool via its status page.
CheckNet	check_ping		Ping another host and check the result.
CheckNet	check_radius (experimental)		Probe RADIUS authentication or responsiveness with authenticated UDP replies.
CheckNet	check_ssh (experimental)		Connect to an SSH port and verify the server presents a valid SSH banner.
CheckNet	check_tcp (experimental)		Connect to a TCP port and optionally send/expect data to check that a service is reachable.
CheckNet	check_tomcat_status (experimental)		Check an Apache Tomcat server via the manager status page (XML).
CheckNSCP	check_nscp		Check the internal health of NSClient++.
CheckNSCP	check_nscp_update (experimental)		Check if there is a newer version of NSClient++ available on GitHub. The result is cached (default 24 hours) to avoid hitting the GitHub API rate limit.
CheckNSCP	check_nscp_version		Check the version of NSClient++ which is used.
CheckSecurity	check_activation (experimental)		Check the Windows activation/licensing state: license status, remaining grace or KMS renewal period and genuineness. Windows only.
CheckSecurity	check_antivirus (experimental)		Check registered antivirus products’ enabled/up-to-date state (Windows Security Center). Windows only.
CheckSecurity	check_bitlocker (experimental)		Check BitLocker drive-encryption protection status per volume. Windows only.
CheckSecurity	check_certificate (experimental)		Check X.509 certificate expiry/validity/hygiene from files (all platforms) or the Windows certificate store.
CheckSecurity	check_defender (experimental)		Check Microsoft Defender status: signature/scan age, real-time and tamper protection, engine/signature versions. Windows only.
CheckSecurity	check_file_security (experimental)		Check the owner and DACL of files, folders or service binaries; alerts on world-writable paths and unexpected owners. Windows only.
CheckSecurity	check_firewall (experimental)		Check the Windows firewall profile (Domain/Private/Public) enabled state. Windows only.
CheckSecurity	check_firewall_rules (experimental)		Check individual Windows firewall rules: assert that specific rules exist and are enabled, and find inbound allow rules that restrict neither address nor port. Windows only.
CheckSecurity	check_group_members (experimental)		Check local group membership (default Administrators) and alert on members not on an expected allow-list. Windows only.
CheckSecurity	check_local_accounts (experimental)		Check local user account hygiene: enabled/disabled, locked, password-required/expires, built-in admin/guest. Windows only.
CheckSecurity	check_nla (experimental)		Check the Network Location Awareness profile (public/private/domain) per network. Windows only.
CheckSecurity	check_secureboot (experimental)		Check whether UEFI Secure Boot is enabled. Windows only.
CheckSecurity	check_users (experimental)		Check the count and detail of logged-on / RDP sessions (Windows and Linux).
CheckSystem	check_battery		Check battery status including charge level, power source, and battery health.
CheckSystem	check_cpu		Check that the load of the CPU(s) are within bounds.
CheckSystem	check_cpu_frequency		Check CPU clock frequency (current vs max) per processor.
CheckSystem	check_cpu_utilization		Check CPU utilization broken down by user/system/iowait/steal/guest.
CheckSystem	check_hardware		Check hardware inventory (vendor, model, serial, chassis type, memory modules) with pinned-expectation alerting: serial changed, DIMM dropped, laptop in a server fleet.
CheckSystem	check_hostname		Check host identity: hostname, FQDN, DNS domain and domain-join state, with drift detection for the name mismatches that silently break auth and monitoring.
CheckSystem	check_installed_software		Check installed software from the registry Uninstall hives (64-bit, 32-bit and per-user views): inventory, unwanted/EOL software policy and recent-install detection.
CheckSystem	check_kernel_memory		Check kernel memory-manager health: paged/nonpaged pool bytes, file-cache bytes and page-fault rates — the pool-exhaustion and hard-fault-storm signals free-RAM thresholds miss.
CheckSystem	check_kernel_stats		Check system-wide kernel activity: context-switch and system-call rates plus live process and thread counts.
CheckSystem	check_load		Check the system load average (1/5/15 minutes), synthesised from the processor queue length plus busy cores.
CheckSystem	check_memory		Check free/used memory on the system.
CheckSystem	check_network		Check network interface status.
CheckSystem	check_os_updates		Check for available Windows updates via the Windows Update Agent (WUA) API.
CheckSystem	check_os_version		Check the version of the underlying OS.
CheckSystem	check_pagefile		Check the size of the system pagefile(s).
CheckSystem	check_patch_age		Check installed-hotfix hygiene: how long since the newest hotfix was installed and whether specific required hotfixes are present.
CheckSystem	check_pdh		Check the value of a performance (PDH) counter on the local or remote system.
CheckSystem	check_pending_reboot		Check whether the system is waiting for a reboot, aggregating the servicing, Windows Update, file-rename, computer-rename and domain-join signals.
CheckSystem	check_printjobs		Check individual Windows print jobs: document, owner, size, pages, age and spooler status of every queued job.
CheckSystem	check_printqueue		Check Windows print queues: queue depth, oldest-job age, offline and error states plus the driver, port and sharing of each printer.
CheckSystem	check_process		Check state/metrics of one or more of the processes running on the computer.
CheckSystem	check_process_history		Check the history of processes that have been running since NSClient++ started. Useful for verifying if certain applications have been executed.
CheckSystem	check_process_history_new		Check for new processes that appeared within a specified time window. Useful for detecting unexpected or unauthorized applications.
CheckSystem	check_registry_key		Check existence, last-write time, and child counts of one or more Windows registry keys.
CheckSystem	check_registry_value		Check the type, content, and size of one or more Windows registry values.
CheckSystem	check_service		Check the state of one or more of the computer services.
CheckSystem	check_swap_io		Check system paging (swap) I/O rates: pages/bytes paged in and out per second.
CheckSystem	check_temperature		Check ACPI thermal zone temperatures.
CheckSystem	check_uptime		Check time since last server re-boot.
CheckSystem	check_w32time		Check the Windows Time service: whether the machine is following a time source at all, which one, the computed clock offset and the configured peers.
CheckTaskSched	check_tasksched		Check status of scheduled jobs.
CheckWindowsApps	check_cluster_groups (experimental)		Check Windows Failover Cluster roles and their current owner nodes.
CheckWindowsApps	check_cluster_networks (experimental)		Check Windows Failover Cluster network states.
CheckWindowsApps	check_cluster_nodes (experimental)		Check Windows Failover Cluster node states.
CheckWindowsApps	check_cluster_resources (experimental)		Check Windows Failover Cluster resources, types, groups and owners.
CheckWindowsApps	check_iis_app_pools (experimental)		Check IIS application pools (state, uptime, recycles).
CheckWindowsApps	check_iis_request_queues (experimental)		Check HTTP.sys request queues (length, rejections, age).
CheckWindowsApps	check_iis_sites (experimental)		Check IIS web sites (state, connections, traffic).
CheckWindowsApps	check_iis_worker_processes (experimental)		Check IIS worker processes (active and served requests per w3wp).
CheckWindowsApps	check_nps_accounting (experimental)		Check discarded NPS accounting requests and optional accounting log freshness.
CheckWindowsApps	check_nps_auth (experimental)		Check NPS authentication outcomes, rejection percentages and reason codes over a time window.
CheckWindowsApps	check_nps_counters (experimental)		Check the installed NPS/RADIUS performance counters using two samples.
CheckWindowsApps	check_rds_broker (experimental)		Check the Remote Desktop Connection Broker counterset (failed/pending connections).
CheckWindowsApps	check_rds_licenses (experimental)		Check Remote Desktop licensing (CAL key packs: issued versus available licenses).
CheckWindowsApps	check_rds_session_load (experimental)		Check per-session resource usage (CPU, working set, protocol bytes).
CheckWindowsApps	check_rds_sessions (experimental)		Check session counts on a session host (active, inactive, total).
CheckWMI	check_wmi		Check a set of WMI values and return rows which are matching criteria.
GearmanClient	submit_gearman (experimental)		Submit a passive check result into a Mod-Gearman result queue.
GraphiteClient	submit_graphite		Submit information to the remote Graphite server.
IcingaClient	submit_icinga		Submit information to the remote Icinga 2 Server.
NRDPClient	submit_nrdp		Submit information to the remote NRDP Server.
NRPEClient	check_nrpe		Request remote information via NRPE.
NRPEClient	exec_nrpe		Execute remote script via NRPE. (Most likely you want nrpe_query).
NRPEClient	nrpe_forward		Forward the request as-is to remote host via NRPE.
NRPEClient	nrpe_query		Request remote information via NRPE.
NRPEClient	submit_nrpe		Submit information to remote host via NRPE. (Most likely you want nrpe_query).
NSCAClient	submit_nsca		Submit information to the remote NSCA server.
NSCANgClient	submit_nsca_ng (experimental)		Submit information to the remote NSCA-NG server. Custom relay commands defined under [/settings/NSCA-NG/client/handlers] are registered automatically using the same submit_<alias> naming convention.
NSCPClient	check_remote_nscp		Request remote information via NSCP.
NSCPClient	remote_nscp_query		Request remote information via NSCP.
NSCPClient	remote_nscpforward		Forward the request to a remote host via NSCP (the command and its arguments are re-issued against the remote agent’s REST API).
Scheduler	run_schedules (experimental)		Run configured schedules now instead of waiting for their interval and submit the results as passive checks.
SimpleCache	check_cache		Fetch results from the cache.
SimpleCache	list_cache		List all keys in the cache.
SMTPClient	submit_smtp		Submit information to the remote SMTP server.
SyslogClient	submit_syslog		Submit information to the remote syslog server.

Modules

Type	Module	OS	Description
windows	CheckActiveDirectory (experimental)		CheckActiveDirectory checks Active Directory health: replication on domain controllers, the machine-account secure channel and Kerberos KDC availability.
check	CheckDisk		CheckDisk can check various file and disk related things.
check	CheckDocker		Check docker containers (state, health) and the docker daemon itself.
windows	CheckEventLog		Check for errors and warnings in the event log.
check	CheckExternalScripts		Module used to execute external scripts
check	CheckHelpers		Various helper function to extend other checks.
windows	CheckHyperV (experimental)		Checks for a Hyper-V host: hypervisor health and capacity, logical processor load and the state, heartbeat, memory and snapshots of every virtual machine.
check	CheckKubernetes (experimental)		Check a Kubernetes cluster through its API server: cluster health, pods, nodes and workloads.
check	CheckLogFile		File for checking log files and various other forms of updating text files
client	CheckMKClient		check_mk client can be used both from command line and from queries to check remote systems via check_mk
client	CheckMKServer		A server that listens for incoming check_mk connection and processes incoming requests.
windows	CheckMSSQL (experimental)		Check Microsoft SQL Server: connectivity, databases, backups, agent jobs and custom queries.
check	CheckMySQL (experimental)		Check MySQL, MariaDB, Percona and other MySQL-compatible servers: connectivity, health and custom queries.
check	CheckNet		Network related checks such as check_ping, check_tcp, check_dns, check_http, check_connections and check_ntp_offset.
check	CheckNSCP		Use this module to check the health and status of NSClient++ it self
check	CheckSecurity (experimental)		CheckSecurity checks host security posture: certificate expiry and (on Windows) the firewall profile state.
check	CheckSystem		Various system related checks, such as CPU load, process state, service state memory usage and PDH counters.
windows	CheckTaskSched		Check status of your scheduled jobs.
windows	CheckWindowsApps (experimental)		Checks for Windows applications and server roles: IIS, Remote Desktop Services, NPS authentication, accounting and performance counters, and Failover Clustering groups, resources, nodes and networks.
windows	CheckWMI		Check status via WMI
client	CollectdClient		CollectD client can be used to submit metrics to a collectd server
generic	CommandClient		A command line client, generally not used except with “nscp test”.
generic	DotnetPlugins		Loads and hosts plugins written for .NET (C#, F#, …)
client	ElasticClient		Elastic sends metrics, events and logs to elastic search
client	GearmanClient (experimental)		Run checks scheduled by a Naemon or Nagios Core through Mod-Gearman: the agent connects out to a gearmand job server, grabs the checks queued for it and answers them as native NSClient++ queries. It also submits passive results into the same result queue, which is what lets a Mod-Gearman installation drop NSCA
client	GraphiteClient		Graphite client can be used to submit graph data to a graphite graphing system
client	IcingaClient		Icinga 2 client submits passive check results to an Icinga 2 server via the REST API
generic	LUAScript		Loads and processes internal Lua scripts
client	NRDPClient		NRDP client can be used both from command line and from queries to check remote systems via NRDP
client	NRPEClient		NRPE client can be used both from command line and from queries to check remote systems via NRPE as well as configure the NRPE server
client	NRPEServer		A server that listens for incoming NRPE connection and processes incoming requests.
client	NSCAClient		NSCA client can be used both from command line and from queries to submit passive checks via NSCA
client	NSCANgClient (experimental)		NSCA-NG client can be used both from command line and from queries to submit passive checks via NSCA-NG (TLS-based NSCA next generation)
client	NSCAServer		A server that listens for incoming NSCA connection and processes incoming requests.
windows	NSClientServer		A server that listens for incoming check_nt connection and processes incoming requests.
client	NSCPClient		NSCP client can be used both from command line and from queries to check remote systems over their REST API
client	Op5Client		Client for connecting nativly to the Op5 Nortbound API
generic	PythonScript		Loads and processes internal Python scripts
generic	Scheduler		Use this to schedule check commands and jobs in conjunction with for instance passive monitoring through NSCA
generic	SimpleCache		Stores status updates and allows for active checks to retrieve them
generic	SimpleFileWriter		Write status updates to a text file (A bit like the NSCA server does)
client	SMTPClient		SMTP client can be used both from command line and from queries to check remote systems via SMTP
client	SyslogClient		Forward information as syslog messages to a syslog server
generic	WEBServer		A server that listens for incoming HTTP connection and processes incoming requests. It provides both a WEB UI as well as a REST API in addition to simplifying configuration of WEB Server module.