When monitoring 130+ servers with 5 checks every 30 seconds (totaling ~21,600 checks/hour), the protocol choice becomes critical. Let's examine the technical realities of both approaches:

# Example SSH-based check_command definition
define command {
    command_name    check_ssh_disk
    command_line    /usr/lib/nagios/plugins/check_by_ssh -H $HOSTADDRESS$ -C "/usr/lib/nagios/plugins/check_disk -w 20% -c 10% -p /"
}

Pros:

• Zero additional daemons required
• Simpler firewall rules (single port 22)
• Built-in encryption

Cons:

• SSH handshake overhead per check (~200ms)
• Resource-intensive process fork()/exec()
• Key management complexity at scale

// Sample NRPE configuration (nrpe.cfg)
command[check_load]=/usr/lib/nagios/plugins/check_load -w 15,10,5 -c 30,25,20
command[check_disk]=/usr/lib/nagios/plugins/check_disk -w 20 -c 10 -X nfs

Performance metrics from our EC2 testbed (c5.large instances):

For EC2 environments, consider these optimizations:

# NRPE with SSL hardening (xinetd configuration)
service nrpe
{
    flags           = REUSE
    socket_type     = stream
    port            = 5666
    wait            = no
    user            = nagios
    group           = nagios
    server          = /usr/sbin/nrpe
    server_args     = -c /etc/nagios/nrpe.cfg --inetd
    log_on_failure  += USERID
    only_from       = 10.0.0.0/8 192.168.0.0/16
    per_source      = UNLIMITED
}

Hybrid approach for gradual transition:

1. Deploy NRPE to new servers automatically via CloudInit
2. Convert existing servers during maintenance windows
3. Implement check fallback mechanism:

define service {
    service_description    CPU Load
    check_command          check_nrpe!check_load
    event_handler          check_by_ssh!-C "/usr/lib/nagios/plugins/check_load -w 15 -c 30"
    ...
}

For physical servers with 16+ cores, the difference becomes less noticeable. However, for EC2 instances where every CPU cycle counts, NRPE shows 3-4x better efficiency.

When establishing remote monitoring with Nagios, administrators face the fundamental choice between SSH-based checks and NRPE (Nagios Remote Plugin Executor). Our infrastructure monitors 130+ servers (mix of physical boxes and EC2 instances) with 5 different checks running every 30 seconds per host - a scenario where the transport protocol choice becomes critical.

SSH Implementation:

define command {
    command_name    check_ssh_disk
    command_line    /usr/lib/nagios/plugins/check_by_ssh -H $HOSTADDRESS$ -C "/usr/lib/nagios/plugins/check_disk -w 20% -c 10% -p /"
}

NRPE Implementation:

define command {
    command_name    check_nrpe_disk
    command_line    /usr/lib/nagios/plugins/check_nrpe -H $HOSTADDRESS$ -c check_disk -a "-w 20% -c 10% -p /"
}

Testing on EC2 m5.large instances (2 vCPUs) showed:

While SSH offers native encryption, NRPE requires proper TLS configuration:

# Sample NRPE secure configuration (nrpe.cfg)
allowed_hosts=192.168.1.100
dont_blame_nrpe=0
use_ssl=1
ssl_version=TLSv1.2

SSH's advantage lies in minimal setup, but NRPE scales better:

# Automated NRPE deployment script snippet
for host in $(cat hostlist); do
    scp nrpe-3.2.1.tar.gz $host:/tmp/
    ssh $host "tar xzf /tmp/nrpe-3.2.1.tar.gz && 
               cd nrpe-3.2.1 && 
               ./configure --with-ssl=/usr/bin/openssl &&
               make all && 
               make install"
done

For environments with diverse requirements:

• Use NRPE for high-frequency checks (CPU, load)
• Reserve SSH for ad-hoc or complex checks requiring shell features
• Implement check clustering for geographical distribution

NRPE Timeouts:

# Adjust in nrpe.cfg
connection_timeout=300

SSH Connection Flooding:

# In sshd_config on monitored hosts
MaxStartups 30:50:100