Nagios and Icinga monitor user agents
Nagios and Icinga are open-source monitoring systems that probe HTTP endpoints with check plugins (such as check_http) to verify availability. Those checks often send a recognisable monitoring user agent and run on a fixed schedule. They are infrastructure monitors you run yourself, not human visits.
What this means
Nagios and its fork Icinga use check plugins to test services. For web endpoints, the standard plugin is check_http (from the Monitoring Plugins project), which makes an HTTP request and evaluates the response.
These checks run on a schedule you define, so their traffic is regular and self-inflicted. Recognising them keeps monitoring volume out of human analytics and confirms the checks are reaching live endpoints.
How they identify themselves
The check_http plugin sends a user agent that, by default, identifies the monitoring plugin (containing a check_http marker), though it can be customised per check. Match on that token substring where present. The Monitoring Plugins, Nagios, and Icinga projects document the plugin and its options.
Because the user agent can be set per check, some deployments use a custom UA; in that case identify the monitor by its fixed source and cadence as well as the string.
- check_http often sends a recognisable monitoring user agent
- User agent can be customised per check definition
- Cadence and source corroborate the monitor identity
Operating around monitor checks
Exclude Nagios/Icinga checks from human analytics, and allowlist them so anti-bot rules do not break your own availability monitoring. Confirm checks target the endpoints you intend, since a misconfigured check can hammer the wrong path.
If you see check_http traffic you did not set up, investigate — it may be another team's monitor or a copied user agent, distinguishable by source and timing.
How it appears in analytics and logs
A request from a Nagios/Icinga HTTP check (e.g. a check_http user agent) is a scheduled availability probe. Its cadence is fixed and configured by you; regular hits are healthy monitoring, not audience, and belong out of human metrics.
Diagnostic use case
Recognise Nagios/Icinga HTTP checks in logs, exclude them from human analytics, and confirm your monitoring is reaching the endpoints it should.
What WebmasterID can help detect
WebmasterID classifies Nagios/Icinga check traffic server-side as monitoring bots and surfaces it on the bot-intelligence view, so availability probes do not inflate human page views.
Common mistakes
- Counting Nagios/Icinga availability checks as human visits.
- Blocking the check_http user agent and breaking your own monitoring.
- Assuming a fixed UA when check_http allows a custom user agent per check.
Privacy and accuracy notes
Monitor detection uses only the user agent. No human identity is involved — these are your own probes. WebmasterID records them as monitoring bot events, separate from human analytics.
Frequently asked questions
- What user agent does check_http send?
- By default the check_http plugin sends a user agent identifying the monitoring plugin, but it can be overridden per check, so confirm against your own configuration.
Related pages
- Datadog and New Relic synthetic user agents
Datadog Synthetics and New Relic Synthetics run scheduled checks that fetch your site from monitoring locations to measure uptime and performance. Their requests carry identifying tokens (Datadog/Synthetics and New Relic markers) so they can be recognised. They are monitoring bots you usually run yourself, not human visits.
- Uptime monitor user agents
Uptime and synthetic monitoring tools repeatedly request your site to check availability and response time. Tools such as UptimeRobot and Pingdom usually identify themselves in the user agent. Their traffic is expected, periodic, and automated. This page explains how to recognise it and keep it out of human analytics.
- User agent in analytics
Analytics platforms parse the user-agent string to report browser, operating system, and device-type breakdowns. Because the user agent is client-supplied, increasingly reduced, and easily spoofed — and because bots send their own strings — these breakdowns are useful approximations, not exact device censuses.
- Website observability
Separate infrastructure monitoring probes from human traffic.
Sources and verification notes
Last reviewed 2026-06-24. Facts are checked against primary/official sources where available; uncertain specifics are marked “Data not yet verified” rather than guessed.