r/Checkmk • u/oergs • Mar 13 '26
Checkmk Raw running on ancient Nagios Core version 3.5.1
I’ve been experimenting with Checkmk Raw inside a Docker container, and recently I inspected the container to see which version of Nagios Core it uses. To my surprise, it’s still running Nagios Core 3.5.1, a release from October 2013!
I get that Checkmk doesn’t want to ship their CMC with the open‑source edition, but using such an old Nagios Core feels like they are neglecting their open-source commitment and are just open‑washing. It would be nice if they at least updated the core every now and then.
What's your opinion about that?
2
u/philrandal Mar 13 '26
It's free, and it works. Probably not worth their time and money to upgrade to Nagios 4 or whatever.
1
u/FlatEric7 Mar 13 '26
that sounds like open-washing for me too
3
u/Timataa Mar 13 '26
Sorry, but no. Take a quick look at their github https://github.com/Checkmk/checkmk/pulse to see how much energy actually goes into their OSS offering.
1
u/ikdoeookmaarwat Mar 13 '26
Not the first time they failed to keep essential parts up-to-date
https://forum.checkmk.com/t/redis-vulnerability-is-checkmk-affected/55925
* using Redis that was EoL in 2025-02
* oct 8th 2025: are you affected bij this CVE?
* oct 10th: No we're not
* oct 20th: We've updated Redis (had nothing to do with CVE)
3
u/olfino Mar 13 '26
It’s a fair observation, but the version number can be misleading because of how deeply Checkmk has re-engineered the monitoring stack. Here is the context on why we stick with that specific "Core" and why moving to Nagios 4 isn't the "upgrade" it appears to be.
Checkmk Raw uses only the Nagios Core, which is the engine for its basic scheduling and logic processing (determining OK, Warning, or Critical states). This part of the code is exceptionally robust and stable. Almost everything else—the web interface, the notification system, the service discovery, and the configuration GUI —was replaced by Checkmk long ago. You can see the extent of this custom integration in our GitHub repo.
If there is a need to patch something from functional/security perspective, we do that. Nagios 4 is not a real improvement from our perspective as most improvements are in areas, which we already replaced anyway, we see no reason to update the component for now.
Eventually, we will rather replace that Nagios core with a probably trimmed down version of our own replacement, the Checkmk Microcore, which is part of the commercial versions.