IT monitoring: which tool should you choose?
Updated on 7 November 2026. Features, licences, prices and versions checked on 7 November 2026 on the vendors' websites and documentation.
Why this is a decision for management
A disk filling up, a backup silently failing for three weeks, a service stopping at night, repeated login attempts on the server: in a small business these signals almost always exist before the outage or the intrusion. They are simply invisible, because nobody is looking at them.
Monitoring means making these signals visible and making sure someone is alerted at the right time. The choice of tool commits the business for years: it decides what you see, who receives the alerts, where your data goes, and what the solution costs in licences and maintenance time.
This comparison starts from a precise need: monitor the health of computers and servers, be alerted when something is wrong, and analyse Windows and Linux logs. It compares a commercial reference solution (NinjaOne), eight free or open tools, and the « home-made » option.
Three jobs not to confuse
Before comparing tools, separate three needs, because each tool was born for one of them.
| Job | The question it answers | Examples |
|---|---|---|
| Remote endpoint management (RMM) | Are my PCs up to date and healthy, and can I work on them without travelling? | NinjaOne, Tactical RMM, MeshCentral (remote control only) |
| Monitoring | Are my servers, services, disks and network devices working, and am I alerted when a threshold is crossed? | Zabbix, Checkmk, Netdata |
| Log management and security | What happened, when, on which machine, and is this behaviour suspicious? | Wazuh, Graylog, Grafana Loki |
RMM stands for Remote Monitoring and Management. An RMM can install updates, run a script, take control of a computer. A monitoring tool measures continuously and alerts. A log tool centralises the events written by Windows and Linux, lets you search them and, for the most security-oriented ones (known as SIEM, Security Information and Event Management), applies detection rules.
Free is not open source: the four licence families
The licence question is not a legal detail: it decides what you are allowed to do, what happens if the vendor changes its policy, and what your IT provider may charge you for.
- Open source: the licence meets the Open Source Initiative (OSI) definition. You may use, modify and redistribute the software, including commercially. Examples here: Apache 2.0, GPLv2, GPLv3, AGPLv3.
- Source available: the code can be read and often used for free, but the licence imposes restrictions that exclude it from the open source definition. This is the case for the SSPL (Graylog) and for Tactical RMM's own licence.
- Free: the software costs nothing, whatever its licence. A free edition may be closed (proprietary) or capped.
- Commercial: paid licence or subscription, closed code, vendor support. NinjaOne is the example here.
Some tools mix families: at Netdata, the collection engine is open source, but the graphical interface shipped by default is under a proprietary licence.
The nine tools and the home-made option, one by one
NinjaOne: the commercial reference
What it is. An endpoint and server management platform delivered as SaaS (hosted by the vendor, an American company). It covers monitoring, alerts, patching of Windows, macOS and Linux and more than 200 third-party applications, remote control, inventory, documentation, and as options backup and mobile device management.
Supported systems. Windows, macOS and Linux, plus a separate module for mobile devices.
Logs. NinjaOne can trigger an alert on a specific Windows event (event ID and source) and offers « critical events » conditions. This is useful for reacting, but it is not a log search and analysis platform: there is no equivalent for exploring the history of Linux logs or correlating events across machines.
Licence and price. Commercial, closed code. The vendor shows a price per device per month ranging from 3.75 dollars (50 devices or fewer) to 1.50 dollars (10,000 devices), varying by region and modules; the exact rate is quoted. No free edition, but a 14-day trial. Onboarding, training and support are included at no extra cost according to the vendor.
Recent changes. Acquisition of Dropsuite (SaaS backup and email archiving) completed in 2025, Mac management through MDM, a vulnerability management module. The company claims nearly 40,000 customers in 2026.
For whom. A small business or an IT provider that wants a complete tool maintained by someone else, and accepts a subscription and hosting outside its walls.
MeshCentral: open remote control
What it is. A web server you install yourself to take control of computers remotely: desktop, terminal, file transfer, remote wake-up (Wake-on-LAN), technician activity log, session recording. It is the self-hosted equivalent of TeamViewer, with management features.
Supported systems. Agent for Windows, Linux (x86 and ARM), macOS and FreeBSD; Node.js server on Windows, Linux or macOS.
Monitoring and logs. Limited: MeshCentral shows whether a device is on and connected and displays system information, but it offers no monitoring with thresholds, history and alerts, and does not analyse logs. It is not a monitoring tool.
Licence. Open source (Apache 2.0), free. The project was backed by Intel until 2022 and is now maintained by the community.
For whom. As a remote control building block, notably within Tactical RMM, which includes it.
Tactical RMM: a free RMM, but not open source
What it is. A self-hosted RMM: remote control (via built-in MeshCentral), terminal, scripts (PowerShell, batch, bash, Python…), Windows patching, service control, event log viewer, automated checks with email, SMS or webhook alerts (CPU, disk, memory, services, scripts, event logs), hardware and software inventory, software installation through Chocolatey.
Supported systems. Agents for Windows 7, 8.1, 10, 11 and Windows Server 2008 R2 to 2025. Linux and macOS agents, but only for sponsors (see below); they offer fewer features than the Windows agent.
Licence. Source available, not open source: the licence says so itself. It allows hosting and use to manage your own systems and your customers' systems, but does not allow, without written approval from AmidaWare, offering installation or configuration services, use within a SaaS product or a managed hosting service.
Free, but. Basic Windows agents are free. Digitally signed Windows agents (less often blocked by antivirus software), Linux and macOS agents and single sign-on (SSO) require a sponsorship of at least 55 dollars per month or 600 dollars per year (tier suggested below 200 agents); the reporting module requires the next tier (80 dollars per month).
Prerequisites. A Debian 11 or 12 or Ubuntu 22.04 virtual machine with at least 4 GB of memory, a domain name and three subdomains (rmm, api, mesh). The chosen names cannot be changed later without a paid migration.
For whom. A mostly Windows small business, with an IT person comfortable with Linux, that wants an RMM without a per-device subscription.
Zabbix: the most complete open monitoring
What it is. A distributed monitoring platform: servers, workstations, services, databases, network (SNMP), websites, with ready-made templates, triggers (thresholds and conditions), alerts and dashboards.
New: Zabbix 8.0 LTS, released on 5 November 2026. This long-term support release has full support until 30 November 2029 and limited support until 30 November 2031. It notably adds OpenTelemetry support (application traces), optional history storage in ClickHouse, dashboard import and export and a modernised interface. It also raises the minimum database versions (PostgreSQL 15, MySQL 8.4, MariaDB 10.11): check before any upgrade.
Supported systems. Server on Linux; agents for Windows, Linux, macOS and other Unix systems.
Logs. Zabbix can monitor log files and, on Windows, the event log (for example failed logons, event 4625) and trigger an alert. It reacts to events chosen in advance; it does not replace a log search tool.
Licence. Open source: AGPLv3 since version 7.0 (GPLv2 before). Free for commercial use; the vendor sells support, training and services.
For whom. A business with several servers, network equipment, services to watch, and someone to build and maintain the configuration.
Checkmk Community: monitoring that is quicker to set up
What it is. A monitoring platform known for its automatic discovery: you install the agent and Checkmk itself proposes the services to monitor. Servers, network, applications, virtualisation, containers.
Recent change. With version 2.5 (spring 2026), the editions were renamed: the former « Raw Edition » is now called Checkmk Community, the Enterprise edition becomes Pro, Cloud becomes Ultimate.
What the Community edition lacks. It relies on the Nagios core, less efficient than the paid editions' own core, and does not have the « Agent Bakery » that builds and updates agents automatically, nor the advanced reports. It does not, however, limit the number of hosts.
The limited free alternative. Since 2.5, Checkmk Pro (like Ultimate) can be used for free after the trial, but limited to 750 services and one site. As a host often counts several dozen services, this matches a small infrastructure.
Licence. Community: open source (GPLv2). Pro and Ultimate: commercial.
For whom. A small business that wants serious monitoring without spending weeks configuring everything by hand.
Netdata: real-time monitoring, with a ceiling
What it is. A lightweight agent that measures everything every second, detects anomalies with machine learning and generates dashboards and alerts without configuration.
Supported systems. Linux and, with the native Windows agent, Windows Server 2012 to 2025, Windows 10 and 11.
Logs. Netdata offers an explorer for systemd journals (Linux) and Windows events, available with a free account. It is an efficient local viewer, not long-term log centralisation.
Licence. Mixed: the agent is open source (GPLv3+), but the default graphical interface is under a proprietary licence (NCUL1).
The limit that matters. The free offer (Community) limits dashboard access to 5 nodes, in Netdata Cloud and on the agents' local dashboards. Beyond that, nodes keep collecting their data but appear locked. Paid plans are counted per node.
For whom. A handful of Linux servers to diagnose in detail, or as a complement to another tool.
Wazuh: logs and security, open source
What it is. A security platform that combines SIEM and endpoint detection: log collection and analysis with a large set of detection rules, file integrity monitoring, configuration assessment (CIS benchmarks), vulnerability detection, automated response.
Supported systems. Agents for Linux, Windows, macOS, Solaris, AIX and HP-UX. By default the Windows agent collects the System, Application and Security channels, and can follow others (PowerShell, remote desktop…).
Prerequisites. Central components on 64-bit Linux. For 1 to 25 agents, the vendor recommends 4 virtual CPUs, 8 GB of memory and 50 GB of disk (90 days of alerts); 8 virtual CPUs from 26 to 100 agents.
Version. The stable version is 4.14 (4.14.10 of 5 November 2026). Version 5.0, a major overhaul, is in testing: the beta documentation states that a 4.x installation cannot be upgraded in place. Better to start with 4.14 today, knowing that a migration is coming.
Licence. Open source (GPLv2), free. Wazuh sells a hosted offer (Wazuh Cloud) and support.
For whom. Any small business that wants to centralise and watch its logs from a security angle, without licence costs.
Graylog: log search, source available
What it is. A log centralisation and search platform: intake from multiple sources, processing pipelines, fast search, dashboards and alerts.
Licence. Source available, not open source: since version 4.0, Graylog Open is under the SSPL, a licence the OSI has not approved. For internal use it is free with no volume limit; the restriction mainly targets those who would offer Graylog as a service to third parties.
Recent changes. The free licence programme for small businesses (Enterprise edition up to 2 GB per day) ended on 31 December 2025; Graylog Open now includes a limited version of Illuminate, its ready-made analysis content. Graylog 7.0 requires Java 21 (shipped in the packages) and at least MongoDB 7.0, and favours its « Data Node » (OpenSearch); Elasticsearch is deprecated.
Prerequisites. Three components (Graylog, MongoDB, Data Node) on a well-equipped Linux server: in tests the stack uses about 4 GB of memory at idle, so plan for at least 8 GB. Windows logs arrive through a collector installed on the machines.
For whom. A team that above all wants to search large volumes of logs quickly. Advanced SIEM features are in the paid editions.
Grafana Loki: low-cost logs, « observability » style
What it is. A log storage system that indexes only labels (machine, service, level…) and not the full text, which makes it economical on storage. You query and visualise it with Grafana, often already used for metrics.
Collection. The former Promtail collector reached end of life on 2 March 2026 and has been removed from Loki; you now need Grafana Alloy, which also reads the Windows event log.
Licence. Open source: Loki and Grafana have been under AGPLv3 since 2021; the agents, including Alloy, remain under Apache 2.0.
For whom. A team already comfortable with Grafana and Prometheus that wants low-cost logs next to its metrics. For security, you have to write your own alert rules.
The « home-made » solution
What it is. Assembling building blocks supplied by the systems themselves and a few scripts: Windows event forwarding (Windows Event Forwarding, built into Windows) to a collector server, forwarding of Linux logs (rsyslog or journald), scheduled PowerShell or shell scripts that check disks, services and backups and send an email.
Advantages. No licence, no third-party agent, full control.
Limits. No dashboard, no usable history without a search tool, alerts to maintain by hand, and knowledge concentrated in one head. Microsoft itself points out that if a computer's log is overwritten while it is not connected to the collector, no notification reports the lost events.
For whom. A very small fleet, or a targeted complement (for example an alert on a failing backup) next to an off-the-shelf tool.
The comparison table
| Tool | Main job | Licence | What is free | Hosting |
|---|---|---|---|---|
| NinjaOne | Complete RMM | Commercial | 14-day trial | Vendor cloud |
| MeshCentral | Remote control | Open source (Apache 2.0) | Everything | Your premises |
| Tactical RMM | RMM | Source available | Unsigned Windows agents | Your premises |
| Zabbix | Monitoring | Open source (AGPLv3) | Everything | Your premises |
| Checkmk Community | Monitoring | Open source (GPLv2) | Everything (Nagios core) | Your premises |
| Netdata | Real-time monitoring | Agent GPLv3+, proprietary interface | Up to 5 visible nodes | Agent on your premises, Cloud or local interface |
| Wazuh | Logs and security | Open source (GPLv2) | Everything | Your premises (or paid cloud) |
| Graylog Open | Log search | Source available (SSPL) | Everything, unlimited volume | Your premises |
| Grafana Loki | Log storage | Open source (AGPLv3) | Everything | Your premises (or paid cloud) |
| Home-made | Case by case | Depends on the blocks | Everything | Your premises |
The same tools, from the systems, logs and effort angle:
| Tool | Windows endpoints | Linux | Windows and Linux logs | Setup effort |
|---|---|---|---|---|
| NinjaOne | Yes | Yes | Alerts on Windows events, no analysis | Low |
| MeshCentral | Yes | Yes | No | Low |
| Tactical RMM | Yes | Sponsors only | Windows viewing and alerts | Medium |
| Zabbix | Yes | Yes | Alerts on chosen events | High |
| Checkmk Community | Yes | Yes | Limited | Medium |
| Netdata | Yes | Yes | Local viewer | Low |
| Wazuh | Yes | Yes | Yes, with security rules | Medium |
| Graylog Open | Through a collector | Yes | Yes, powerful search | Medium to high |
| Grafana Loki | Through Alloy | Yes | Yes, rules to write | Medium to high |
| Home-made | Yes | Yes | Collection only | High and permanent |
One tool or a combination?
For the need described (machine health, alerts, Windows and Linux logs), a combination of two tools covers the ground better than a single tool. RMM and monitoring tools cannot analyse logs; log tools do not handle patching or remote control. Here are three consistent combinations, depending on your fleet.
| Your situation | Suggested combination | Why |
|---|---|---|
| Small business, mostly Windows PCs and one or two servers | Tactical RMM + Wazuh, or NinjaOne + Wazuh if you prefer a hosted service | The RMM manages endpoints (patches, scripts, basic alerts, remote control); Wazuh centralises logs and detects suspicious behaviour |
| Several Windows and Linux servers, network to watch | Zabbix or Checkmk Community + Wazuh + MeshCentral | Full monitoring of servers and network, security through logs, open remote control |
| Technical team already on Grafana | Netdata or Zabbix + Grafana Loki (with Alloy) | Metrics and logs in the same interface; to be completed with security rules you write yourself |
Two rules apply to every combination. First, a single alert channel: if each tool sends its emails its own way, nobody reads them any more. Second, every tool added is one more piece of software to update and protect. An RMM, in particular, holds the keys to all your machines: in 2025 Microsoft described intrusions that began by exploiting this kind of tool. We covered this in our article on external access audits.
In practice: three options
| Option | What it costs | The risk |
|---|---|---|
| Do nothing | Nothing, until the outage | Discovering the problem when work stops: full disk, backup dead for weeks, intrusion spotted too late |
| Install free tools yourself | Licences are free (apart from the Tactical RMM sponsorship), but you need a server and time: installation, threshold tuning, updates, alert sorting | A badly tuned tool cries wolf or stays silent at the wrong moment; an exposed or unpatched platform itself becomes a way in |
| Get support | A commercial subscription, or a provider who installs and maintains open tools | The lowest, if roles are clear: who receives the alerts, who acts, within what time |
To give an order of magnitude: for 30 devices, NinjaOne's highest public rate (3.75 dollars per device per month) comes to about 1,350 dollars per year, excluding options. The minimum Tactical RMM sponsorship (for Linux, macOS and signed agents) costs 600 dollars per year up to 200 agents. The other tools have no licence cost, but need a server and working hours.
Example (illustrative case): an engineering office of 18 people, 18 Windows PCs, a Windows file server, a small Linux server hosting the website, and a NAS. Before: no monitoring, backups checked « when someone thinks of it ». After: an RMM on the PCs (automatic patches, alert when a disk exceeds 90 %, remote control), Wazuh on a small Linux server receiving the logs of the file server and the web server, with alerts on series of failed logons, creation of administrator accounts and the backup service stopping, and a single destination address for all alerts. In the second week, the alerts report an almost full disk on the file server and a backup job that had been failing since a password change.
For your IT person
- Versions as of 7 November 2026: Zabbix 8.0.0 LTS (5 November 2026), Checkmk 2.5, Wazuh 4.14.10 (5.0 in testing, no in-place upgrade from 4.x), Graylog 7.x, Loki 3.7.x, MeshCentral 1.x.
- Zabbix 8.0: minimum databases PostgreSQL 15 (TimescaleDB 2.20+), MySQL 8.4, MariaDB 10.11. Windows event log in active checks only, for example
eventlog[Security,,,,4625,,skip], with afind()trigger. - Wazuh:
log_formateventchannelfor modern Windows channels (System, Application, Security by default; addMicrosoft-Windows-PowerShell/Operational,Microsoft-Windows-TerminalServices-RemoteConnectionManager), XPath filters through<query>. Disable the repositories after installation, as the vendor recommends, to avoid an unplanned upgrade. - Loki: replace Promtail with Alloy (configuration conversion tool provided);
loki.source.windowseventfor Windows. The Helm chart has been maintained by the community since 16 March 2026. - Graylog 7: Java 21 included, MongoDB 7.0 or later (watch out for AVX on some VMs with recent MongoDB), Data Node recommended, Elasticsearch deprecated and OpenSearch 1.x removed in 8.0.
- Tactical RMM: Debian 12 recommended (smaller memory footprint), no CPU-throttled VMs; three DNS records (rmm, api, mesh) and a Let's Encrypt wildcard certificate via a TXT record. The licence forbids selling installation or configuration services without written approval from AmidaWare.
- Netdata: the 5-node limit also applies to the local dashboard of a parent agent, even without a Cloud connection.
- Windows Event Forwarding (home-made option or feeding a SIEM): subscriptions through GPO, WEC collector, ForwardedEvents channel; no notification of event loss on the source side.
- Platform security: no console (RMM, Zabbix, Wazuh, Graylog, Grafana) exposed directly on the Internet; access through a VPN with two-factor authentication, named accounts, updates followed like those of a firewall.
Test yourself
Sources
AmidaWare. (n.d.-a). License. Tactical RMM Documentation. https://docs.tacticalrmm.com/license/
AmidaWare. (n.d.-b). Sponsor Tactical RMM. Tactical RMM Documentation. https://docs.tacticalrmm.com/sponsor/
AmidaWare. (n.d.-c). Tactical RMM Documentation. https://docs.tacticalrmm.com/
AmidaWare. (n.d.-d). Installation. Tactical RMM Documentation. https://docs.tacticalrmm.com/install_server
Checkmk. (n.d.-a). Checkmk Pro. https://checkmk.com/product/checkmk-pro
Checkmk. (n.d.-b). Checkmk Pro [User guide]. Checkmk User Guide. https://docs.checkmk.com/latest/en/cse.html
Checkmk. (n.d.-c). Werk #19391: Checkmk edition renaming. https://checkmk.com/werk/19391
Computingforgeeks. (2026). [Tutorial on installing Graylog 7 on Rocky Linux and AlmaLinux]. https://computingforgeeks.com/install-graylog-rocky-linux-almalinux/
Grafana Labs. (2021, April 20). Grafana, Loki, and Tempo will be relicensed to AGPLv3. https://grafana.com/blog/2021/04/20/grafana-loki-tempo-relicensing-to-agplv3
Grafana Labs. (2025, February 13). Grafana Loki 3.4: Standardized storage config, sizing guidance, and Promtail merging into Alloy. https://grafana.com/blog/2025/02/13/grafana-loki-3-4-standardized-storage-config-sizing-guidance-and-promtail-merging-into-alloy/
Grafana Labs. (n.d.). loki.source.windowsevent. Grafana Alloy documentation. https://grafana.com/docs/alloy/next/reference/components/loki/loki.source.windowsevent/
Graylog. (n.d.-a). The SMB License Program Ended December 31, 2025. https://graylog.org/?p=8716
Graylog. (n.d.-b). Upgrade to Graylog 7.0. Graylog Documentation. https://go2docs.graylog.org/current/upgrading_graylog/upgrade_to_graylog_7.0.htm
MeshCentral. (n.d.). Manageability features [PDF]. https://meshcentral.com/docs/managementfeatures.pdf
Microsoft. (n.d.). Use Windows Event Forwarding to help with intrusion detection. Microsoft Learn. https://learn.microsoft.com/en-us/windows/security/operating-system-security/device-management/use-windows-event-forwarding-to-assist-in-intrusion-detection
Microsoft Security Experts. (2025). Keys to the kingdom: RMM exploits enabling human-operated intrusions in 2024–25. Microsoft Community Hub. https://techcommunity.microsoft.com/t5/microsoft-security-experts-blog/keys-to-the-kingdom-rmm-exploits-enabling-human-operated/ba-p/4410903
Netdata. (2026, October 29). Access control and feature availability. Netdata Learn. https://learn.netdata.cloud/docs/security-and-privacy-design/access-control-and-feature-availability
Netdata. (n.d.-a). Netdata for Windows. https://www.netdata.cloud/windows-monitoring
Netdata. (n.d.-b). Windows Events plugin. Netdata Learn. https://learn.netdata.cloud/docs/logs-management/windows-event-logs
NinjaOne. (n.d.-a). Policy condition types explained. NinjaOne Docs. https://www.ninjaone.com/docs/policies-and-conditions/conditions/policy-condition-types-explained/
NinjaOne. (n.d.-b). Pricing for the #1 Unified IT Operations Platform. https://ninjaone.com/pricing/
NinjaOne. (n.d.-c). Why NinjaOne. https://www.ninjaone.com/why-ninjaone/
Wazuh. (n.d.-a). Configuring log collection for different operating systems. Wazuh documentation. https://documentation.wazuh.com/current/user-manual/capabilities/log-data-collection/configuration.html
Wazuh. (n.d.-b). Quickstart. Wazuh documentation. https://documentation.wazuh.com/current/quickstart.html
Wazuh. (n.d.-c). Release notes. Wazuh documentation. https://documentation.wazuh.com/current/release-notes/
Wikipedia. (2026). MeshCentral. https://en.wikipedia.org/wiki/MeshCentral
Zabbix. (2026, November 5). Release notes for Zabbix 8.0.0. https://www.zabbix.com/release_notes
Zabbix. (n.d.-a). Zabbix license. https://www.zabbix.com/license
Zabbix. (n.d.-b). Zabbix life cycle and release policy. https://www.zabbix.com/life_cycle_and_release_policy
Zabbix. (n.d.-c). Monitor Windows event log using active checks. Zabbix documentation. https://www.zabbix.com/documentation/current/en/manual/guides/monitor_windows_eventlog