For example, it can notify you when a disk is running out of space, a service stops responding, or CPU usage becomes unusually high. Whether you’re monitoring a single VPS or multiple servers across different locations, Icinga 2 helps you track system health and performance from one place.
It also stores monitoring data in a database, making it easy to view historical trends, create reports, and integrate with web-based dashboards.
In this guide, you’ll learn how to install Icinga 2 on Rocky Linux 10. By the end, you’ll have the Icinga 2 monitoring service running, the required monitoring plugins installed, and the Icinga API enabled, which is needed if you plan to connect Icinga to a database backend or use the Icinga Web interface later.
Although this tutorial was tested on Rocky Linux 10, but the same instructions should also work on RHEL 10 and AlmaLinux 10.
What Is Icinga 2 and Why Use It?
Icinga 2 is a modern monitoring platform that helps administrators detect and fix problems before they affect users. It began as a fork of Nagios in 2009, but over time evolved into a completely redesigned monitoring solution with a more flexible architecture, easier configuration, and better scalability.
Unlike traditional monitoring tools that rely heavily on static configuration files, Icinga 2 uses its own configuration language, making it easier to define hosts, services, and monitoring rules. It also includes a built-in REST API, allowing administrators to automate monitoring tasks and integrate Icinga with other tools and services.
One of Icinga 2’s biggest strengths is its distributed monitoring architecture. You can run a central monitoring server and connect satellite nodes or agents across different locations, making it suitable for everything from a small home lab to a large enterprise environment.
At its core, Icinga 2 continuously performs health checks on your systems and services. When a problem is detected, it records the event and can send alerts through various notification methods so you can respond quickly.
A complete Icinga monitoring setup typically consists of four main components:
- Icinga 2 – The core monitoring engine that performs checks, processes results, and manages alerts.
- IcingaDB – The backend service that collects monitoring data and synchronizes it through Redis into a database.
- MariaDB – The database server that stores monitoring history, events, and performance metrics.
- Icinga Web 2 – A web-based dashboard for viewing system status, investigating issues, acknowledging alerts, and managing downtime.
In this guide, we’ll focus on installing and configuring the Icinga 2 core monitoring engine. Once the core service is running, you’ll be ready to add a database backend and web interface in later steps.
For a complete production-ready deployment, including IcingaDB, MariaDB, and Icinga Web 2, follow the Icinga 2 Complete Monitoring Series available on Pro TecMint.
Prerequisites
Before you start, make sure you have:
- A fresh Rocky Linux 10 server (minimal install is fine).
- A non-root user with sudo privileges, or root access directly.
- At least 1 GB RAM and 10 GB disk space.
- An active internet connection for downloading packages.
- Port 5665/tcp is accessible on your firewall, since Icinga 2 uses it for agent communication.
Step 1: Update the System
Before installing Icinga 2, make sure your system is fully up to date, as it helps avoid package conflicts and ensures you’re working with the latest security fixes and software updates.
sudo dnf update -y
If the update installs a new kernel version, reboot the server so the system starts using the updated kernel:
sudo reboot
After the server comes back online, reconnect through SSH and verify that the system is running normally before proceeding to the next step.
Step 2: Enable EPEL and CRB Repositories
Icinga 2 relies on several packages that are not available in the default Rocky Linux repositories. To install these dependencies successfully, you need to enable both the CRB (CodeReady Builder) repository and the EPEL (Extra Packages for Enterprise Linux) repository.
The CRB repository provides additional development and library packages that many EPEL packages depend on. If CRB is not enabled, you may encounter dependency errors during the installation process.
First, enable the CRB repository:
sudo dnf config-manager --set-enabled crb
Next, install the EPEL repository package:
sudo dnf install -y epel-release
To verify that the repositories are enabled, run:
sudo dnf repolist
You should see entries for both crb and epel in the repository list.
repo id repo name appstream Rocky Linux 10 - AppStream baseos Rocky Linux 10 - BaseOS crb Rocky Linux 10 - CRB epel Extra Packages for Enterprise Linux 10 - x86_64 extras Rocky Linux 10 - Extras
The output confirms both the CRB and EPEL repos are now active. If you skip CRB and only install EPEL, you’ll hit dependency errors when installing the monitoring plugins later. That’s the most common mistake on a fresh install.
If this helped you get past the repo setup headache, who’s setting up their first monitoring server.
Step 3: Add the Icinga Repository
Icinga 2 packages are not available in the default repositories, so you’ll need to add the official Icinga package repository before installation.
First, import the Icinga GPG signing key that allows DNF to verify that the packages you install are authentic and haven’t been modified.
sudo rpm --import https://packages.icinga.com/icinga.key
Next, create a repository configuration file for the Icinga stable packages:
sudo tee /etc/yum.repos.d/icinga-stable-release.repo << 'EOF' [icinga-stable-release] name=Icinga Stable Release (Fedora 40) baseurl=https://packages.icinga.com/fedora/40/release/ enabled=1 gpgcheck=1 gpgkey=https://packages.icinga.com/icinga.key EOF
Once the repository file has been created, verify that DNF can see it:
sudo dnf repolist | grep icinga
If everything is configured correctly, you’ll see output similar to:
icinga-stable-release Icinga Stable Release (Fedora 40)
If no output is returned, check that the repository file exists and contains the correct configuration:
cat /etc/yum.repos.d/icinga-stable-release.repo
Review the contents for any typos, then run sudo dnf repolist again to confirm the repository is loaded successfully.
Step 4: Install Icinga 2
Now that the Icinga repository is configured, you can install the Icinga 2 monitoring engine.
On Rocky Linux 10, it’s important to install both the icinga2 package and the icinga2-selinux package, as it provides the permissions Icinga 2 needs to operate correctly when SELinux is running in enforcing mode, which is the default on Rocky Linux.
Install both packages with:
sudo dnf install -y icinga2 icinga2-selinux
Once the installation finishes, verify that the packages were installed successfully:
rpm -qa | grep icinga2
You should see entries similar to:
icinga2-bin-2.15.0-1.fc40.x86_64 icinga2-common-2.15.0-1.fc40.x86_64 icinga2-2.15.0-1.fc40.x86_64 icinga2-selinux-2.15.0-1.fc40.x86_64
Step 5: Install the Monitoring Plugins
At this point, Icinga 2 is installed, but it can’t actually monitor anything yet. Think of Icinga 2 as the monitoring engine that schedules checks and processes results, but the actual checks are performed by external monitoring plugins, and each plugin is designed to test a specific service or resource, such as disk usage, CPU load, memory consumption, website availability, or network connectivity.
For example:
check_diskmonitors available disk space.check_loadmonitors system load averages.check_pingtests network connectivity and latency.check_httpverifies that a website or web service is responding correctly.
The easiest way to install the complete plugin collection is to install the nagios-plugins-all package from EPEL:
sudo dnf install -y nagios-plugins-all
After installation, the plugins are stored in /usr/lib64/nagios/plugins/ and you can verify that the plugins were installed successfully by listing the directory contents:
ls /usr/lib64/nagios/plugins/
The output should show dozens of available check commands, including check_disk, check_http, check_ping, check_load, and many others.
total 9524 -rwxr-xr-x. 1 root root 2348 Feb 23 05:30 check_breeze -rwxr-xr-x. 1 root root 37544 Feb 23 05:30 check_by_ssh lrwxrwxrwx. 1 root root 9 Feb 23 05:30 check_clamd -> check_tcp -rwxr-xr-x. 1 root root 32856 Feb 23 05:30 check_cluster -rwsr-x---. 1 root root 37032 Feb 23 05:30 check_dhcp -rwxr-xr-x. 1 root root 37280 Feb 23 05:30 check_dig -rwxr-xr-x. 1 root root 54648 Feb 23 05:30 check_disk -rwxr-xr-x. 1 root root 10136 Feb 23 05:30 check_disk_smb -rwxr-xr-x. 1 root root 49504 Feb 23 05:30 check_dns -rwxr-xr-x. 1 root root 15840 Feb 23 05:30 check_dummy -rwxr-xr-x. 1 root root 5068 Feb 23 05:30 check_file_age -rwxr-xr-x. 1 root root 6506 Feb 23 05:30 check_flexlm -rwsr-x---. 1 root root 37224 Feb 23 05:30 check_fping ...
Icinga 2’s default configuration already knows where these plugins are located, so you don’t need to modify any paths or configuration files. As soon as the plugins are installed, Icinga can begin using them to monitor hosts and services.
Step 6: Start and Enable Icinga 2
With Icinga 2 and the monitoring plugins installed, it’s time to start the monitoring service.
sudo systemctl start icinga2 sudo systemctl enable --now icinga2
Next, verify that the service is running correctly:
sudo systemctl status icinga2
A healthy installation should display something similar to:
● icinga2.service - Icinga host/service/network monitoring system
Loaded: loaded (/usr/lib/systemd/system/icinga2.service; enabled; preset: disabled)
Drop-In: /etc/systemd/system/icinga2.service.d
└─limits.conf
Active: active (running) since Thu 2026-06-04 14:12:38 IST; 9s ago
Invocation: 7cac86204bbb4e118bde51165e5fa04b
Main PID: 4341 (icinga2)
Status: "Startup finished."
Tasks: 21
Memory: 12.8M (peak: 13.3M)
CPU: 136ms
CGroup: /system.slice/icinga2.service
├─4341 /usr/lib64/icinga2/sbin/icinga2 --no-stack-rlimit daemon --close-stdio -e /var/log/icinga2/error.log
├─4369 /usr/lib64/icinga2/sbin/icinga2 --no-stack-rlimit daemon --close-stdio -e /var/log/icinga2/error.log
└─4378 /usr/lib64/icinga2/sbin/icinga2 --no-stack-rlimit daemon --close-stdio -e /var/log/icinga2/error.log
Jun 04 14:12:38 localhost.localdomain icinga2[4369]: [2026-06-04 14:12:38 +0530] information/ConfigItem: Instantiated 247 CheckCommands.
Jun 04 14:12:38 localhost.localdomain icinga2[4369]: [2026-06-04 14:12:38 +0530] information/ConfigItem: Instantiated 1 User.
Jun 04 14:12:38 localhost.localdomain icinga2[4369]: [2026-06-04 14:12:38 +0530] information/ConfigItem: Instantiated 1 UserGroup.
Jun 04 14:12:38 localhost.localdomain icinga2[4369]: [2026-06-04 14:12:38 +0530] information/ConfigItem: Instantiated 3 ServiceGroups.
Jun 04 14:12:38 localhost.localdomain icinga2[4369]: [2026-06-04 14:12:38 +0530] information/ConfigItem: Instantiated 3 TimePeriods.
Jun 04 14:12:38 localhost.localdomain icinga2[4369]: [2026-06-04 14:12:38 +0530] information/ConfigItem: Instantiated 11 Services.
Jun 04 14:12:38 localhost.localdomain icinga2[4369]: [2026-06-04 14:12:38 +0530] information/ConfigItem: Instantiated 1 ScheduledDowntime.
Jun 04 14:12:38 localhost.localdomain icinga2[4369]: [2026-06-04 14:12:38 +0530] information/ScriptGlobal: Dumping variables to file '/var/cache/icinga2/icinga2.vars'
Jun 04 14:12:38 localhost.localdomain icinga2[4341]: [2026-06-04 14:12:38 +0530] information/cli: Closing console log.
Jun 04 14:12:38 localhost.localdomain systemd[1]: Started icinga2.service - Icinga host/service/network monitoring system.
If the service status shows failed instead of active (running), check the service logs for error messages:
sudo journalctl -u icinga2 -n 50
Step 7: Enable the Icinga 2 API
The Icinga 2 API allows external components to communicate with the monitoring engine such as IcingaDB, Icinga Web 2, distributed monitoring, and automation tools all rely on the API being enabled.
By default, the API feature is not configured, so you’ll need to run the built-in setup command to generate the required certificates and configuration files.
sudo icinga2 api setup
You should see output similar to the following:
information/cli: Generating new CA. information/base: Writing private key to '/var/lib/icinga2/ca//ca.key'. information/base: Writing X509 certificate to '/var/lib/icinga2/ca//ca.crt'. information/cli: Generating new CSR in '/var/lib/icinga2/certs//localhost.localdomain.csr'. information/base: Writing private key to '/var/lib/icinga2/certs//localhost.localdomain.key'. information/base: Writing certificate signing request to '/var/lib/icinga2/certs//localhost.localdomain.csr'. information/cli: Signing CSR with CA and writing certificate to '/var/lib/icinga2/certs//localhost.localdomain.crt'. information/pki: Writing certificate to file '/var/lib/icinga2/certs//localhost.localdomain.crt'. information/cli: Copying CA certificate to '/var/lib/icinga2/certs//ca.crt'. information/cli: Adding new ApiUser 'root' in '/etc/icinga2/conf.d/api-users.conf'. information/cli: Reading '/etc/icinga2/icinga2.conf'. information/cli: Enabling the 'api' feature. Enabling feature api. Make sure to restart Icinga 2 for these changes to take effect. information/cli: Updating 'NodeName' constant in '/etc/icinga2/constants.conf'. information/cli: Created backup file '/etc/icinga2/constants.conf.orig'. information/cli: Updating 'ZoneName' constant in '/etc/icinga2/constants.conf'. information/cli: Backup file '/etc/icinga2/constants.conf.orig' already exists. Skipping backup. Done.
Now restart your Icinga 2 daemon to finish the installation!
sudo systemctl restart icinga2
The Icinga 2 API listens on TCP port 5665, so confirm that the service is accepting connections, run:
sudo ss -tlnp | grep 5665
A successful result looks similar to:
LISTEN 0 4096 *:5665 *:* users:(("icinga2",pid=4617,fd=18))
If your server is running firewalld (the default firewall service), you’ll need to allow incoming connections on port 5665.
sudo firewall-cmd --permanent --add-port=5665/tcp sudo firewall-cmd --reload
With the firewall configured, your Icinga 2 server is ready to accept secure API connections from other Icinga components and monitored systems.
Step 9: Validate the Configuration
Before moving on, it’s a good idea to verify that the Icinga 2 configuration is valid. Even if you’ve only followed the installation steps so far, running the configuration check helps confirm that all required files, modules, and settings are loaded correctly.
Icinga 2 includes a built-in validation tool that checks configuration syntax and verifies references between objects.
sudo icinga2 daemon -C
A successful validation will produce output similar to:
[2026-06-04 14:21:57 +0530] information/cli: Icinga application loader (version: r2.15.0-1) [2026-06-04 14:21:57 +0530] information/cli: Loading configuration file(s). [2026-06-04 14:21:57 +0530] information/ConfigItem: Committing config item(s). [2026-06-04 14:21:57 +0530] information/ApiListener: My API identity: localhost.localdomain [2026-06-04 14:21:57 +0530] information/ConfigItem: Instantiated 12 Notifications. [2026-06-04 14:21:57 +0530] information/ConfigItem: Instantiated 2 NotificationCommands. [2026-06-04 14:21:57 +0530] information/ConfigItem: Instantiated 1 IcingaApplication. [2026-06-04 14:21:57 +0530] information/ConfigItem: Instantiated 2 HostGroups. [2026-06-04 14:21:57 +0530] information/ConfigItem: Instantiated 1 Host. [2026-06-04 14:21:57 +0530] information/ConfigItem: Instantiated 1 Downtime. [2026-06-04 14:21:57 +0530] information/ConfigItem: Instantiated 1 FileLogger. [2026-06-04 14:21:57 +0530] information/ConfigItem: Instantiated 3 Zones. [2026-06-04 14:21:57 +0530] information/ConfigItem: Instantiated 1 CheckerComponent. [2026-06-04 14:21:57 +0530] information/ConfigItem: Instantiated 1 Endpoint. [2026-06-04 14:21:57 +0530] information/ConfigItem: Instantiated 1 ApiUser. [2026-06-04 14:21:57 +0530] information/ConfigItem: Instantiated 1 ApiListener. [2026-06-04 14:21:57 +0530] information/ConfigItem: Instantiated 1 NotificationComponent. [2026-06-04 14:21:57 +0530] information/ConfigItem: Instantiated 247 CheckCommands. [2026-06-04 14:21:57 +0530] information/ConfigItem: Instantiated 1 User. [2026-06-04 14:21:57 +0530] information/ConfigItem: Instantiated 1 UserGroup. [2026-06-04 14:21:57 +0530] information/ConfigItem: Instantiated 3 ServiceGroups. [2026-06-04 14:21:57 +0530] information/ConfigItem: Instantiated 3 TimePeriods. [2026-06-04 14:21:57 +0530] information/ConfigItem: Instantiated 11 Services. [2026-06-04 14:21:57 +0530] information/ConfigItem: Instantiated 1 ScheduledDowntime. [2026-06-04 14:21:57 +0530] information/ScriptGlobal: Dumping variables to file '/var/cache/icinga2/icinga2.vars' [2026-06-04 14:21:57 +0530] information/cli: Finished validating the configuration file(s).
The most important line is:
Finished validating the configuration file(s).
Once the configuration validates successfully, your Icinga 2 installation is fully operational and ready for monitoring hosts and services.
If this is your first time installing Icinga 2, who’s still manually SSHing into servers to check if services are running.
What’s Next: Building the Full Monitoring Stack
At this stage, you have a fully functional Icinga 2 monitoring server running on Rocky Linux 10 wiht the monitoring engine, the monitoring plugins are installed, the API is enabled, and the configuration has been validated.
However, everything is currently running behind the scenes, but there is no web dashboard yet, and monitoring data is not being stored in a database. To build a complete monitoring platform, you’ll need to add the remaining Icinga components.
A production-ready Icinga deployment typically includes:
- Icinga 2 for monitoring and alerting.
- IcingaDB for collecting and synchronizing monitoring data.
- MariaDB for storing monitoring history and events.
- Icinga Web 2 for providing a web-based dashboard and management interface.
The complete setup is covered in the Icinga 2 Complete Monitoring Series on Pro TecMint, which is divided into four practical chapters.
top, htop, vmstat, iostat, sar, iotop, and other utilities that Linux administrators use every day to troubleshoot performance problems.Conclusion
In this guide, you installed Icinga 2 on Rocky Linux 10, enabled the required repositories, installed the monitoring plugins, configured the API, opened the firewall, and verified that the service is running correctly.
You now have a working Icinga 2 core installation that’s ready to be connected to IcingaDB and a web dashboard in the next stage of your deployment.
Now that your monitoring server is ready, what are you planning to monitor first? A website, a database server, application services, or basic system resources such as CPU, memory, and disk usage? Let us know in the comments and share how you’re using Icinga in your environment.
If this article helped, with someone on your team.
