Nagios is a scheduler wrapped around a state machine. The daemon decides when each check runs, executes a small program, and interprets a single exit code — 0, 1, 2 or 3 — plus one line of text. Everything else in the system is a consequence of that contract, which is why Nagios can monitor anything anyone is willing to write a script for, and why writing good plugins is a core skill rather than an advanced one.
The state machine is where operational behaviour is decided. A failing check first enters a SOFT state and is retried at the retry interval; only after max_check_attempts does it become HARD, and only a HARD state change generates a notification. That single mechanism prevents a transient failure from paging anyone. Layered on top are notification periods and escalations, acknowledgements, scheduled downtime, flap detection based on state change history, and freshness checking for results that are supposed to arrive but have not.
Configuration is object-based and inherited: hosts, services, hostgroups, servicegroups, contacts, contactgroups, commands, timeperiods and templates, with macros substituting values at execution time. Whether an estate stays maintainable at a thousand services depends almost entirely on how deliberately that template and group structure was designed. Two further mechanisms decide whether alerts stay useful — host parent relationships, which let Nagios distinguish a host that is DOWN from one that is merely UNREACHABLE behind a failed router, and explicit host and service dependencies that suppress alerts caused by something already known to be broken. Checks themselves may be active, run by the scheduler, or passive, submitted from elsewhere through the external command file or an NRDP or NSCA receiver — which is how distributed pollers, remote sites and event-driven sources feed one central view.
Why this skill matters now
Monitoring split into two worlds and most organisations now live in both. Metrics-first systems took the workloads that emit metrics natively — containers, cloud services, modern applications — while an enormous installed base of hosts, appliances, network gear and physical equipment continued to be watched by check-based systems because nothing else asks a simple question and gets a simple answer. The skill that is now scarce is running that half competently instead of neglecting it until it becomes noise.
The noise problem is the real driver. A monitoring system that pages on every symptom of one underlying failure trains people to ignore it, and the fix is structural: correct parent topology, dependencies, sensible check and retry intervals, notification escalation, downtime discipline and flap detection. Those are Nagios features that exist and are widely unused, and turning them on properly is often the single largest improvement available to an operations team.
The third pressure is coexistence. Teams running both Nagios and Prometheus need a decision about which system owns which signal, how alerts converge on one escalation path, and how to migrate the parts that should move without losing the parts that should not. Doing that deliberately requires understanding both models — which is why demand here is for judgement about monitoring architecture rather than for installation instructions.