Cacti, LibreNMS, Icinga and Observium: measuring the monitoring tier nobody replaces
Cacti, LibreNMS, Icinga and Observium: measuring the monitoring tier nobody replaces Monitoring platforms accumulate. They are installed by an engineer who has since moved teams, they hold credentials that grant access to everything they watch, and they are rarely included in application asset inventories. Four ZoomEye queries for this category show what is visible when someone looks. Context and…
The monitoring platform landscape is filled with various software solutions that collect and analyze data from network devices and servers. Among these platforms are Cacti, LibreNMS, Icinga, and Observium. According to data collected by ZoomEye on September 26, 2026, Cacti has an extensive presence with 17,703 instances, while LibreNMS registers 15,614 appearances.
These two open-source graphing platforms are similar in function and are frequently used by network and server administrators. However, Icinga and Observium, with only 64 and 5 instances respectively, are less commonly observed in web fingerprints. This discrepancy suggests that these platforms may have smaller user bases, or they might be underrepresented in web searches due to specific deployment methods, such as being behind authentication proxies or installed in isolated management segments.
The security implications of these platforms are significant. They all store sensitive credentials used for monitoring, making them prime targets for attacks. If an attacker gains access to a monitoring interface with default or reused credentials, they can potentially gain control over everything the platform can reach. Therefore, monitoring platforms should be treated as sensitive infrastructure.
They should be restricted to the management network, and remote access should be handled through a bastion host rather than direct exposure. Additionally, the credentials used by these platforms to poll other systems should be regularly audited and preferably limited to per-host credentials with restricted capabilities. Furthermore, monitoring servers should be kept up-to-date with the latest security patches, as an outdated monitoring server can serve as a gateway for attackers to access other systems.
When it comes to monitoring platform measurement, the figures for Cacti and LibreNMS provide a reliable basis for tracking changes over time. Organizations using these products can utilize the observed patterns to estimate the extent of their external reachability, offering a more practical outcome than a generic internet-wide total.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
