Zabbix, Checkmk, Prometheus or Netdata: monitoring compared 2026

Do you lack an overview of your systems? WZ-IT builds monitoring, sets up alerting with clear ownership and takes on operations, see managed operations. Discuss your setup

Monitoring comparisons usually list features side by side and arrive at the conclusion that all candidates do essentially the same thing. That misleads, because the tools answer two different questions.

This article assigns four common solutions to their architectures, shows the licence boundaries of each edition, and states which tool suits what. All licence and version details come from the repositories and vendor pages, as of 31 August 2026.

Table of contents

• Two architectures, not four products
• The candidates at a glance
• Why star counts are useless here
• Zabbix
• Checkmk
• Prometheus and Grafana
• Netdata
• The licence boundaries compared
• Which one for which situation
• What a tool comparison does not answer
• How we approach this at WZ-IT
• Further guides

Two architectures, not four products

The difference that explains all the others lies in the question the tool answers.

State-oriented. Zabbix and Checkmk ask: is this service in order? They run checks, derive states such as OK, warning or critical, and alert on transitions. Metrics come along, but they are not the purpose. This architecture suits servers, network devices, services and anything with a defined target state.

Metric-oriented. Prometheus collects time series and makes them available for querying. Whether something is in order is decided not by the tool but by a rule someone writes. This architecture suits applications that expose metrics themselves, and environments where systems change constantly.

Netdata sits between the two: metric-oriented like Prometheus, but with ready thresholds and alerts from installation, and a time resolution of one second built for single-system diagnosis.

The practical consequence: anyone wanting to monitor a grown server estate is worse served by Prometheus than by Zabbix or Checkmk, even though Prometheus is the better-known technology. Conversely, Zabbix represents a Kubernetes environment with short-lived instances less well.

The candidates at a glance

Figures from the public repositories, as of 31 August 2026.

Grafana is not listed as a separate candidate because it is not a monitoring system but a presentation layer. It has been under AGPL-3.0 since 2021 and has 76,528 stars.

All four were updated within the last two days. None of them is on the way out.

Why star counts are useless here

The table above contains a trap, and it appears in every comparison that uses stars as a ranking.

Netdata has around 80,000 stars, Checkmk around 2,400. It does not follow that Netdata is the thirty-three-times better tool. What follows is that Netdata runs on any machine with one command and immediately shows a pretty picture, while Checkmk is a product for operational use that people rarely install out of curiosity.

Stars measure attention, not deployment in companies. Checkmk is considerably more widespread among German-speaking mid-sized companies than its star count suggests. Anyone selecting by this metric picks the tool with the best first minute, not the one with the best third year.

Zabbix

Zabbix is a complete monitoring system: collection, storage, state evaluation, alerting and interface in one. Its strength lies with network devices over SNMP, with classic servers, and everywhere states rather than curves are what matter.

The licence change. With version 7.0 Zabbix moved from GPLv2 to AGPLv3. The difference concerns provision over a network: anyone offering a modified version as a service must disclose the modifications. For internal self-hosting nothing changes.

No feature split. Zabbix sells subscriptions for support, response times and services. The vendor states on its pricing page that there are no licence fees, no device limits and no feature gates. Among the tools compared here that is the exception, and it is the strongest point for Zabbix where predictability over years matters.

The price for that is setup. Zabbix requires more configuration than Checkmk before it produces useful results.

Checkmk

Checkmk comes from Munich and is the most widespread of the four in German-speaking countries. Its practical advantage is automatic service discovery: install the agent, add the host, and the relevant checks stand ready with usable thresholds.

The editions are named differently from most comparisons. The vendor currently lists Checkmk Community, Checkmk Pro, Checkmk Ultimate and Checkmk Cloud. The names Raw Edition and Enterprise Edition come from before that and no longer appear on the product page.

The boundary runs at the core, not at a feature list. Checkmk Community uses Nagios as its monitoring core. The commercial editions run on the Checkmk Micro Core, developed in house since 2013 expressly to overcome Nagios's limitations.

That is an unusual construction and it is rarely named as such: the free edition is not the commercial one minus a few checkboxes, but a different system behind the same interface. Anyone pushing the Community edition to its performance limit is not changing package but changing the engine underneath.

The commercial source is not inspectable. The public repository is entirely under GPL-2.0 and contains no directory with a differing licence. The commercial part is not in it. That is cleaner than mixing free and commercial parts in one repository, but it also means: what you buy, you cannot read beforehand.

Prometheus and Grafana

Prometheus is the standard for application metrics in containerised environments and sits under Apache-2.0 at the Cloud Native Computing Foundation. It is therefore the only one of the four with no vendor who might one day change the licence.

The model differs fundamentally: Prometheus actively pulls metrics from endpoints that the monitored applications expose. It therefore expects the systems to cooperate. For your own applications that is an advantage; for an appliance with no metrics endpoint it needs an exporter in between.

Grafana provides the presentation. It has been under AGPL-3.0 since 2021, Apache-2.0 before that. Alongside it there is Grafana Enterprise as a proprietary offering. Anyone running Grafana only to display their own data is affected by neither.

The combination has a drawback that often surfaces late: you have to formulate the alerting yourself. There is no shipped collection of sensible thresholds for a file server. What is a template in Zabbix and Checkmk is here a rule someone has to write and maintain.

Netdata

Netdata takes its own approach: it collects a great many metrics at one-second resolution and displays them without configuration. For the question of what happened on a particular system in the last few minutes, there is hardly anything faster.

The agent is under GPL-3.0. The boundary lies at Netdata Cloud: the Cloud interface is a paid service. The free Community plan limits the dashboards usable in Netdata Cloud to 5 nodes; according to the documentation, this is a Cloud entitlement, not a streaming or connection limit. According to the pricing page, it is also intended for personal, non-commercial use only. For businesses it starts with the Business tier at USD 4.50 per node per month billed annually (as of October 2026). Without Cloud, any number of nodes can stream to a local Netdata Parent, which shows them together in its dashboard (documentation). You then run the Parent yourself, including storage, high availability and access protection.

Netdata therefore rarely replaces central monitoring. It complements it as a diagnostic tool for the moment you want to know what is happening right now.

The licence boundaries compared

The question worth asking before adoption is not "what does it cost" but "where does the free edition end".

Two observations on this.

The two tools without a feature boundary, Zabbix and Prometheus, both demand more setup effort than those with one. That is no coincidence: a vendor selling a commercial tier has a reason to make the entry pleasant.

And the boundaries sit exactly where environments grow: at core performance, at aggregating multiple systems, at reporting. A tool that works well for free with five systems can become paid at fifty. That belongs before the decision, not after it.

Which one for which situation

The last row is not an evasion. In larger environments the combination is the normal case, because the two architectures answer different questions. The mistake is not running two systems but expecting one to do both jobs well.

What a tool comparison does not answer

Selection is the smaller part of the work. Three points decide the benefit and appear in no comparison:

Who receives the alert? Monitoring without a named recipient and a deputy rule produces logs, not response.

What happens on an alert? Without a stored course of action, every incident starts the same search from scratch.

How many messages can the team take? A system sending daily messages with no action required gets clicked away after two weeks. Then the one message that mattered is missing too. Fewer checks with clear thresholds are more effective than complete coverage without consequence.

Still unsure which tool fits? The orientation workshop sorts out your requirements and delivers a prioritised topic list with a recommendation per topic. From €1,490 excl. VAT, remote.

How we approach this at WZ-IT

We start with the question of what someone should react to, and derive from that what gets monitored. The reverse route, capturing everything first and deciding afterwards what matters, reliably produces a system nobody reads any more.

For grown environments we mostly deploy Checkmk, because service discovery shortens the start. Where licence freedom over years is the decisive point, Zabbix is the better choice. For application metrics, Grafana with Prometheus is added.

We take on operations on request with agreed response times. That includes alerts arriving with us rather than in a mailbox nobody reads on a Friday.

Further guides

• Monitoring Proxmox: the tools compared - Zabbix, Checkmk and Grafana on a concrete case
• Grafana at WZ-IT - building and operating dashboards
• CVE monitoring for self-hosted software - vulnerabilities rather than system states
• Managed operations - monitoring with agreed response times
• Uptime Kuma - the lean entry for pure availability checks

Unclear which tool fits your environment? We look at the estate, assess the candidates and set up monitoring so that messages lead to responses. Book a call

Sources

• Zabbix on GitHub
• Zabbix: subscriptions and scope
• Zabbix 7.0 under AGPLv3
• Checkmk on GitHub
• Checkmk: editions and pricing
• The Checkmk Micro Core
• Prometheus on GitHub
• Netdata on GitHub
• Netdata: pricing and plans
• Netdata: access control and feature availability