MantisNMS · Getting Started Guide

MantisNMS Getting Started

Last updated August 2026 · Applies to all MantisNMS tenants

This guide covers everything you need to get MantisNMS running — from installing your first probe to discovering devices, adding SNMP and uptime sensors, choosing which switch interfaces to monitor, host sensors, alerting, syslog/trap collection, and flow monitoring. Follow the steps in order if you're new, or jump to any section via the sidebar.

Overview

MantisNMS is a cloud-delivered network monitoring platform. The management portal is at nms.mantisops.net — there is no server software to install. The only on-premises component is a lightweight probe that runs on any host inside your network and reaches your devices via SNMP and other protocols. The probe is the same signed Go binary as the Mantis360 probe, so a single deployment can serve both products.

Core concepts

Install the Probe

The probe runs on any always-on host inside the network you want to monitor — a small VM, a spare server, or an existing Mantis360 probe host. It communicates outbound over HTTPS/WSS; no inbound firewall changes are required for polling.

Download the probe

Log in to nms.mantisops.net → Discovery → Probes → Add Probe. Download the platform-specific binary pre-configured with your tenant's enrollment token.

Linux installation

Supports Debian/Ubuntu and RHEL/CentOS on amd64 and arm64.

Windows installation

Installs as a Windows Service and starts automatically. On Windows, optional Npcap enables ARP-based discovery and passive fingerprinting.

Register the probe to your tenant

The download from Discovery → Probes → Add Probe is pre-configured for your tenant. To register a probe manually — or to script deployment across several sites — drop a config.json next to the probe binary with your server URL and enrollment token, then install it. Copy the token from the Add Probe dialog.

Windows — PowerShell, as Administrator (place config.json beside the binary):

Linux — as root (use the -arm64 binary on ARM hosts):

macOS — as an admin user:

Confirm enrollment

Within about 60 seconds the probe registers itself and appears under Discovery → Probes with a green online indicator. Once it's online you're ready to discover devices.

Discover Devices

Discovery finds the devices on a segment so you can turn them into monitored sensors, rather than typing IPs by hand.

Run a discovery scan

1. Go to Discovery → select your probe → New Scan
2. Enter the subnet(s) to sweep (e.g. 192.168.1.0/24)
3. Optionally supply SNMP credentials (v2c community or v3 USM) so discovered devices are identified by vendor/model
4. Start the scan — devices stream into the table as they're found

Discovery uses ICMP + ARP host discovery, light port checks, and SNMP sysObjectID decoding to classify each device (switch, router, firewall, server, printer, UPS, and so on).

Credentials

SNMP and device credentials are stored in the central credential vault, encrypted at rest, and are only ever used by your probe to poll your own devices. You can manage reusable credentials centrally and assign them per device or per subnet.

Sensors

A sensor is a single thing MantisNMS watches. Add sensors from Sensors → Add Sensor, or promote a discovered device into a monitored SNMP device.

Sensor types

Polling interval

Each sensor has its own interval (default 60s; ICMP may go as low as 30s). Set it on the sensor when you create or edit it. The interval controls how often the sensor is checked — it does not change what a sensor costs.

Interface Monitoring

For an SNMP switch or router, MantisNMS discovers every interface — but you choose which ones are worth monitoring. Each monitored interface is one sensor, tracking bandwidth in/out and up/down availability.

Select interfaces to monitor

1. Open the device in Sensors → the Interfaces tab
2. MantisNMS pre-selects the connected (operationally up) interfaces as a suggested set
3. Tick or untick interfaces — deselect unused access ports, admin-down ports, and stack links
4. Click Save. Only the selected interfaces are billed and stored going forward

Interface availability & alerting

A monitored interface that goes down opens an incident (with a one-poll flap damp so a brief blip doesn't alert) and sends a notification through your alert channels; recovery closes the incident and sends an "up" notice. Availability is reconstructed from up/down transitions, so a stable port costs almost nothing to track.

Host Sensors

When a monitored device reports host resources over SNMP (or via a MantisRMM/native agent), each resource becomes its own sensor, the same way a dedicated monitoring tool counts them:

• System Uptime — one per monitored host
• CPU Load — when the device exposes it
• Memory — when the device exposes it
• Disk — one sensor per fixed disk/volume

Open a device's Host sensors · billing panel to see the aspects it exposes and pause any you don't want to monitor or bill (for example, a noisy temp volume). Paused aspects stop counting immediately.

Alerts & Incidents

An incident opens when a sensor fails its check for the configured number of polls and closes when it recovers. Incidents appear in the Alerts view, the notification bell, and dashboard widgets.

Configure notifications

1. Go to Settings → Alerts
2. Set the notification email(s) and any additional channels
3. Choose how many consecutive failed polls trigger an alert (default 2) and an optional escalation delay

Thresholds

Beyond up/down, you can raise incidents on metric thresholds — e.g. latency, interface utilization or errors, CPU/memory/disk — under Settings → Thresholds. A rule can target one sensor or every sensor of a kind (tenant-wide).

Syslog & SNMP Traps

Point your devices' syslog and SNMP-trap destinations at the probe, and MantisNMS ingests the messages for search and audit. They appear in the Events view, filterable by kind, source, severity, and message, with CSV export for SIEM hand-off.

Flow Monitoring

MantisNMS includes a passive flow probe for NetFlow v5/v9, IPFIX, and sFlow. Configure your routers/switches to export flow records to the probe, and MantisNMS aggregates them per exporter into ranked top talkers, top conversations, and top applications over a reporting window.

Tags & Organization

Tag sensors to organize and filter them — by site, role, criticality, customer, or anything else. Tag filters drive the Sensors list, dashboards, and CSV exports, and tag-based rules can shape alerting. Use tags rather than rigid groups so a sensor can belong to several views at once.

How Sensors Are Counted

MantisNMS bills per sensor, following the "device = free container" model. Your billable count is the sum of:

• Each monitored interface on an SNMP device — 1 sensor
• Each reported host aspect (Uptime / CPU / Memory / each disk) that you haven't paused — 1 sensor
• Each leaf monitor (ping, HTTP, TCP, SSH) — 1 sensor

An SNMP device counts as zero on its own — you only pay for the interfaces and resources you actually choose to watch. The status bar shows your current usage against your plan; the Sensors → usage breakdown itemizes base sensors, monitored interfaces, and host sensors. See pricing for current per-sensor tiers.