Replacing PRTG under NIS2: Zabbix, Checkmk and AtlasEye

Organisations reconsider PRTG for ordinary reasons, such as subscription cost as sensor counts grow or a core server that runs only on Windows, and increasingly because NIS2 asks for things a monitoring tool alone does not provide: an incident record with defensible timestamps, retained logs and a path to the CSIRT. This guide sets out criteria that hold up under NIS2 and compares three alternatives against them.

Why teams re-evaluate PRTG

PRTG is developed by Paessler, based in Nuremberg, Germany. It is licensed by sensors, a sensor being one monitored aspect of a device such as CPU load, a disk or a switch port, so a single switch can consume dozens. Paessler sells subscriptions in sensor tiers and offers a free edition limited to 100 sensors. The core server runs on Windows (Windows Server 2016 to 2025, or Windows 10 and 11) with .NET Framework 4.7.2 or later.

None of this is a defect. For a Windows-centric team with a moderate estate, PRTG's auto-discovery and ready-made sensors are productive. The questions start when the sensor count, and with it the subscription, grows faster than the network, when the organisation standardises its servers on Linux, or when NIS2 asks for an incident record and a reporting path that the monitoring tool does not hold.

Criteria that hold up under NIS2

  1. Evidence quality. Synchronised clocks across collectors and devices, retained logs and an audit trail that reveals tampering.
  2. Incident workflow. A record opened at awareness, a timeline, the Article 23 milestones and an export in the format the authority expects.
  3. Log handling. Native syslog reception, search and retention, rather than log files read after the fact.
  4. Operator and data location. Who runs the platform and where the data sits; supply-chain security is one of the areas in Article 21(2).
  5. Availability of the monitoring system. Mandatory redundancy for the entities covered by Implementing Regulation (EU) 2024/2690, and good practice for everyone else.
  6. Cost predictability. How the price scales: per sensor, per device, or not at all.
  7. Operating effort. The people and skills the platform needs to stay useful.

The alternatives compared

Capabilities as documented by each vendor on 2 October 2026. Check the current documentation before relying on any line of this table.

PRTGZabbixCheckmkAtlasEye
VendorPaessler, Nuremberg (DE)Zabbix SIA, Riga (LV)Checkmk GmbH, Munich (DE)cdnCore, Covilhã (PT)
LicenceCommercial subscription by sensor tier; free edition up to 100 sensorsAGPLv3 from 7.0; no licence feeCheckmk Community under GPLv2; commercial Pro, Ultimate and Cloud editionsCommercial subscription by device tier
Core platformWindowsLinuxLinuxLinux x86_64 with Docker Compose
SyslogSyslog Receiver sensorThrough rsyslog and agent log itemsEvent Console, which also receives SNMP trapsBuilt-in receiver on UDP and TCP 514, with search
Incident record and NIS2 exportAlerts, notifications and built-in tickets; reporting outside the productProblems and actions, ITSM integrations; reporting outside the productNotifications and Event Console actions; reporting outside the productIncident lifecycle, Article 23 milestones and CSIRT export (Pro and Enterprise)
Redundancy of the monitoring serverFailover clusterNative server HA since 6.0; proxy groups since 7.0Appliance clustering; distributed monitoringSingle node, no geo-redundant HA
Vendor-operated optionPRTG Hosted MonitorZabbix CloudCheckmk CloudDedicated instance operated by cdnCore in Portugal

Reading the table

PRTG remains a reasonable choice for Windows-centric teams with moderate estates who value ready-made sensors. NIS2 does not by itself require replacing it; the incident record and the reporting can live in an IT service management tool, provided someone builds the Article 23 workflow there.

Zabbix offers the most headroom: no licence fee, a highly available server and proxies for distributed collection. The price is engineering effort, and logs and NIS2 reporting have to come from other systems. A closer look is in AtlasEye and Zabbix compared.

Checkmk sits between the two. Its automatic service discovery reduces configuration work, and its Event Console receives syslog and SNMP traps natively, which closes part of the log gap. Features differ between Checkmk Community and the commercial editions, so compare the edition you would actually run.

Of the four, AtlasEye is the one whose documented features include the NIS2 incident record and the CSIRT export, together with syslog and network administration, in one console. It is also the smallest in scale: a single node, sized for networks of up to 250 devices on the Pro plan, with Enterprise for larger installations.

A migration that keeps the evidence intact

  • Run the old and the new system in parallel for at least one reporting cycle, so that the availability history has no gap.
  • Export PRTG's historical data before decommissioning it. Availability reports from the old system may be needed as evidence for the assessment of effectiveness under Article 21(2)(f).
  • Point syslog and SNMP traps at the new collector only after the parallel period, and keep the old log archive for its full retention period.
  • Synchronise every collector and device to the same time source before the cut-over; mixed clocks make a combined timeline unusable.
  • Record the change itself. Replacing the monitoring system is maintenance of network and information systems within the meaning of Article 21(2)(e).

Sources

See whether AtlasEye fits your operations.

Request a 14-day free trial for up to 25 devices with every feature enabled. A member of the team reviews each request within 48 business hours before activation.

Request free trial