rConfigUse Checkmk as your inventory source of truth. Back up every device configuration. Prove compliance from the network you already monitor.
- SourceCheckmk host inventory
- rConfigDevice record
- Fans out to
- Backup archive
- Diff view
- Compliance report
rConfig reads your Checkmk host inventory over the REST API, backs up the running configuration of every monitored network device on the schedule you choose, diffs every change, and generates NIS2 or DORA evidence without custom Checkmk plugins, without a parallel cron job, treating Checkmk's host inventory as the upstream source of truth and never asking your team to maintain two inventories of the same network.
Checkmk Raw, Cloud, MSP and Enterprise editions200+ vendor profilesSet up in under 30 minutes
Checkmk is your network’s inventory source of truth. It was never built to back up their configurations.
If you run Checkmk, you already know why thousands of network and IT teams chose it over Nagios, Icinga, Zabbix and the rest. For a lot of those teams, Checkmk has quietly become the de facto inventory source of truth for the network: every host, every host tag, every contact group, every folder hierarchy, all curated by the people who actually run the network. Auto service discovery via the Checkmk agent. Hosts and folder based config. Rule based parameterisation. SNMP, agent based and agentless monitoring on the same engine. Distributed monitoring with central aggregation. A REST API that exposes the host inventory, downtimes, contact groups, host tags and folder structure cleanly. tribe29 (now Checkmk GmbH) in Munich kept the product opinionated, and Checkmk Raw, Cloud, MSP and Enterprise editions all share the same monitoring core.
What Checkmk was never built to do is pull the running configuration from the Cisco, Juniper, Arista or Fortinet devices it's monitoring. That's not a flaw. Configuration management is a separate discipline, and the Checkmk team has stayed focused on monitoring rather than blurring the scope.
That leaves a gap that shows up the moment an auditor asks what the ACL on the core switch looked like last March, or when a change gets pushed at 2am and nobody can work out what was there before. rConfig fills that gap. Vendor agnostic. 200+ device profiles out of the box. On prem, VM, bare metal or your private cloud. Your Checkmk host inventory becomes rConfig's device list over the REST API, and every configuration on every device lives in rConfig's versioned archive from that point forward.
- Running config isn't a Checkmk service. The agent collects metrics, not running-config text.
- MKP plugins or local checks pulling configs over SSH or SNMP work until a Checkmk version bump moves things underneath them.
- Cron jobs that scrape configs and dump them onto the Checkmk site are the single point of failure nobody wants to inherit.
- Checkmk Exchange covers monitoring extensions beautifully. Network configuration management lives outside that remit.
- Auditors don't care that Checkmk reported the device green. They care what the configuration looked like every Friday.
rConfig is the tool that picks up where Checkmk's scope ends, and it does it without asking you to change a single thing about how you monitor.
Checkmk plus rConfig, in three moves.
Sync, capture, prove. The three capabilities that turn a monitored Checkmk estate into an audit ready one. Every host, every configuration, every change.
Sync
Checkmk hosts become rConfig devices automatically, scoped by Checkmk folder, host tag or contact group. Add a host to Checkmk, it lands in rConfig on the next schedule. Decommission one in Checkmk, it's flagged in rConfig for review before anything breaks.Capture
Every running config, every startup config, every change, stored and diffable. 200+ vendors out of the box. No MKP plugins to maintain. No local checks. No SCP scripts waiting to break.Prove
Compliance policies run against every Checkmk monitored device. NIS2, DORA, PCI-DSS, CIS benchmarks and anything your security team writes. Evidence exports in minutes, not days.
Checkmk holds the inventory. rConfig holds the configuration history. Between the two, there’s no version of the network you can’t prove to an auditor.
How rConfig syncs with Checkmk, step by step.
Four screens. Set up in under 30 minutes. Filter and mapping that scales cleanly from a five host pilot to a full estate.
- 01Step 1: AuthorisePaste a Checkmk REST API automation user secret and site URL into rConfig's Integrations screen. The Test Connection and Test Credentials buttons confirm reachability in seconds.
- 02Step 2: ScopePick which Checkmk hosts to bring across. Filter by Checkmk folder, host tag or contact group. Most teams start with a single test folder of five to ten hosts and widen from there.
- 03Step 3: MapTranslate Checkmk host tags, folders and labels into rConfig vendors, templates and credentials using tag based mapping. Set it up once, rConfig applies it on every sync thereafter. Default mappings cover the common Checkmk host categories out of the box.
- 04Step 4: SyncRun it now, schedule it (hourly, daily, weekly), or trigger it from the CLI with
php artisan rconfig:integration-checkmk. Idempotent: reruns produce identical state, failures resume cleanly on the next cycle.
The integration is one way by design. rConfig never writes to Checkmk. Once hosts are in rConfig, backup, diff and compliance run automatically. Checkmk continues monitoring. Neither tool interferes with the other.
Built for how Checkmk operators actually work.
The jobs the NOC, the security team and the auditor each need from network configuration management. No features bolted on for show.
Multi vendor configuration backup
Cisco, Juniper, Arista, Fortinet, Palo Alto, Huawei, Nokia, MikroTik, HPE, Aruba and 200 more. Hourly, daily or on demand.Change detection with a readable diff
See exactly what changed, line by line, since the last known good version. Filter out noise like timestamps and session identifiers.NIS2, DORA and CIS compliance reporting
Write policies once, run them against every Checkmk monitored device. Export evidence your auditor can actually read.One click configuration restore
Push a known good configuration back to any device in under 90 seconds, with approvals and a full audit trail.Bulk configuration deployment
Apply the same template across every Checkmk host that matches a tag or folder filter, in a single job with preview and rollback.Full audit trail, exportable on demand
Who changed what, when, from where. The report your auditor asks for takes minutes, not days.
Deploys alongside Checkmk. Sets up in minutes. Stays out of the way.
rConfig does not install a Checkmk MKP. Does not run on the Checkmk site. Does not touch the Checkmk monitoring core or the site database. All interaction happens over the documented Checkmk REST API through an automation user secret that you scope yourself. That matters because it means rConfig cannot interfere with your Checkmk performance, cannot consume monitoring capacity, and cannot be the thing that breaks when you upgrade Checkmk.
What rConfig does is what Checkmk was deliberately not built to do: capture configuration, track how it changes, and prove what it looked like when someone needs to know. Self hosted on prem, VM or bare metal, or in your private cloud. Supports Checkmk Raw, Cloud, MSP and Enterprise editions, single site or distributed monitoring with a central site. Your operations team is running it inside 30 minutes on V8 Pro or Vector.
Your inventory.Your configuration.Your audit trail.
From Checkmk service alert to restored configuration, in under fifteen minutes.
A regional bank in central Europe runs Checkmk Enterprise across roughly 1,800 hosts in a distributed setup with a central site and four remote sites. The NetOps team owns the network folder. At 21:42 on a Wednesday, Checkmk alerts on a BGP peer flap at a branch firewall and an uplink interface oscillating up and down. The on call engineer pulls up the host overview in Checkmk and the services confirm the symptom. The diagnosis lives in rConfig: a route map change pushed by a third party installer earlier that evening on the wrong neighbour. rConfig’s diff view surfaces the exact six line difference from the last known good configuration, and the engineer rolls back with a single click. Service is restored at 21:57. The change management ticket is closed with the diff attached as evidence. No MKP was written. No local check was added. No second on call engineer was woken.
That’s what configuration management looks like when it’s built for network operators, not for scripting experts.
NIS2 and DORA evidence, sourced from the inventory Checkmk already curates.
If you’re in scope for NIS2 or DORA, regulators want two kinds of evidence. They want to know the network was available, and they want to know it was configured correctly. Checkmk is the availability evidence. rConfig is the configuration evidence. Neither tool alone satisfies both halves of the audit.
Run both and your compliance process stops being a quarterly panic. Drift detection policies run automatically, every day, against every Checkmk monitored host. When the auditor asks what the firewall ruleset looked like on 12 March, the evidence is already in rConfig’s archive. Your Checkmk service history and rConfig configuration archive together cover availability and configuration for the same scope of devices.
rConfig compared to a custom Checkmk MKP, Oxidized or a home grown SSH script.
Checkmk users who want configuration backup typically try one of three things before landing on a purpose built NCM platform. All three have their place.
Custom MKP packages or local checks pulling configs over SSH, NETCONF or SNMP are the most common DIY approach. They work, they fit Checkmk’s extension model, and they are free. What they do not give you: a searchable archive, a readable diff, compliance reporting, RBAC, SAML SSO or audit ready evidence. And the first Checkmk version bump that changes something about the local checks API breaks the plugin on a schedule you cannot predict.
Oxidized and RANCID are fine tools for shops with a dedicated automation engineer and a tolerance for Git and YAML debugging. Free. Works. Maintenance cost rises with the estate size.
rConfig’s positioning is simple. If you have Python and Git capacity in house and a small enough estate that maintenance is manageable, DIY is a reasonable choice. If you need compliance evidence your auditor can read without a walk through, RBAC and SAML out of the box, commercial support with SLAs, and a platform your network team can operate without becoming Checkmk plugin developers, rConfig is the tool that gets you there faster. Most teams move to rConfig after their DIY plugin or script breaks at the wrong moment and the engineer who wrote it has moved on. And the strategic answer is the same one your Checkmk admins already gave you: keep the inventory in the tool that is good at inventory, and let a purpose built network configuration management platform handle everything Checkmk was never trying to do.
The Checkmk integration, at a glance.
Everything your architecture review will ask about. Share this section with your security team before the demo.
- rConfig version
- 8.0 or later (V8 Pro, Enterprise or Vector)
- Checkmk versions supported
- Checkmk 2.1, 2.2, 2.3 and later. Raw, Cloud, MSP and Enterprise editions
- Authentication
- Checkmk REST API automation user with secret
- Transport
- HTTPS, with optional support for internally signed certificates
- Filterable fields
- Checkmk folder, host tag, host label, contact group
- Sync triggers
- Manual, scheduled, or CLI
- CLI command
php artisan rconfig:integration-checkmk- Single device CLI
php artisan rconfig:integration-checkmk-single-device {device_id}- Data flow
- One way, Checkmk to rConfig
- Idempotency
- Yes, reruns produce identical state
- Logging
- Every sync logged with user, timestamp, host count, errors
- Checkmk footprint
- Zero MKP packages, zero local checks, zero monitoring core impact
- Distributed monitoring
- Supported (point rConfig at the central Checkmk site, remote sites are read transparently)
- Documentation
- docs.rconfig.com/integrations/device-sync-overview
Questions Checkmk operators ask about network configuration management
See the sync running against your own Checkmk inventory.
Book 30 minutes with an rConfig engineer. We’ll point the integration at a slice of your real Checkmk host inventory, back up a handful of your actual devices, and run a compliance report against a policy that matters to your team. No generic demo. No slide deck. No sales gate.
Set up in under 30 minutes. Backs up from day one. No Checkmk MKP required.