Wire the probe into your RMM / monitoring scripts

Two things make the probe scriptable: a stable exit-code contract and versioned JSON. Your RMM, Nagios, PRTG, Zabbix, or a scheduled task can run one command and act on the result — no screen-scraping, no parsing human text that might change.

1. Exit codes — the simplest integration

For a lot of monitoring you don't need the JSON at all: run with --strict and branch on the exit code. The contract is stable across releases:

Use --strict in monitoring so a cert-expiring-soon or BlastRADIUS warning trips the alert while it's still cheap to fix, instead of passing until it becomes an outage.

2. The JSON output

Add --json for a machine-readable result you can key on:

authhound-probe radius test --server radius.corp.com \
  --secret-file /etc/authhound/secret --peap alice --password-file /etc/authhound/alice.pw \
  --json --strict

The fields a check script actually needs:

The output carries a schema version so your parser can depend on it; the full, versioned schema is documented in the repo. Key on the field names above rather than on output order.

3. Worked check scripts

Both keep the secret and password in root-/admin-readable files, off the command line. Adjust the OK/CRITICAL convention to your platform (Nagios uses 0/1/2/3; many RMMs just want non-zero = alert).

bash (Linux / macOS, with jq):

#!/usr/bin/env bash
# Nagios-style check: exit 0 OK, 2 CRITICAL. Reads secret/password from files.
set -o pipefail

out="$(authhound-probe radius test --server radius.corp.com \
  --secret-file /etc/authhound/secret --peap alice --password-file /etc/authhound/alice.pw \
  --json --strict)"
code=$?

if [ "$code" -eq 0 ]; then
  echo "OK - RADIUS authentication passed"
  exit 0
fi

# pull the failing check names out of the JSON for a useful alert line
failed="$(printf '%s' "$out" | jq -r '.results[] | select(.status!="pass") | .name' | paste -sd, -)"
echo "CRITICAL - RADIUS check failed: ${failed:-see output} (exit $code)"
exit 2

PowerShell (Windows):

# PowerShell — for an RMM that keys on exit code + stdout
$out = & 'C:\Program Files\authhound\authhound-probe.exe' radius test `
  --server nps.corp.com --secret-file C:\authhound\secret `
  --peap alice --password-file C:\authhound\alice.pw --json --strict
$code = $LASTEXITCODE

if ($code -eq 0) {
  Write-Output 'OK - RADIUS authentication passed'
  exit 0
}

$failed = ($out | ConvertFrom-Json).results |
  Where-Object { $_.status -ne 'pass' } | ForEach-Object { $_.name }
Write-Output ("CRITICAL - RADIUS check failed: {0} (exit {1})" -f ($failed -join ', '), $code)
exit $code

--no-color isn't needed for --json, but add it if you also capture the human output to a log — the probe auto-disables colour when stdout isn't a terminal anyway.

Related

• Monitor from a Raspberry Pi

  Where to run the check — a cheap standing probe at a branch site, on a timer.

• Flag reference

  Every flag, generated from the binary — including --strict, --json, and the credential forms.

• Check BlastRADIUS exposure

  The warning --strict will trip if your server doesn't sign replies — worth catching.