Cacti (software)
Open-source network monitoring and graphing web application
From Wikipedia, the free encyclopedia
Cacti is an open-source, web-based network monitoring, performance, fault, and configuration management framework that functions as a front end for the RRDtool time-series data logging tool. Created by Ian Berry in 2001, it is written in PHP with a MySQL or MariaDB backend and released under the GNU General Public License.[4][5]
| Cacti | |
|---|---|
 | |
 | |
| Original author | Ian Berry |
| Developers | The Cacti Group, Inc. |
| Initial release | September 23, 2001[1] |
| Stable release | |
| Written in | PHP[3] |
| Operating system | Linux, FreeBSD, macOS, Windows |
| Type | Network monitoring |
| License | GNU General Public License |
| Website | www |
| Repository | github |
Cacti polls network devices via Simple Network Management Protocol (SNMP) at configured intervals, storing the resulting data in RRDtool databases and generating graphs from them. It also supports custom data collection through shell scripts and executables.[6] Through a plugin architecture with over 20 official and community plugins, Cacti extends beyond graphing to cover all five FCAPS operational management categories. It supports role-based access control, LDAP and Active Directory authentication, and distributed data collection across multiple remote pollers.
Cacti is used by telecommunications providers, network operations centers, and web hosting providers.[7] It is also embedded in IBM Spectrum LSF RTM as the monitoring layer for high-performance computing (HPC) clusters based on IBM LSF.
History
Ian Berry started the Cacti project on September 2, 2001, while working for a small ISP during high school.[4][8] His aim was "to offer more ease of use than RRDtool and more flexibility than MRTG".[4]
Version 0.8.6, released on September 13, 2004, attracted additional developers and brought improvements in speed and scalability.[4][9] Version 0.8.7 followed in October 2007.[10] A 2012 roadmap scheduled version 1.0.0 for the first quarter of 2013, but team member availability issues led to a development hiatus. Between 2012 and 2017, The Cacti Group released six point releases of the 0.8.8 series, limited to bug fixes and security patches.
The Cacti Group reorganized in early 2015 to resume work on version 1.0, which was released in January 2017.[11] This release added multiple data collectors, user group permissions, multiple polling intervals, and site support. Version 1.2.0, released in January 2019, continued the 1.x series.[12]
The 1.2.x branch has received regular point releases since 2019. Version 1.2.23, released in January 2023, patched a critical unauthenticated remote code execution vulnerability (see Security).[13] Version 1.2.27 (May 2024) addressed a batch of twelve security advisories.[14] As of March 2025, the current stable release is version 1.2.30.[15]
Features
Data collection
Cacti collects data primarily through SNMP polling but also supports custom data collection via shell scripts and executables.[6] Two built-in data collectors are available: cmd.php, a PHP script suitable for smaller installations, and Spine, a multi-threaded C-based poller that can scale to tens of thousands of monitored devices per data collector.[16][17] Distributed data collection is supported through remote pollers that are resilient to intermittent network failures.
Graphing and visualization
Cacti stores collected data in RRDtool databases and generates graphs from this data.[18] Devices and graphs are organized through a hierarchical tree structure with site and location attributes. Graph and data templates reduce configuration overhead for common monitoring scenarios. A dashboarding plugin (Intropage) provides customizable overview screens.
Device management
Cacti supports automated network discovery, including automatic graph and tree creation for newly detected devices.[6] Device, automation, and graph templates allow administrators to define standard monitoring profiles. Upstream SNMP trap and inform reception is also supported.
Access control
Cacti supports local user accounts and external authentication via LDAP, Active Directory, and single sign-on providers through Apache and Nginx modules. Role-based access control governs access to graphs, devices, and administrative functions at both user and user group levels.
Plugins
Cacti uses a plugin architecture that extends the application beyond graphing into fault management, configuration management, and log analysis.[6] Plugins hook into the Cacti framework through a registration API and can add pages, tabs, settings, and poller tasks.
The Cacti Group maintains several official plugins on GitHub:[3]
- Thold -- threshold-based alerting with email, syslog, and SNMP trap notifications
- Syslog -- receives and stores syslog messages, with alert rules and message forwarding
- MacTrack -- MAC address and switch port tracking across network infrastructure
- Monitor -- real-time device status dashboard with up/down/recovering indicators
- Audit -- logs configuration changes made through the web interface
- Flowview -- NetFlow, sFlow, and IPFIX flow data collection and reporting
- Maint -- scheduled maintenance windows that suppress alerts during planned downtime
- Routerconfigs -- automated backup of switch and router configurations via TFTP, SSH, and Telnet
- WebSeer -- website and URL availability monitoring with response time tracking
- Intropage -- customizable dashboard landing page with system status panels
- CLog -- Cacti log viewer with filtering and tail functionality
- GExport -- automated export of graphs to static HTML pages or remote servers
- HMib -- host-level monitoring via the Host Resources MIB (CPU, memory, disk, processes)
- MikroTik -- polling and graphing for MikroTik RouterOS devices
- WeatherMap -- network topology visualization with traffic overlays
Third-party plugins are also available from community developers. The plugin architecture was introduced in version 0.8.6 and was substantially reworked for the 1.0 release.
Architecture
Cacti is a PHP web application that uses MySQL or MariaDB for configuration storage and RRDtool for time-series data. The system operates on a poller cycle: at configured intervals, typically five minutes, a data collector queries monitored devices and feeds the results to RRDtool for storage. The web interface generates graphs on demand by reading from RRDtool databases.
The data model is template-driven. Data templates define what to collect (OIDs, scripts), graph templates define how to visualize collected data, and device templates associate a set of graph and data templates with a type of monitored equipment. This separation allows a single template change to propagate across all devices of that type.
Security
In December 2022, SonarSource disclosed CVE-CVE-2022-46169, an unauthenticated remote code execution vulnerability in Cacti's remote_agent.php endpoint. The flaw combined an authentication bypass with a command injection, allowing an unauthenticated attacker to execute arbitrary commands on the host. The National Vulnerability Database assigned it a CVSS score of 9.8 (Critical).[19][20] The Cacti Group patched the issue in version 1.2.23.
By January 2023, the Shadowserver Foundation observed active exploitation in the wild, with attackers deploying Mirai botnet malware and IRC-based botnets on compromised hosts.[21] Scanning identified over 1,600 internet-facing Cacti instances that remained unpatched.[21] In February 2023, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2022-46169 to its Known Exploited Vulnerabilities catalog.[22] Exploitation continued through March 2023, with additional botnet campaigns (ShellBot, Moobot) targeting unpatched systems alongside a Realtek SDK vulnerability.[23]
Subsequent releases have addressed additional vulnerabilities. In May 2024, version 1.2.27 patched twelve security issues, including CVE-CVE-2024-25641 (arbitrary file write, CVSS 9.1) and CVE-CVE-2024-29895 (unauthenticated command injection, CVSS 10.0, affecting the 1.3.x development branch).[14] In January 2025, version 1.2.29 patched CVE-CVE-2025-22604, an authenticated remote code execution flaw via multi-line SNMP responses.[15]
Reception
InfoWorld in 2006 described Cacti as a strong first step for organizations adopting network monitoring, noting its accessible interface relative to configuring RRDtool directly.[24] Linux.com and Computer Weekly covered Cacti as a practical open-source option for network device monitoring in the mid-2000s.[25][26] Network World included Cacti among recommended free tools for network engineers in 2022,[27] and Opensource.com listed it among the top five open-source monitoring tools in 2019.[28]
See also
- Net-SNMP
- Simple Network Management Protocol
- RRDtool, the underlying data storage tool upon which Cacti is built
- MRTG, the multi-router traffic grapher that preceded RRDtool
- Comparison of network monitoring systems
