> Section: [9. Nagios compatibility](https://jaque.sh/docs/nagios-compat/overview.md)
> Next: nagios-compat/fifo-external-commands
> Index: https://jaque.sh/llms.txt


The single biggest reason a Nagios migration stalls is "we have 400 plugins
and nobody wants to rewrite them." jaque's answer is: don't. Any executable
that speaks the Nagios exec convention runs on jaque unmodified, and this is
permanent supported surface, not a deprecation runway -- vendor monitoring
plugins, in-house scripts written a decade ago, anything a `check_command`
in an imported config resolves to, all of it keeps working with no rewrite
deadline attached.

## 1. The protocol

The convention is exit code plus stdout: exit 0/1/2/3 for
OK/WARNING/CRITICAL/UNKNOWN, with the check's text on stdout and, when the
plugin has it, `|`-delimited perfdata on the same line. jaque reads exactly
that, nothing more. ADR-005 fixes this as forever, not as a bridge scheduled
for removal: it is the one compatibility surface with no sunset date on the
roadmap.

## 2. Where the detail lives

See [Legacy exec plugins](https://jaque.sh/docs/checks/legacy-exec-plugins.md) for the wire
protocol in full, the perfdata format, and process-group timeout handling.
[WASM checks](https://jaque.sh/docs/checks/wasm-checks.md) exist alongside this surface for
new work worth sandboxing and shipping as one file -- not to replace it.

## 3. Security considerations

An exec plugin runs with the same trust boundary as any other command
named in config: jaque does not sandbox it, the way it sandboxes a WASM
check. A `check_command` pointed at an untrusted script is exactly as
dangerous here as it was under Nagios.