Cacti

Overview

Founded in 2001, Cacti is an open-source network traffic graphing tool built on the RRDTool data storage and graphing engine. The name Cacti is an acronym for CDE (Cacti Data Environment), created by Ian Berry and Larry Adams as a more user-friendly, feature-rich web interface than MRTG (Multi Router Traffic Grapher).

Cacti collects data from network devices via SNMP, stores it in RRDTool's round-robin databases, and generates historical trend graphs. Its template system (device templates + graph templates + data query templates) lets administrators configure once and apply to all similar devices. After 25 years of development, Cacti has over 1 million deployments worldwide, supporting everything from enterprise Cisco and Juniper switches to Linux servers and home routers.

Key Strengths

• 25 Years of Mature Traffic Graphing: Cacti's RRDTool engine has been refined over 25 years, proven in reliability, consistency, and long-term data retention, with support for custom time ranges, auto-scaling, and CDEF calculation functions.
• Template-Based Bulk Management: Device templates define SNMP OID mappings, graph templates define chart layouts, and data query templates define interface discovery rules. For hundreds of same-brand switches, templates cut configuration time from 4 hours to 5 minutes.
• Long-Term Historical Data Storage: RRDTool's round-robin design keeps storage space fixed with automatic consolidation and pruning, supporting 5 retention tiers (minute/hourly/daily/weekly/monthly) for bandwidth auditing and capacity planning.
• Multi-User Permission Management: Supports user groups, roles, and 3 permission levels, letting administrators restrict users to specific devices or graphs with LDAP/AD authentication for team collaboration. Pair with monitoring alert practices to build a complete monitoring stack.

Product Ecosystem

Data Collection Engine

Cacti uses a PHP-based poller running on a cron schedule with a default 5-minute interval. Collection executes via cmd.php (PHP implementation) or spine (C-based, high-performance version), with spine supporting multi-threaded concurrent polling for large-scale device management.

Template System

Cacti templates operate on three levels: device templates (device type, SNMP parameters, associated graph templates), graph templates (line styles, colors, CDEF formulas, data source mappings), and data query templates (index methods for discovering interfaces/disks/CPUs via SNMP walks). Templates can be imported/exported as XML, with hundreds of pre-built templates from the community.

Graph Management

Cacti provides a graph management interface for creating, editing, sorting, and aggregating charts. Tree View organizes devices by geography, business line, or device type, with support for auto-scaling, overlay display, and CDEF custom calculation functions.

Alerting (Thold Plugin)

Native alerting is limited; the Thold plugin adds threshold alerts with baseline alerts (dynamic baselines from historical data), absolute thresholds, and custom trigger conditions. Notifications support email and Syslog.

Limitations

• High Learning Curve: Requires understanding of SNMP OIDs, RRDTool retention policies, and the template system; first-time deployment typically takes 1-2 weeks. Compared with LibreNMS's auto-discovery, Cacti's manual template configuration is more time-consuming.
• Weak Real-Time Monitoring: The 5-minute minimum poll interval makes sub-minute or real-time monitoring impossible. For instant alerting, pair with Prometheus or Zabbix.
• Dated Interface Design: Cacti 1.x has improved but still relies on tables and static graphs, lacking interactive dashboards, drag-and-drop layouts, and real-time refresh—behind modern tools like Grafana.
• Alerting Depends on Plugins: Core Cacti only records basic log-based alerts; threshold alerts and notifications require installing Thold and Monitor plugins, adding complexity.

Use Cases

• Network Bandwidth Monitoring (★★★★★): Enterprise egress bandwidth, core link, and WAN traffic trend monitoring—RRDTool's long-term storage is ideal for multi-year bandwidth auditing.
• ISP Network Management (★★★★): Internet service providers tracking customer access links and backbone traffic statistics and bandwidth usage.
• Data Center Network Operations (★★★★): ToR switch, core switch, and firewall port traffic monitoring and trend analysis.
• Real-Time Alerting Scenarios (★★): For real-time alerting and high-frequency polling, pair with Prometheus or Zabbix.

Pricing

Note: Cacti is completely free and open-source with no paid versions. Commercial consulting and custom development are available.

FAQ

• What is the difference between Cacti and MRTG? MRTG is an early Perl-based RRDTool traffic graphing tool managed through text config files with limited functionality. Cacti builds on this with a web management interface, template-based configuration, multi-user permissions, and plugin extensibility—effectively a functional upgrade of MRTG; see the monitoring and alerting guide.
• Can Cacti monitor server performance? Yes. Via SNMP or Script Server (PHP scripts), Cacti can monitor Linux/Windows CPU usage, memory, disk I/O, and system processes, with community templates for Unix and Windows hosts; compare in cloud monitoring services comparison.
• Cacti vs Grafana—which to choose? Cacti specializes in SNMP network traffic collection and RRDTool graphing, ready out of the box. Grafana is a general-purpose visualization platform requiring Prometheus, InfluxDB, or other data sources. If you already run Cacti, you can integrate its graphs into Grafana via the Cacti Graph JSON data source; see Prometheus alert rules design.
• What's new in Cacti 1.x vs 0.8.x? Cacti 1.x is a major upgrade introducing a responsive Bootstrap web interface, improved user management, a new graph rendering engine, and a native REST API. New deployments should use Cacti 1.x; see monitoring and alerting.