> Section: [1. Introduction](https://jaque.sh/docs/get-started/install.md)
> Next: concepts/architecture
> Index: https://jaque.sh/llms.txt


You do not hand-translate `nagios.cfg`. jaque ships a compiler frontend
that reads a Nagios object tree, resolves its inheritance, and emits native
CUE together with a migration report naming every object that did not make
it across unchanged. The output is a config you own from then on; there is
no legacy-config runtime mode. This page covers the fast path through the
importer and how to read its report.

Status: the importer is implemented and property-tested for round-trip
correctness, but it has never been run against a real third-party Nagios
configuration, because the project has no corpus. Treat its output as a
strong first draft that still needs verifying. See
[Status](https://jaque.sh/docs/project/status.md).

## 1. The fast path

```sh
jaque import -from nagios -o jaque.cue /etc/nagios/
```

The positional argument is a directory, in which case jaque looks for
`nagios.cfg` inside it, or a single file. `-from` accepts `nagios` and `nautobot`. The second reads a device
inventory and is described in
[Nautobot import](https://jaque.sh/docs/config/nautobot-import.md). Icinga 2 is next on the
plan; it has not shipped. `-o` writes the emitted CUE to a file instead
of stdout, which is what you want for anything past a first look.

## 2. What comes out

Two artefacts, on two streams, so that `jaque import ... > jaque.cue`
captures the config and never the report mixed into it.

The CUE itself, on stdout or in the `-o` file: hosts, services, checks,
contacts, notification policies, escalations and labels, the whole object
graph. Where the source repeats itself the importer emits shared templates
rather than a flat one-object-per-line dump, so the result reads like a
config someone wrote by hand.

The migration report, on stderr: every source object classified as exactly
one of `mapped`, `approximated` or `unsupported`. An approximated object
was translated but something changed, and the report says what. An
unsupported object was dropped, and the report gives the source
`file:line` so you can go and look. The header line reads `objects: N
emitted of M in source (P% survived)`, which is the one number to read
first.

Nothing here executes your Nagios config. The importer is a compiler
frontend (ADR-006): it parses to an intermediate representation and emits
CUE from it. [Importer](https://jaque.sh/docs/nagios-compat/importer.md) has the mapping
rules; [Overview](https://jaque.sh/docs/nagios-compat/overview.md) has the reason the
boundary is drawn there.

## 3. What to expect the first time

A real Nagios tree carries two decades of `use` chains, custom variables
and Perl-flavoured `check_command` macros, and none of that is
theoretical. The importer resolves inheritance itself: `use` chains,
`register 0` templates, `+value` appends, `null` unsets. It translates
`check_command` with its `$ARGn$` and `$USERn$` macros into jaque checks,
and turns hostgroups into labels.

What it has not done is meet a stranger's config. Until it has, read the
report before the output: anything marked `unsupported` is a gap you must
fill by hand, and anything `approximated` is a decision the importer made
that you may disagree with. If you run Nagios and want to point `jaque
import` at your object files, reporting what broke is the most useful
thing you could send the project right now.

## 4. Validate what you got

The emitted CUE is an ordinary jaque config, so validation is the same
command as running it, `jaque -config jaque.cue`:

```sh
jaque -config jaque.cue
```

Validation runs in two phases, described in [Why
CUE](../concepts/why-cue.md): constraints at build, concretion at load. A
bad field name or a wrong type fails at startup with an error naming the
exact field, before a single check runs. A config that passes both phases
is one the engine will schedule.

Once it is running, `#/hosts` and `#/services` in the dashboard are the
fastest way to confirm that what you expected to see is what arrived. See
[Dashboard](https://jaque.sh/docs/ui/dashboard.md).

## 5. Security considerations

The importer reads files and writes files; it opens no listener and
executes nothing it reads. `check_command` lines are translated, never
run, so a hostile object file can produce a wrong config but not a process.
Macros from `resource.cfg` such as `$USERn$` frequently hold credentials:
the emitted CUE carries them in plain text exactly as the source did, so
give the output the same file permissions you gave the input.