diff --git a/server.ts b/server.ts
index 95102a2..61e5576 100644
--- a/server.ts
+++ b/server.ts
@@ -758,12 +758,32 @@ async function startServer() {
         if (name !== undefined && state !== undefined) hostnameToState.set(name, state);
       }
 
-      // Diagnostic: log a sample so mismatches between config and monitoring IDs are visible
-      const cfgSample = [...ipToHostname.values()].slice(0, 3).join(', ');
-      const monSample = [...hostnameToState.keys()].slice(0, 3).join(', ');
-      db.prepare('INSERT INTO logs (id, timestamp, type, message) VALUES (?, ?, ?, ?)')
-        .run(uid('log'), now, 'system',
-          `CheckMK diagnostic — config hosts (${ipToHostname.size}): [${cfgSample}] | monitoring hosts (${hostnameToState.size}): [${monSample}]`);
+      if (hostnameToState.size === 0 && ipToHostname.size > 0) {
+        // Monitoring collection empty despite config hosts existing.
+        // Likely cause: automation user lacks "Use monitoring" permission in CheckMK.
+        // Falling back: probe one host via /objects/host_config/{name} and log its raw extensions
+        // so we can identify which field carries the reachability state.
+        db.prepare('INSERT INTO logs (id, timestamp, type, message) VALUES (?, ?, ?, ?)')
+          .run(uid('log'), now, 'system',
+            'CheckMK: monitoring collection returned 0 hosts. The automation user may need ' +
+            '"Use monitoring" permission (Setup → Users → Roles). ' +
+            'Attempting per-host fallback via host_config endpoint.');
+
+        const firstHostname = [...ipToHostname.values()][0];
+        try {
+          const probeRes = await fetch(
+            `${CHECKMK_API_URL}/objects/host_config/${encodeURIComponent(firstHostname)}`,
+            { headers }
+          );
+          if (probeRes.ok) {
+            const probeData = await probeRes.json();
+            const extJson = JSON.stringify(probeData?.extensions ?? {}).substring(0, 400);
+            db.prepare('INSERT INTO logs (id, timestamp, type, message) VALUES (?, ?, ?, ?)')
+              .run(uid('log'), now, 'system',
+                `CheckMK probe extensions for "${firstHostname}": ${extJson}`);
+          }
+        } catch { /* probe is best-effort */ }
+      }
     } catch (err: any) {
       const msg = `CheckMK sync failed — could not fetch monitoring states: ${err?.message ?? err}`;
       console.error('[CheckMK]', msg);