Netdata

Last reviewed Aug 24, 2026 · 765 words

Netdata is the monitoring tool for the first five minutes of a problem: install one agent and, with literally zero configuration, get per-second charts of everything the box is doing — every core, every disk, every container, every network interface, auto-discovered and already graphed by the time you open port 19999. Where Prometheus answers "what changed since March", Netdata answers "what is happening right now, at one-second resolution" — which is exactly the question during an incident, and the reason the two coexist happily rather than compete.

Install and immediately see everything

The kickstart script (curl -fsSL https://get.netdata.cloud/kickstart.sh | sh) or the Docker image both work; native install sees more (temperatures, systemd, disk details) since containers need /proc, /sys, and the Docker socket mounted to match. There is no step two — collectors auto-detect Postgres, Redis, Nginx, containers, and a few hundred other things if they're present. The dashboard's density is the famous first impression: thousands of metrics is genuinely more than you need, and the right response is to learn the overview page and the search box rather than every chart. The built-in ML anomaly detection earns its keep here — it flags "this chart is behaving unusually" without you defining a single threshold.

Retention: per-second data doesn't last forever, by design

The default configuration stores metrics in tiers — roughly per-second data for a few days, per-minute for weeks, per-hour for months, all in a fixed disk budget — and the catalogue's "long retention needs tuning" con is exactly this. It's the correct trade for Netdata's job (incident-time forensics), but check [db] in netdata.conf and size the tiers deliberately if you expect week-old per-second data to exist; it won't unless you paid disk for it. For long-horizon capacity trends, don't fight the design: Netdata exposes a Prometheus-format endpoint, so your Prometheus can scrape a curated subset for the long game while Netdata keeps the high-resolution recent past. That split — Netdata for resolution, Prometheus+Grafana for history, Uptime Kuma for is-it-up — is the whole homelab observability stack in one sentence.

Several boxes: stream to a parent

Per-machine dashboards stop scaling at about three machines. Netdata's native answer is parent-child streaming: every agent ships its metrics to one parent node, which holds the retention and serves a single dashboard for the fleet, while children can run nearly stateless with tiny memory. Configuration is one API key in stream.conf on both ends. This is also the security answer: children bind to localhost, only the parent's dashboard exists, and that lives behind Tailscale or your proxy's auth — because a raw Netdata dashboard on the internet leaks an extraordinary amount about a system, and port 19999 has no authentication of its own.

The cloud question, answered plainly

Netdata the company offers Netdata Cloud, and the agent will offer to "claim" your nodes to it. The hosted layer adds fleet views and alert routing, has a free tier, and is where the commercial features live — but it is optional: the agent is GPL, the local dashboard works without any cloud account, and unclaimed agents monitor exactly as well. Decide the same way you'd decide any own-your-data question: if the fleet UI earns its telemetry relationship for you, claim; if not, run parents-and-children entirely locally and lose nothing that matters in a homelab.

Alerts: prune the defaults

Netdata ships hundreds of preconfigured health checks, which means a fresh install will notify you about ephemeral nonsense (a container's brief CPU spike, a full tmpfs). Route notifications (ntfy, Telegram, email are all supported) and then silence liberally — edit or disable the noisy checks in health.d/ until a Netdata alert reliably means "look now". An alert stream you've learned to swipe away is the failure mode; twenty minutes of pruning prevents it.

What I'd do

Native agents everywhere, streamed to a parent on the monitoring box with tiers sized for 90 days, dashboard reachable over the tailnet only, cloud unclaimed, alerts pruned to the dozen that matter, and the Prometheus endpoint scraped for the long-term subset. Total setup is an hour, and the payoff arrives the first time something goes sideways at 9 p.m. and the per-second charts show you which container, which disk, and when, while everyone else is still tailing logs.