Netdata Real-Time Monitoring for Linux Servers

Netdata collects thousands of metrics per server every second — CPU, memory, disk I/O, network, processes, containers, and application-specific collectors — with zero configuration for most Linux systems. Unlike traditional monitoring that samples every 15–60 seconds, Netdata gives you per-second granularity, which makes it invaluable for diagnosing sudden spikes, OOM events, and brief latency bursts that other tools miss entirely.

This guide installs Netdata on individual servers, configures alerting to Telegram or Slack, and sets up parent-child streaming so you can centralize dashboards without losing per-node detail. Netdata complements Prometheus/Grafana — many teams run both, using Netdata for real-time troubleshooting and Prometheus for long-term trend storage.

What Netdata Monitors Out of the Box

• System: CPU per core, memory, swap, load, uptime, entropy
• Storage: disk I/O, space usage, inode usage, SMART health
• Network: bandwidth per interface, packets, errors, sockets
• Processes: top consumers, file descriptors, systemd services
• Containers: Docker and Podman cgroup metrics automatically
• Apps: Nginx, PostgreSQL, MySQL, Redis, and 200+ more via collectors

Step 1: Install Netdata with the Kickstart Script

curl https://get.netdata.cloud/kickstart.sh > /tmp/netdata-kickstart.sh
sh /tmp/netdata-kickstart.sh --stable-channel --claim-token YOUR_CLAIM_TOKEN --claim-rooms YOUR_ROOM_ID

# Without Netdata Cloud (local only):
sh /tmp/netdata-kickstart.sh --stable-channel --no-claim

# Verify:
sudo systemctl status netdata
curl -s http://127.0.0.1:19999/api/v1/info | head

Step 2: Secure the Dashboard

By default, Netdata listens on all interfaces. Bind to localhost and expose through a reverse proxy with authentication, or restrict access via firewall rules.

sudo tee -a /etc/netdata/netdata.conf >/dev/null <<'EOF'
[web]
    bind to = 127.0.0.1
    allow connections from = localhost 10.0.0.0/8
EOF

sudo systemctl restart netdata

Step 3: Configure Telegram Alerts

sudo tee /etc/netdata/health_alarm_notify.conf >/dev/null <<'EOF'
SEND_TELEGRAM="YES"
DEFAULT_RECIPIENT_TELEGRAM="YOUR_CHAT_ID"
TELEGRAM_BOT_TOKEN="YOUR_BOT_TOKEN"
EOF

# Test notification:
sudo /usr/libexec/netdata/plugins.d/alarm-notify.sh test

Step 4: Tune Alert Thresholds

Netdata ships with hundreds of preconfigured alerts. Review the most critical ones for your environment and adjust thresholds to reduce noise.

# View active alarms:
curl -s http://127.0.0.1:19999/api/v1/alarms?all | python3 -m json.tool | head -50
# Custom alert example — /etc/netdata/health.d/custom.conf:
alarm: high_disk_usage
on: disk.space
lookup: average -1m percentage of used
units: %
every: 1m
[...]

Step 5: Set Up Parent-Child Streaming

Stream metrics from child nodes to a central parent for unified dashboards. Children retain local data and dashboards — streaming is additive, not a replacement for local monitoring.

# On parent (monitoring.example.com) — /etc/netdata/stream.conf:
[STREAM]
    enabled = yes
[CHILD_SERVER_1]
    enabled = yes
    allow from = 10.0.0.11
# On child node — /etc/netdata/stream.conf:
[STREAM]
[...]

Step 6: Enable Application Collectors

# Nginx stub_status collector:
# Add to nginx.conf:
# location /stub_status {
#     stub_status;
#     allow 127.0.0.1;
#     deny all;
# }
# PostgreSQL collector — /etc/netdata/go.d/postgres.conf:
[...]

Step 7: Export to Prometheus (Optional)

# /etc/netdata/exporting.conf:
[prometheus:local]
    enabled = yes
    destination = localhost:9090
    data source = average
    prefix = netdata
    send names instead of ids = yes
    send configured labels = yes

Resource Usage

Netdata is lightweight: typically 50–150 MB RAM and minimal CPU on a standard VPS. The parent node needs more resources proportional to the number of children — plan 1 GB RAM per 10–20 child nodes for the parent dashboard.

Production Checklist

• Do not expose port 19999 to the public internet without authentication.
• Test alert delivery monthly with alarm-notify.sh test.
• Review and disable noisy alerts after the first week of data.
• Use parent-child streaming for fleets larger than 5 servers.
• Keep Netdata updated — collectors improve with each release.

"Per-second metrics turn five-minute mysteries into five-second diagnoses — that is why Netdata belongs on every production Linux host."