Netdata is a real-time infrastructure monitoring platform that collects metrics every second from the nodes it runs on, auto-discovers what to monitor, trains machine-learning models per metric at the edge, and raises alerts, without a central metrics store. It runs on Linux, macOS, FreeBSD, and Windows and covers system resources, storage, network, hardware sensors, processes, logs, containers, virtual machines, synthetic checks, cloud-provider infrastructure, and packaged applications such as nginx, PostgreSQL, Redis, and MongoDB.
Each Netdata Agent runs a modular pipeline: collect, store in a tiered time-series database, learn per-metric ML models from recent behaviour, detect anomalies, check alert rules, stream to Netdata Parents, archive to external stores, serve queries over an API, and score metric correlations. Parents centralise dashboards, retention, and alert configuration for many Agents; the optional Netdata Cloud adds remote access, single sign-on, role-based access control, and multi-node views while metrics stay on your infrastructure.
For AI-assisted operations, Netdata exposes an MCP (Model Context Protocol) server so assistants such as Claude or Cursor can query a running deployment during an incident, alongside AI reporting, an anomaly advisor, and root-cause and blast-radius analysis in the platform.
Features
- Per-second collection: metrics are gathered and visualised with one-second latency across 800+ integrations, including OpenMetrics, StatsD, and logs
- Zero-configuration discovery: the Agent auto-detects services, containers, and hardware on the node and generates dashboards from a NIDL data model without a query language
- Edge ML anomaly detection: multiple unsupervised models per metric are trained on the node and score anomalies locally
- Tiered retention: three storage tiers (per-second, per-minute, per-hour) at roughly 0.5 bytes per sample, queried automatically by zoom level
- Parent-Child streaming: Agents stream to Parents for central dashboards, longer retention, and replication; Parents scale to millions of samples per second
- Log management: direct systemd-journald and Windows Event Log integration with processing at the edge
- Alerting and notifications: hundreds of pre-configured alerts with delivery to email, Slack, Telegram, PagerDuty, Discord, Microsoft Teams, and others
- Exports: archives metrics to Prometheus, InfluxDB, OpenTSDB, Graphite, and other stores
- MCP access for AI assistants: an MCP server lets agents such as Claude or Cursor interrogate live infrastructure state
- Resource footprint: about 5% CPU and 150 MiB RAM by default, under 1% CPU and about 100 MiB RAM with ML and alerts disabled; can run entirely in RAM or stream to a Parent for no disk writes
