netdata

Netdata collects thousands of metrics per second (default update_every=1) across 850+ integrations by automatically discovering data sources without manual configuration. The collector architecture in src/collectors/ and src/go/plugin/go.d/ uses a modular plugin system where external collector processes (src/plugins.d/) are spawned and managed by the core daemon (src/daemon/), each maintaining independent threads that parse system interfaces, container APIs, and application endpoints to extract metrics in real-time.

Netdata trains unsupervised learning models locally on each agent (src/ml/) to detect anomalies per metric without sending raw data to cloud services. The ML pipeline analyzes metric distributions, seasonality, and trend deviations using statistical models that adapt to each metric's baseline behavior, enabling real-time anomaly flagging at the edge with sub-second latency and zero external dependencies.

Netdata provides Windows-specific monitoring (src/collectors/windows/) that collects metrics from Windows Performance Counters and WMI (Windows Management Instrumentation) APIs, enabling monitoring of Windows-specific metrics like CPU, memory, disk I/O, network, and application-specific counters. The collector automatically discovers available counters and maps them to Netdata metrics.

Netdata provides Kubernetes-aware monitoring through collectors that integrate with Kubernetes APIs (src/collectors/kubernetes/) to discover and monitor pods, nodes, and services. The system automatically detects container metadata, tracks pod lifecycle events, and collects container-specific metrics from cgroup interfaces, enabling visibility into containerized workloads without manual configuration.

Netdata provides integration points for distributed tracing and APM systems through its API and collector framework, enabling correlation of system metrics with application-level traces. While Netdata itself does not implement tracing, it can ingest trace-derived metrics (latency percentiles, error rates) from external APM systems and correlate them with infrastructure metrics for end-to-end visibility.

Netdata implements a proprietary RRD-like engine (src/database/engine/) that stores metrics in a custom time-series database with configurable retention tiers, page-cache optimization (src/database/engine/cache.c), and SQLite metadata storage (src/database/engine/). The engine uses memory-mapped I/O and journal files (src/database/engine/journalfile.c) to achieve high write throughput while maintaining query performance across historical data without external dependencies like InfluxDB or Prometheus.

Netdata implements real-time metric replication via a parent-child streaming protocol (src/streaming/) where child agents continuously stream their collected metrics to parent agents, enabling infrastructure-wide dashboards and centralized alerting without requiring a separate metrics aggregation layer. The streaming system uses efficient binary protocols and handles network interruptions with automatic reconnection and backpressure management.

Netdata implements a declarative alert system (src/health/) where users define alert rules using a domain-specific language that evaluates metric conditions, triggers notifications, and manages alert state transitions. The health engine evaluates rules every second against collected metrics, supports multiple notification backends (email, Slack, PagerDuty, webhooks), and can synchronize alert configurations with Netdata Cloud (src/aclk/) for centralized management across distributed agents.

Netdata implements a secure bidirectional communication channel (src/aclk/) between agents and Netdata Cloud that enables cloud-based features (multi-node dashboards, RBAC, centralized alert configuration) while maintaining agent autonomy. ACLK uses TLS-encrypted WebSocket connections with certificate-based authentication, allowing agents to receive configuration updates and send alerts to cloud while remaining fully functional if cloud connectivity is lost.

Netdata provides a built-in React-based web dashboard (src/web/) that renders real-time metric charts with interactive features including zoom, pan, drill-down, and metric selection. The dashboard communicates with the Netdata API to fetch metric data, supports multiple visualization types (line, area, stacked charts), and can display metrics from multiple agents via parent-child streaming or cloud aggregation.

Netdata exposes a comprehensive RESTful API (src/web/api/) that enables programmatic access to collected metrics, alert status, and agent configuration. The API supports multiple query formats (JSON, CSV, raw), time-range filtering, metric aggregation, and data export, allowing external tools and scripts to integrate with Netdata without direct database access.

Netdata implements a modular collector architecture (src/collectors/, src/go/plugin/go.d/) where collectors are independent plugins that discover and monitor specific services or systems. The system supports multiple collector implementations (C-based internal collectors, Go-based collectors, shell scripts, external processes) with automatic discovery, health checks, and dynamic enable/disable based on system state.

Netdata includes a specialized SQL database collector (src/collectors/databases/) that automatically discovers database instances, executes monitoring queries, and extracts metrics without manual configuration. The collector supports MySQL, PostgreSQL, MongoDB, and other databases, with built-in queries for common metrics (connections, queries, replication lag) and extensibility for custom queries.