Monitoring, alerting, and trending (MAT) are rarely at the top of the list of important topics for admins, but they simply cannot be avoided in everyday life. Experienced admins in particular will be familiar with the problem of Nagios and its numerous forks and offshoots, which used to be obvious choices for the prevailing IT landscape, being difficult to transfer later to containerized microservice architectures.

In the meantime, much has happened in the monitoring world. Increasing numbers of solutions are capable of automatically identifying targets and adding them to their configurations. Instead of legacy event monitoring, trending is seeing more frequent use, to the extent that event monitoring is becoming a kind of byproduct. However, those who have ever worked with Prometheus and had to develop a strategy for the long-term storage of metrics data will not relish the prospect.

Netdata promises to do things better. In this article, I take a closer look at how Netdata works to discover exactly what the solution offers.

Netdata

With a remarkably simple architecture, Netdata (Figure 1) lets you monitor your infrastructure without too much overhead. To do this, you just need to install the Netdata agent on the devices in your infrastructure and set up a connection to Netdata Cloud to create a complete monitoring system quickly with a colorful graphical user interface (GUI), functional display, and meaningful alerting.

Figure 1: Netdata offers comprehensive monitoring for services on premises and in the cloud. It generates clear user interface (UI) views from the collected metrics data.

If you think Netdata is a commercial provider, you are partly right. The complete software is available under a free license. Although a charge is levied for using the Netdata cloud service, the price spectrum will not cause experienced admins to break a sweat. The bottom line is also significantly cheaper than employing one or more full-timers to operate and maintain your in-house monitoring solution.

Licensing Questions

The Netdata website [1] is full of superlatives, with talk of infinite scalability, straightforward pricing, and maximum cost efficiency. The whole thing gives the impression that you are dealing with a Silicon Valley start-up marketing a proprietary monitoring solution. At least in terms of the location, you're not entirely wrong: Netdata Inc. is based in San Francisco, and as you might expect, Netdata is also backed by major investors.

However, the bit about proprietary software is not quite right. Although Netdata is a little circumscript when explaining the license model, it is basically quite simple. The Netdata agent, which runs directly on the customer systems and accesses the data of the services to be monitored there, is licensed under version 3 of the GNU General Public License (GPLv3) and is therefore completely open software. The provider also explicitly points this out, maybe to dispel security concerns up front.

The situation is different with two other components: Netdata Cloud and Netdata UI. These components make the whole setup really interesting. Although the Netdata agent can theoretically run locally without a connection to Netdata Cloud and Netdata UI, in practical terms the two components handle all analysis tasks and prepare the acquired data for dashboards and trending graphs (Figure 2). Unfortunately, neither of the two components is under an open license; they are proprietary software.

Figure 2: Netdata has several cloud endpoints worldwide. Alternatively, you can operate the product on premises.

If you do not want to use Netdata in the cloud, you still have the option of installing it on premises, which certainly dispels European concerns about the General Data Protection Regulation (GDPR), but to refer to Netdata as a completely open source and free solution would be an exaggeration.

The license model structure implicitly explains how Netdata, or rather its architecture, works. Customers roll out the agent on their infrastructure and specify the desired Netdata cloud platform as the target. Data acquisition starts, and almost immediately, Netdata Cloud and Netdata UI return colorful charts and assume the tasks of monitoring the services on your target systems, some of which will be detected automatically.

What Netdata Monitors

From the point of view of an organization that needs a simple and functional monitoring system, the license issue could be of secondary interest. In this case, practical aspects are probably more important, such as the question of which targets Netdata can monitor and how it does so. The Netdata developers claim more than 300 supported monitoring targets, which does not even include the basic metrics of individual systems such as CPU and RAM utilization, I/O, network performance, and so on.

Basically, Netdata acts more like a time series database than a classic monitoring system, which makes its functionality more similar to that of Prometheus than Zabbix or Icinga. The agent collects data on basic system metrics and specific services such as MySQL on the target systems. From this data, Netdata then draws conclusions about the status of the services and raises an alarm, if necessary. It would be well beyond the scope of this article to look at every supported target service at this point. The highlights include the classic Linux standard services for authorization and authentication (i.e., OpenLDAP, SSH, FreeRADIUS, HashiCorp Vault, etc.).

Netdata also covers classic network infrastructure services, including BIND, PowerDNS, most DHCP servers, and common databases (e.g., PostgreSQL, MySQL, and MariaDB). Netdata can seamlessly monitor NTP and Chrony as time servers without any additional configuration. Systemd gets a completely separate section: Netdata monitors systemd's metrics in a practically seamless way, including various details on top, such as the total number of services started or the number of services that systemd has tagged as Failed .

If you are looking for a comprehensive way of monitoring your hardware, Netdata can do so. The software can read out most common hardware sensors to aggregate data. This capability proves to be very helpful in various places (e.g., temperature sensors in servers). If a case fan dies, Netdata notices – on one hand because it records the data from the fan itself, but on the other hand (presumably) because the temperature in the server increases. Hardware sensors can also be controlled and read outside of the classic IT infrastructure. For example, if you were to install thermometers in your home as part of your smart home setup, you could use Netdata to monitor them.

One particularly practical aspect is that Netdata does not necessarily have to rely on the Linux kernel or its drivers in servers to discover the values of the various sensors. It can read these values directly by HP Integrated Lights-Out (iLO), IBM Rational Software Architect (RSA), and Dell Remote Access Controller (DRAC) or generically with the Intelligent Platform Management Interface (IPMI) or Redfish. When it comes to the Internet of things (IoT), Netdata also leverages the full potential: The service can connect to practically all popular open source solutions for home automation, working directly with OpenHAB, with connectors for adapters such as Homebridge, which can be connected to other solutions such as the FHEM house automation system.

If you frequently deal with smart home scenarios, you will already be familiar with the zoo of different standards: You will appreciate Netdata's versatility. In addition to collection services, Netdata can communicate directly with various IoT tools from established manufacturers. API tokens can connect to Philips Hue and devices from Netatmo and Elgato. If you operate a photovoltaic or battery storage system (e.g., SolarEdge hardware or SMA converters from SMA Solar Technology AG), you also have a good chance of accessing the metrics data they generate. In addition to acquisition tools for Linux, FreeBSD and macOS counterparts exist.

The Netdata developers clearly and carefully consider the source of their data. They have written a dedicated module for importing metric data from eBPF, Linux's in-kernel virtual machine that allows arbitrary intervention in network traffic. Armed with suitable virtual eBPF instances, practically the entire status of a network can be read out and interpreted. Coroot [2] is another monitoring solution that leverages this ability, but the Netdata programmers take things even further than Coroot with an artificial intelligence (AI) function on the Netdata dashboard designed to detect anomalies in network traffic on the basis of data from eBGP (Figure 3).

Figure 3: Netdata uses eBPF to provide AI-supported anomaly detection for network traffic. In doing so, it is following in the footsteps of services such as Coroot.