How to monitor a Linux server with Netdata
Install Netdata for per-second CPU, memory, disk and network charts, keep its dashboard private behind an SSH tunnel, and get its built-in alerts.
Tested on Ubuntu 24.04 LTS
Before you start
- A server running Ubuntu or Debian or a RHEL-family distribution
- Root or a user with sudo
- SSH access from your computer
To monitor a Linux server with Netdata, run Netdata's kickstart script (wget -O /tmp/netdata-kickstart.sh https://get.netdata.cloud/kickstart.sh && sh /tmp/netdata-kickstart.sh), then open port 19999 in a browser. You get per-second charts for CPU, memory, disks, network and every running service, with alerts already configured, and nothing to set up first.
The dashboard has no password by default, so this tutorial binds it to localhost and reaches it through an SSH tunnel instead of opening the port to the internet. We installed Netdata 2.12.1 on Ubuntu 24.04 this way; the script also supports Debian, AlmaLinux, Rocky Linux and Fedora.
Install Netdata
Download the kickstart script, then run it:
wget -O /tmp/netdata-kickstart.sh https://get.netdata.cloud/kickstart.sh
sh /tmp/netdata-kickstart.sh --stable-channel --disable-telemetryWhat the options do:
--stable-channelinstalls the stable releases rather than the nightly builds, which are the default.--disable-telemetrystops the agent sending anonymous usage statistics to Netdata.
The script adds Netdata's own package repository (/etc/apt/sources.list.d/netdata.sources on Ubuntu and Debian), installs the netdata package and its plugins, and starts the service. It asks for confirmation and for sudo along the way; add --non-interactive to skip the questions. To read it first, open /tmp/netdata-kickstart.sh before the second command.
Check it worked
systemctl is-active netdata
sudo ss -tlnp | grep 19999The service is active, and it listens on port 19999 on every address (0.0.0.0:19999). Fix that next.
Keep the dashboard private
Anyone who can reach port 19999 can read everything Netdata collects: processes, connections, disk names. Make it listen on localhost only. Add this to the end of /etc/netdata/netdata.conf:
[web]
bind to = 127.0.0.1Then restart it:
sudo systemctl restart netdata
sudo ss -tlnp | grep 19999It now shows 127.0.0.1:19999 only.
To open the dashboard, forward the port over SSH from your computer:
ssh -N -L 19999:127.0.0.1:19999 deploy@203.0.113.10Leave that running and browse to http://localhost:19999. Close the tunnel with Ctrl+C when you're done. Nothing extra is exposed on the server, and the tunnel is as secure as your SSH login.
If you need the dashboard reachable without a tunnel, put it behind a reverse proxy with HTTPS and a password, or connect the server to Netdata Cloud (below), rather than opening 19999.
Read the dashboard
The dashboard opens on an overview of the node. The sections worth looking at first:
| Section | What to look for |
|---|---|
| System Overview: CPU | Sustained use near 100%, and iowait (time waiting for the disk) |
| System Overview: Load | The load average compared with your number of vCPUs |
| Memory | Available memory, and any swap activity |
| Disks | Utilisation and the time requests wait (latency) |
| Networking | Traffic in and out, and errors or drops |
| Applications (apps plugin) | CPU and memory per program, grouped (nginx, postgres, docker) |
| systemd Services | The same per service |
Every chart is per second for recent data. Zoom with the time picker or by dragging on a chart, and the other charts follow, which makes it easy to see what else happened at the moment of a spike.
Alerts
Netdata ships with alert rules for CPU, memory, disk space, disk latency, network errors and many applications; they're in /usr/lib/netdata/conf.d/health.d/ (cpu.conf, ram.conf, disks.conf and more than a hundred others). Active alerts show up under Alerts in the dashboard.
To change a threshold, copy the file into /etc/netdata/ with Netdata's helper and edit the copy:
cd /etc/netdata
sudo ./edit-config health.d/cpu.conf
sudo netdatacli reload-healthTo have alerts emailed, the server needs to be able to send mail. Netdata uses the system's sendmail, so set up an SMTP relay first, then set DEFAULT_RECIPIENT_EMAIL with sudo ./edit-config health_alarm_notify.conf.
Netdata Cloud (optional)
Netdata Cloud is Netdata's hosted service: it shows several servers on one dashboard, adds sign-in, and sends alert notifications without a mail setup. Connecting a server is optional, and the local dashboard works without it. If you want it, the Connect button in the dashboard (or the claim options of the kickstart script) walks you through it. Read Netdata's terms for what it stores; the metrics themselves stay on your server.
Updates and removal
Because Netdata came from its own repository, it updates with your normal sudo apt upgrade (or dnf upgrade).
To remove it completely:
sh /tmp/netdata-kickstart.sh --uninstallDownload the script again first if /tmp has been cleared.
Troubleshooting
The browser can't connect to http://localhost:19999. The SSH tunnel isn't running, or another program on your computer uses 19999. Use another local port: ssh -N -L 29999:127.0.0.1:19999 ... and browse to localhost:29999.
Netdata uses more memory than you'd like. It used about 60 MB in our test. Shorter retention lowers it: see [db] in netdata.conf and Netdata's documentation on database modes.
ss still shows 0.0.0.0:19999 after the change. The [web] section is in the wrong file or misspelt. sudo netdatacli dumpconfig | grep -A3 '^\[web\]' shows what Netdata actually read.
Next steps
- Found something busy? Troubleshoot high CPU and memory.
- Match a spike to log lines with journalctl.
- The quick, no-install checks: monitor your server.
Doing it on VPSNine
The VPSNine panel already graphs each server's CPU, memory, disk reads and writes and network traffic in five-minute steps, and can email you on resource alerts without anything installed on the server. Netdata adds per-second detail and per-process charts from inside it. Runs on Ubuntu 24.04 and every other image, on all plans.