Netdata’s single agent monitors every container on each host using cgroups-level metrics. You pay per-node, not per-container. This eliminates the ‘container trap’ where autoscaling creates surprise bills. One agent can monitor hundreds of containers without additional cost.

Netdata collects metrics every second with 1-second visualization latency - sub-2-second worst-case total latency from event to dashboard. This is 10-60× more granular than traditional tools (10-60 second intervals). Per-second granularity captures microbursts, CPU throttling, and memory spikes that minute-based monitoring averages away.

Netdata auto-discovers all Kubernetes resources (pods, nodes, deployments, services) and monitors control plane components (API server, etcd, scheduler). The k8s_state collector provides real-time pod lifecycle tracking, while cgroups.plugin monitors per-container resource usage. Helm charts enable one-command deployment with DaemonSet for nodes and Deployment for centralized storage.

Yes, for infrastructure monitoring. Netdata provides metrics collection, storage, visualization, ML anomaly detection, and alerting in one platform - with zero configuration. Netdata also ingests OpenTelemetry traces over OTLP, so your instrumented services can send spans to the same agents and you explore them in the Traces tab of Netdata Cloud.

Netdata trains 18 unsupervised k-means models per metric using different time windows. All 18 models must agree before flagging an anomaly (consensus requirement), achieving 99% false positive reduction in anomaly detection. The Anomaly Advisor then correlates anomalies across thousands of metrics to surface root causes in the top 30-50 results - typically identifying the issue in seconds.

Agents run on each container host, collecting metrics and storing data locally. Parents aggregate data from multiple Agents, providing centralized storage, longer retention, and unified dashboards. For ephemeral containers (Kubernetes), Parents are essential - Agents can run in RAM-only mode (<2% CPU, <150 MB RAM) while Parents handle persistent storage and ML training.

Netdata’s extreme cardinality protection automatically detects and cleans up ephemeral metrics (≥1,000 instances, >50% ephemeral). Industry-leading compression (0.6 bytes/sample) maintains efficiency even with millions of unique time series. Beyond cleanup, contained impact means cardinality issues stay within the streaming hierarchy rather than cascading globally, and resources scale linearly. This prevents the storage cost multiplier that plagues traditional tools in dynamic container environments.

Yes. Netdata’s primary container monitoring uses cgroups.plugin (works everywhere) and k8s_state collector (Kubernetes). eBPF (ebpf.plugin) provides additional kernel-level visibility for processes, network, and filesystem - but requires Linux kernel 4.11+ and does NOT run inside containers (requires host DaemonSet). Core container monitoring works without eBPF.

Netdata queries systemd-journal (Linux) or Windows Event Logs in place, with no log pipeline. This eliminates Elasticsearch/Splunk infrastructure, achieving 90% cost reduction. The systemd-journal.plugin provides full-text search, field filtering, and histograms. For containers, logs written to journald (Docker’s journald logging driver) are queried in place, and container and Kubernetes pod log files are collected through Netdata’s OpenTelemetry logs pipeline (Logs Management) and stored with every field indexed.

Netdata supports Docker, containerd, Podman, LXC/LXD, and Kubernetes (any runtime). The cgroups.plugin monitors resource usage regardless of runtime by interfacing directly with kernel cgroups. For Kubernetes, the k8s_state collector works with any conformant cluster. Netdata also monitors systemd-nspawn containers and VMs (KVM, Xen, VMware).

Netdata provides 90% cost reduction with predictable per-node pricing (vs Datadog’s per-host + custom metrics fees). Netdata delivers true real-time (1s vs 15s), zero configuration (vs extensive setup), and data sovereignty (metrics stay on-premises). Netdata also ingests OpenTelemetry traces over OTLP and shows them in the Traces tab, next to your container metrics and logs. Datadog’s APM suite adds code-level profiling, so teams that depend on it can run both. For infrastructure monitoring plus OpenTelemetry tracing, Netdata covers it.

Yes. Netdata Cloud federates queries across unlimited Parents/Agents, providing unified dashboards for multi-cluster environments. Deploy one Parent cluster per Kubernetes cluster (or per region), then organize via Spaces (physical isolation) and Rooms (logical isolation). Queries are distributed in parallel with sub-2s latency even across 100,000+ nodes.

Netdata provides runtime observability (ebpf.plugin for process/network/filesystem monitoring on host level, systemd-journal for audit logs) but does NOT provide preventive security (image scanning, CIS compliance, policy enforcement). Complement Netdata with Trivy/Grype for vulnerability scanning, Lynis/InSpec for CIS compliance, and Falco for signature-based threat detection. Netdata excels at runtime detection; security tools excel at prevention.

Zero. Netdata auto-discovers containers, generates dashboards, and configures alerts in 60 seconds - no PromQL, no YAML, no manual setup. The NIDL framework (Nodes, Instances, Dimensions, Labels) enables point-and-click analysis without query languages. Junior engineers get the same visibility as senior SREs. This is fundamentally different from Prometheus/Grafana which require weeks to master.

Linearly from 1 to 100,000+ nodes. Each Agent operates independently (no central bottleneck), Parents scale horizontally (add more for more Agents), and Netdata Cloud federates queries across unlimited Parents. Netdata’s internal benchmark at 4.6 million metrics/second showed 36% less CPU and 88% less RAM than Prometheus. Adding nodes doesn’t affect existing performance.

Yes. Netdata provides a Prometheus scrape endpoint and Grafana datasource plugin. You can gradually migrate by running Netdata alongside existing tools, then deprecate Prometheus/Grafana once you experience Netdata’s zero-config dashboards and ML anomaly detection. Many organizations keep Prometheus for long-term storage while using Netdata for real-time monitoring and troubleshooting.

Netdata bills per node, with P90 billing protection. Every container on a node is monitored, with no charges for metrics volume, Logs Monitoring (querying logs in place), users, data retention or containers. Plans include ML anomaly detection, 400+ pre-configured alerts, and 800+ integrations; Business includes 10 AI credits per month for AI troubleshooting. 14-day free Business trial with no limit on nodes. See the pricing page for current plan details.

Netdata Parents provide persistent storage for ephemeral Agents. Agents stream metrics in real-time to Parents, which maintain historical data even after containers are destroyed. The extreme cardinality protection automatically cleans up old time-series from terminated containers. This architecture is specifically designed for Kubernetes and auto-scaling environments where containers have short lifespans.

Netdata collects 3,000-20,000 metrics per node including: CPU (user/system/throttling), memory (RSS/cache/swap/pressure), network (bytes/packets/errors/drops per interface), disk I/O (read/write bytes/ops/throttling), container restarts, states, readiness, and resource limits. Plus process-level metrics (via apps.plugin), network connections (via ebpf.plugin on host), and logs (systemd-journal in place, plus container and pod logs through Netdata’s OpenTelemetry logs pipeline). All with per-second granularity.

Yes. Netdata’s Windows agent monitors Windows containers via performance counters and Windows Event Logs. The windows.plugin provides container resource metrics, while windows-events.plugin captures container lifecycle events. However, eBPF-based features (ebpf.plugin) are Linux-only. Core container monitoring (CPU, memory, network, disk) works on both Linux and Windows.