How to Install Netdata (Self-Hosted) on Ubuntu 24.04 — Real-Time Monitoring with 1-Second Granularity

Most monitoring stacks force a trade-off: either you pay per host for SaaS with 15 to 60-second granularity, or you stitch together Prometheus, Grafana, alertmanager, node-exporter, and a storage backend yourself. Netdata breaks that trade-off. A single install gives you per-second metrics, hundreds of auto-discovered collectors, built-in machine-learning anomaly detection, multi-channel alerting, and a browser dashboard that feels like a real-time oscilloscope — all free, open source, and running entirely on your own server.

This tutorial walks you through installing self-hosted Netdata on an Ubuntu 24.04 VPS, tuning netdata.conf for production, building a Parent-Child streaming topology for fleets, enabling ML anomaly detection, wiring up alert notifications, and placing everything behind an Nginx reverse proxy with TLS and basic auth.

Skip the setup? Our CloudCore Starter plan at EUR 7.99/month is more than enough headroom to host Netdata for your entire fleet as a Parent node. Launch in 60 seconds.

Table of Contents

What is Netdata?

Netdata is an open-source, real-time observability agent for systems, containers, and applications. Where a traditional stack pairs node_exporter with Prometheus, a separate TSDB, a separate alerting system, and Grafana on top, Netdata bundles all of that into a single binary with sensible defaults and no configuration required to start.

At its core, Netdata collects thousands of metrics every second directly from the kernel, /proc, /sys, cgroups, eBPF probes, systemd journals, and over 300 application collectors (nginx, PostgreSQL, MySQL, Redis, MongoDB, Apache, PHP-FPM, Kubernetes, Docker, HAProxy, and many more). Collectors auto-discover — install Netdata on a server running PostgreSQL and it starts graphing pg_stat metrics within seconds, no YAML required.

Metrics are stored in Netdata's native dbengine, a tiered time-series database that keeps hot data in RAM, warm data in an SSD-friendly on-disk format, and compresses older data aggressively. Because Netdata samples at 1-second granularity by default, you can see micro-spikes in CPU, IO wait, or network packets that a 15-second scrape would smooth right over.

The dashboard ships with the agent. Browse to port 19999 and you get a browser UI with composite charts, correlation views, instant zoom, alert panes, and a built-in function catalogue for inspecting processes, sockets, and systemd services. No Grafana to deploy, no data source to wire up.

Why Self-Host Netdata vs Datadog

SaaS monitoring is convenient, but the economics break down quickly as your fleet grows. Self-hosted Netdata sits at the opposite end of the spectrum: one install, unlimited hosts, zero per-metric or per-host fees, and all telemetry stays on your infrastructure.

Alternatives worth knowing about

• How to install Prometheus on Ubuntu 24.04 — if you need a pull-based metric pipeline with PromQL.
• How to install Grafana on Ubuntu 24.04 — Netdata can be a Grafana data source if you want both dashboards.
• How to install Zabbix on Ubuntu 24.04 — enterprise-style monitoring with inventory and templating.
• How to install Checkmk on Ubuntu 24.04 — excellent host/service checks with an operator-friendly UI.

Prerequisites

• A VPS running Ubuntu 24.04 LTS with root or sudo access
• SSH access to the server
• At least 1 GB of RAM for a Child agent (2 GB+ recommended for a Parent)
• At least 5 GB of free disk space for a Child; 20 GB+ for a Parent with long retention
• A domain name pointed at your Parent's public IP if you plan to expose the dashboard

Recommended Plan: CloudCore Starter

For a single Parent node monitoring up to a few dozen Children, our CloudCore Starter plan is ideal:

- 2 vCPU cores

- 4 GB RAM

- 60 GB NVMe SSD

- Unmetered bandwidth

- EUR 7.99/month

Child agents can run on any VPS — they use only 100 to 200 MB of RAM when configured in streaming mode.

Connect to your server:

ssh root@your-server-ip

Step 1: Update System Packages

sudo apt update && sudo apt upgrade -y

Reboot if the kernel was updated:

sudo reboot

Step 2: Install Netdata with kickstart.sh

The official kickstart.sh installer is the recommended way to install on Ubuntu 24.04. It detects your distribution, installs from the official Netdata APT repository (native packages, not a compiled-from-source blob), sets up automatic updates, and starts the systemd service.

Install from the stable release channel (recommended for production):

wget -O /tmp/netdata-kickstart.sh https://get.netdata.cloud/kickstart.sh
sudo sh /tmp/netdata-kickstart.sh --stable-channel --dont-wait

Useful flags:

• --stable-channel — install the latest stable release (default is nightly).
• --dont-wait — skip the interactive confirmation.
• --disable-telemetry — opt out of anonymous usage statistics.
• --no-updates — disable the nightly auto-updater (if you prefer to manage updates manually).
• --native-only — refuse to fall back to source build if native packages aren't available.

Using Netdata release channel: stable
Installing netdata from Netdata's official native package repository
Netdata will be available at http://localhost:19999
 --- Netdata is now installed on your system ---

The installer creates:

• /etc/netdata/ — configuration directory (edit files here, not in /usr/lib/netdata/conf.d).
• /var/lib/netdata/ — dbengine data files.
• /var/log/netdata/ — error.log, access.log, collector.log.
• /usr/sbin/netdata — main binary.
• netdata.service — systemd unit, enabled and started automatically.

Step 3: Verify the Installation

sudo systemctl status netdata

Expected output:

● netdata.service - Real time performance monitoring
     Loaded: loaded (/usr/lib/systemd/system/netdata.service; enabled)
     Active: active (running) since Thu 2026-04-16 12:00:00 UTC; 30s ago
   Main PID: 2345 (netdata)
      Tasks: 42 (limit: 9431)
     Memory: 168.4M

Confirm the API is up:

curl -s http://localhost:19999/api/v1/info | head -20

Open the dashboard in a browser:

http://your-server-ip:19999

You should see live charts for CPU, memory, disk IO, network, systemd services, and any applications Netdata auto-detected. If you can't reach it from outside the server, open the port temporarily (we'll lock it back down behind Nginx in Step 9):

sudo ufw allow from YOUR_OFFICE_IP to any port 19999 proto tcp

Step 4: Configure netdata.conf

The main config file is at /etc/netdata/netdata.conf. Netdata's defaults are good, but a few tweaks make sense on any production install. Use edit-config to copy the stock file into /etc/netdata before editing (it lives there already on a fresh install, but on upgrades this helper keeps things tidy):

cd /etc/netdata
sudo ./edit-config netdata.conf

Key sections to review:

[global]
    hostname = parent-01.example.com
    run as user = netdata
    # Update frequency — 1 second is the default and the whole point of Netdata
    update every = 1
[db]
    # dbengine = tiered on-disk TSDB; alternatives: ram, save, map, none
    mode = dbengine
    # Tier 0 holds raw 1-sec samples; size in MiB
    dbengine tier 0 retention size = 1024
    # Tier 1 holds 1-min rollups
    dbengine tier 1 retention size = 512
    # Tier 2 holds 1-hour rollups — great for long-term trends
    dbengine tier 2 retention size = 256
[web]
    # Bind only to localhost once Nginx is in front
    bind to = 127.0.0.1
    # Allow connections from Nginx
    allow connections from = localhost 127.0.0.1
    allow dashboard from = localhost 127.0.0.1
[ml]
    # Enable the built-in ML anomaly detection (see Step 6)
    enabled = yes

Apply changes:

sudo systemctl restart netdata

Confirm dbengine retention is active:

curl -s http://localhost:19999/api/v1/dbengine_stats | grep -E 'retention|tier'

Step 5: Parent-Child Streaming

The Parent-Child pattern is Netdata's answer to "I have 50 VPS and don't want to browse 50 dashboards." Children stream their metrics in real time to a Parent, which becomes the single dashboard and the single alert source. Children can even run in memory-only mode (db mode = ram) so they use almost no disk and keep no local history.

On the Parent (central node)

Generate a streaming API key (any UUID will do):

uuidgen
e.g. 8f7e2c3d-4b5a-6e7f-8a9b-0c1d2e3f4a5b

Edit /etc/netdata/stream.conf:

sudo ./edit-config stream.conf

Add a receiver block for the key:

[8f7e2c3d-4b5a-6e7f-8a9b-0c1d2e3f4a5b]
    enabled = yes
    default history = 3600
    default memory mode = dbengine
    health enabled by default = auto
    allow from = *

Open the streaming port on the Parent (19999 is used for both dashboard and streaming):

sudo ufw allow from CHILD_SUBNET to any port 19999 proto tcp
sudo systemctl restart netdata

On each Child (monitored node)

Install Netdata with the same kickstart.sh command from Step 2, then edit stream.conf:

[stream]
    enabled = yes
    destination = parent-01.example.com:19999
    api key = 8f7e2c3d-4b5a-6e7f-8a9b-0c1d2e3f4a5b
    timeout seconds = 60
    default port = 19999
    send charts matching = *
    buffer size bytes = 1048576
    reconnect delay seconds = 5

Optionally set the Child to memory-only mode so it keeps no local history — everything lives on the Parent:

# /etc/netdata/netdata.conf on the Child
[db]
    mode = ram
    retention = 3600

Restart:

sudo systemctl restart netdata

Verify the Child connected by checking the Parent's error log:

sudo tail -f /var/log/netdata/error.log
Look for: STREAM_RECEIVER[child-hostname] connected

The Child's charts will now appear on the Parent's dashboard under the Nodes menu — with the exact same 1-second granularity, as if Netdata were installed locally.

Step 6: Enable ML Anomaly Detection

Netdata includes a built-in machine-learning engine that trains a small k-means model per metric and classifies each new sample as normal or anomalous. Training is local, cheap, and runs continuously — no external service, no data export.

Edit /etc/netdata/netdata.conf:

[ml]
    enabled = yes
    # Minimum training samples before predictions start
    minimum num samples to train = 900
    # Training window in seconds (4 hours)
    maximum num samples to train = 14400
    # Retrain every 3 hours
    train every = 10800
    # Number of k-means models per metric (smoothing)
    num models per dimension = 18
    # Anomaly detection grouping window (in seconds)
    anomaly detection grouping method = average
    anomaly detection grouping duration = 60

Restart:

sudo systemctl restart netdata

On the dashboard, each chart now shows an AR% (anomaly rate) ribbon beneath the graph. When multiple unrelated metrics spike their anomaly rates simultaneously, that correlation often identifies the root cause faster than a threshold alert ever could.

To alert on anomalies, see the ml-* sample alert templates in /etc/netdata/health.d/ml/ and the per-dimension anomaly_bit query in /api/v1/data?chart=...&options=anomaly-bit.

Step 7: Health Alarms

Netdata ships with ~200 curated alert definitions out of the box (high load, low disk, swap usage, failed systemd units, HTTP endpoint down, and more). They live in /etc/netdata/health.d/ as .conf files; the master /etc/netdata/health_alarm_notify.conf controls delivery.

List active alerts:

curl -s http://localhost:19999/api/v1/alarms?all | jq 'keys | length'

Add a custom alert — for example, alert when 1-minute system load exceeds 80% of the number of CPU cores:

sudo ./edit-config health.d/load.conf

Append:

template: custom_high_load
       on: system.load
    class: Utilization
     type: System
component: Load
   lookup: average -1m unaligned of load1
    units: load
    every: 10s
     warn: $this > (0.8 * $system.cpu.cores)
     crit: $this > (1.2 * $system.cpu.cores)
    delay: down 5m multiplier 1.5 max 1h
     info: 1-minute load average is elevated versus CPU core count
       to: sysadmin

Reload health checks without restarting Netdata:

sudo netdatacli reload-health

The to: sysadmin role maps to a channel in health_alarm_notify.conf, covered next.

Step 8: Alert Notifications (Slack, Telegram, Email)

Open the notification config:

cd /etc/netdata
sudo ./edit-config health_alarm_notify.conf

Slack

Create an Incoming Webhook at https://api.slack.com/apps, copy the URL, then set:

SEND_SLACK="YES"
SLACK_WEBHOOK_URL="https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX"
DEFAULT_RECIPIENT_SLACK="#alerts"

Telegram

Create a bot with @BotFather to get a token, then add your bot to a group and fetch the chat ID:

curl -s "https://api.telegram.org/bot<TOKEN>/getUpdates" | jq '.result[].message.chat.id'

Set:

SEND_TELEGRAM="YES"
TELEGRAM_BOT_TOKEN="1234567890:ABCdefGHIjklMNOpqrsTUVwxyz"
DEFAULT_RECIPIENT_TELEGRAM="-100123456789"

Email

Netdata uses the local sendmail or msmtp binary. Install msmtp if you don't already have a mail agent:

sudo apt install -y msmtp msmtp-mta bsd-mailx

Then in health_alarm_notify.conf:

SEND_EMAIL="YES"
EMAIL_SENDER="[email protected]"
DEFAULT_RECIPIENT_EMAIL="[email protected]"

Route roles to channels

Further down the same file, wire the sysadmin role we used in Step 7:

role_recipients_slack[sysadmin]="#alerts"
role_recipients_telegram[sysadmin]="-100123456789"
role_recipients_email[sysadmin]="[email protected]"

Test a notification

sudo su -s /bin/bash netdata
/usr/libexec/netdata/plugins.d/alarm-notify.sh test sysadmin
exit

You should see test messages land in Slack, Telegram, and your inbox within seconds.

Step 9: Nginx Reverse Proxy with TLS and Basic Auth

Exposing port 19999 directly to the internet is never a good idea. Put Netdata behind Nginx with Let's Encrypt TLS and HTTP basic auth.

Install:

sudo apt install -y nginx apache2-utils certbot python3-certbot-nginx

Create a basic-auth password file:

sudo htpasswd -c /etc/nginx/.netdata-htpasswd opsuser

Make sure Netdata is bound to localhost only (you did this in Step 4):

# /etc/netdata/netdata.conf
[web]
    bind to = 127.0.0.1

Create the Nginx site:

sudo tee /etc/nginx/sites-available/netdata > /dev/null <<'EOF'
upstream netdata {
    server 127.0.0.1:19999;
    keepalive 64;
}
server {
    listen 80;
    server_name netdata.example.com;
    return 301 https://$host$request_uri;
}
server {
    listen 443 ssl http2;
    server_name netdata.example.com;
    ssl_certificate     /etc/letsencrypt/live/netdata.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/netdata.example.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers on;
    add_header Strict-Transport-Security "max-age=31536000" always;
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options SAMEORIGIN;
    auth_basic "Netdata";
    auth_basic_user_file /etc/nginx/.netdata-htpasswd;
    location / {
        proxy_pass http://netdata;
        proxy_http_version 1.1;
        proxy_pass_request_headers on;
        proxy_set_header Connection "keep-alive";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_store off;
    }
    # WebSocket / streaming endpoints
    location ~ /(api/v2|api/v1/data|api/v1/chart) {
        proxy_pass http://netdata;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_read_timeout 3600s;
    }
}
EOF

Enable and obtain a certificate:

sudo ln -s /etc/nginx/sites-available/netdata /etc/nginx/sites-enabled/
sudo nginx -t
sudo certbot --nginx -d netdata.example.com
sudo systemctl reload nginx

Close the raw Netdata port externally:

sudo ufw delete allow 19999 || true
sudo ufw allow 'Nginx Full'

You can now reach the dashboard at https://netdata.example.com with basic-auth protection and a valid TLS certificate.

Step 10: Netdata Cloud (Optional)

Netdata Cloud is the free SaaS layer on top of the open-source agent. It adds:

• A unified view across all your Parents and Children
• Role-based access control for teams
• Alerting from outside your network (useful if your Parent goes down)
• Long-running metric correlations across the fleet

To connect:

# Sign in at https://app.netdata.cloud, create a Space/Room, and grab a claim token
sudo netdata-claim.sh -token=YOUR_CLAIM_TOKEN -rooms=YOUR_ROOM_ID -url=https://app.netdata.cloud

Restart the agent:

sudo systemctl restart netdata

The node appears in Netdata Cloud within a minute. To disconnect, delete /var/lib/netdata/cloud.d/claimed_id and restart the service.

Troubleshooting

sudo tail -f /var/log/netdata/error.log /var/log/netdata/collector.log

FAQ

Is self-hosted Netdata really free?

Yes. The Netdata Agent is fully open source (GPL-3.0) and free forever, including 1-second metric granularity, ML anomaly detection, alerts, and dashboards. Netdata Cloud adds optional fleet-wide features with a generous free tier.

How is Netdata different from Datadog?

Datadog bills per host (roughly USD 15 to 34/host/mo) with 15-second granularity on most plans. Self-hosted Netdata collects at 1-second granularity by default, runs entirely on your infrastructure, and costs only the VPS it runs on. For small to mid-sized fleets, Netdata is 10 to 50 times cheaper.

How much RAM and disk does Netdata use?

A single agent typically uses 100 to 200 MB of RAM and 1 to 3% of one CPU core. Disk usage depends on dbengine retention — a 1 GiB tier-0 cache retains roughly a week of 1-second data on a typical VPS.

Do I need Netdata Cloud?

No. The local dashboard at port 19999 gives the full feature set. Cloud is useful for a single pane of glass across many nodes and external alerting.

What is Parent-Child streaming?

Lightweight Children forward their metrics in real time to a central Parent, which handles long-term storage, dashboards, and alerts. Children can run memory-only with zero local retention — ideal for fleets of small VPS.

Can Netdata send alerts to Slack and Telegram?

Yes. health_alarm_notify.conf supports 25+ channels out of the box including Slack, Telegram, Discord, email, PagerDuty, Opsgenie, and custom webhooks.

How does ML anomaly detection work?

Each agent trains a small k-means model per metric using the last 4 hours of data, retraining every 3 hours. Samples are classified locally and anomaly bits are stored alongside the raw data. No telemetry leaves the server.

Next Steps

• Integrate Netdata with Prometheus — Scrape /api/v1/allmetrics?format=prometheus from your Prometheus server. See our Prometheus install guide.
• Visualize Netdata in Grafana — Add Netdata as a Prometheus data source and build cross-tool dashboards. See our Grafana install guide.
• Compare with enterprise monitors — If you need inventory, business-service monitoring, or SLA reports, compare with Zabbix or Checkmk.
• Deep-dive the official docs — learn.netdata.cloud is the canonical reference for collectors, alert syntax, and streaming topologies.

Ready to deploy Netdata?

Spin up a CloudCore Starter VPS at EUR 7.99/month — 2 vCPU, 4 GB RAM, 60 GB NVMe — more than enough to host Netdata as a Parent node for dozens of Children. Ubuntu 24.04 is one click away, and you'll have a live dashboard in under 30 minutes.