Linux Server Performance Monitoring with Netdata

Netdata is an open-source, real-time Linux server performance monitoring tool with a lightweight web front-end. It allows you to monitor CPU, RAM usage, disk I/O, network traffic, mail queues, and many other system metrics. Written in C, Netdata is designed to be highly resource-efficient, updating system statistics on a 1-second granularity while utilizing minimal CPU resources.

Netdata Features

• Provides real-time anomaly diagnosis via thousands of metrics, interactive visualizations, and automated health alarms.
• Offers deep Linux kernel insights via eBPF metrics.
• Parses web server logs to display request processing times, upstream response metrics, and performance counters.
• Collects database infrastructure health data (MySQL/MariaDB, PostgreSQL, MongoDB, Galera Clusters).
• Extremely lightweight, utilizing roughly 1% of a single CPU core by default.

Prerequisites

• A remote Linux server running a supported distribution (Debian, Ubuntu, RHEL, Rocky Linux, AlmaLinux, Fedora, openSUSE, or Arch Linux).
• Root or sudo administrative access to the server.
• An active domain or subdomain with an A record pointing to your server IP (if configuring a reverse proxy).

Step 1: Install Netdata on a Linux Server

To ensure you deploy the latest upstream release, execute the official installation script on your system:

bash <(curl -Ss https://my-netdata.io/kickstart.sh) --disable-telemetry

Review the installation path summary presented on the screen, then type y and hit Enter to build and install dependencies.

Once installation finishes, check the service operational status to confirm it is running and enabled on boot:

systemctl status netdata

By default, Netdata binds to port 19999 across all network interfaces without built-in authentication. If your server utilizes a firewall daemon, you must explicitly allow incoming traffic on TCP port 19999:

# For UFW (Debian/Ubuntu)
sudo ufw allow 19999/tcp

# For Firewalld (RHEL/Rocky/AlmaLinux)
sudo firewall-cmd --permanent --add-port=19999/tcp
sudo firewall-cmd --reload

Troubleshooting Alternative Installations

If the script fails to complete due to environment compiling errors, you can provision pre-built binary packages via the official repository mirrors:

# Debian/Ubuntu systems
curl -s https://packagecloud.io/install/repositories/netdata/netdata/script.deb.sh | sudo bash
sudo apt install netdata

# RHEL/Rocky Linux/AlmaLinux/Fedora/openSUSE systems
curl -s https://packagecloud.io/install/repositories/netdata/netdata/script.rpm.sh | sudo bash
sudo dnf install netdata

Step 2: Set Up a Reverse Proxy

Routing traffic through an Nginx or Apache reverse proxy isolates the application, eliminates port numbers from web links, and prepares the site configuration for HTTPS mapping layers.

Option A: Nginx Configuration

Install the Nginx package using your native distribution package manager, then generate a new configuration map block:

sudo nano /etc/nginx/conf.d/netdata.conf

Populate the file with the following server block, replacing netdata.example.com with your target domain:

upstream netdata_backend {
   server 127.0.0.1:19999;
   keepalive 64;
}

server {
   listen 80;
   server_name netdata.example.com;

   location / {
     proxy_set_header X-Forwarded-Host $host;
     proxy_set_header X-Forwarded-Server $host;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_pass http://netdata_backend;
     proxy_http_version 1.1;
     proxy_pass_request_headers on;
     proxy_set_header Connection "keep-alive";
     proxy_store off;
   }
}

Test the syntax layout, then refresh your web engine service:

sudo nginx -t
sudo systemctl reload nginx

Option B: Apache Configuration

Install the Apache web server package via your native system repository, then open a virtual host file configuration:

# For Debian/Ubuntu
sudo nano /etc/apache2/sites-available/netdata.conf

# For RHEL/Rocky/AlmaLinux
sudo nano /etc/httpd/conf.d/netdata.conf

Add the following configuration map definitions, ensuring your target domain configuration fields match:

<VirtualHost *:80>
    ProxyRequests Off
    ProxyPreserveHost On
    
    ServerName netdata.example.com

    <Proxy *>
        Require all granted
    </Proxy>

    ProxyPass "/" "http://localhost:19999/" connectiontimeout=5 timeout=30 keepalive=on
    ProxyPassReverse "/" "http://localhost:19999/"

    ErrorLog ${APACHE_LOG_DIR}/netdata-error.log
    CustomLog ${APACHE_LOG_DIR}/netdata-access.log combined
</VirtualHost>

On Debian/Ubuntu architectures, enable required proxy handler modules, link the site virtual host, and restart Apache:

sudo a2enmod proxy proxy_http rewrite headers proxy_wstunnel
sudo a2ensite netdata.conf
sudo systemctl restart apache2

Step 3: Restrict Netdata Bindings to Localhost

Now that your reverse proxy maps traffic cleanly, restrict Netdata from listening to public interface paths to secure the deployment from direct network exploitation. Edit the application configuration file:

sudo nano /etc/netdata/netdata.conf
# Note: If not present, the file may reside at /opt/netdata/etc/netdata/netdata.conf

Locate the [web] configuration division block and restrict socket visibility explicitly to local loops:

[web]
    bind to = 127.0.0.1

Save amendments and restart the application daemon process:

sudo systemctl restart netdata

Step 4: Enable HTTPS Encryption Layers

Deploy a free Let's Encrypt TLS certificate layer using the Certbot utility tool. Install the base client software along with your specific web server module plugin:

# For Nginx Environments
sudo apt install certbot python3-certbot-nginx || sudo dnf install certbot python3-certbot-nginx
sudo certbot --nginx --agree-tos --redirect --hsts --staple-ocsp --email [email protected] -d netdata.example.com

# For Apache Environments
sudo apt install certbot python3-certbot-apache || sudo dnf install certbot python3-certbot-apache
sudo certbot --apache --agree-tos --redirect --hsts --staple-ocsp --email [email protected] -d netdata.example.com

Step 5: Enforce Password Authentication

To protect sensitive infrastructure visibility, restrict metrics accessibility using basic HTTP access authentication mechanisms.

HTTP Auth via Nginx

Generate your encrypted password verification file layout. Replace the placeholder items with your intended structural logins:

printf "yourusername:$(openssl passwd -crypt 'yourpassword')" | sudo tee -a /etc/nginx/passwords

Open your Nginx configuration, append basic authentication headers inside the server block, and apply configurations:

# Inside /etc/nginx/conf.d/netdata.conf
server {
    ...
    auth_basic "Protected Metric Space";
    auth_basic_user_file /etc/nginx/passwords;
    ...
}

sudo systemctl reload nginx

HTTP Auth via Apache

Compile your credentials file block inside the Apache system configuration space:

printf "yourusername:$(openssl passwd -crypt 'yourpassword')" | sudo tee -a /etc/apache2/passwords

Open your SSL-active virtual host tracking configuration file and inject access requirements directly into the proxy security wrapper:

# Inside your active Apache virtual host definition
<Proxy *>
    AllowOverride None
    AuthType Basic
    AuthName "Protected Metric Space"
    AuthUserFile /etc/apache2/passwords
    Require valid-user
</Proxy>

sudo systemctl restart apache2

Advanced Monitoring Optimizations

Memory Optimization via KSM (Kernel Same-page Merging)

If your system platform kernel architecture supports memory page de-duplication frameworks, you can toggle KSM active to compress runtime footprint spaces by roughly 40-60%. Run these tracking declarations as a direct root administrator:

echo 1 > /sys/kernel/mm/ksm/run
echo 1000 > /sys/kernel/mm/ksm/sleep_millisecs

Configuring External Email Warnings

To reroute health monitoring alerts outward from internal root systems directly to a target external email address, open the configuration assistant script:

sudo /etc/netdata/edit-config health_alarm_notify.conf

Modify the variables block to state your functional operational guidelines:

SEND_EMAIL="YES"
EMAIL_SENDER="[email protected]"
DEFAULT_RECIPIENT_EMAIL="[email protected]"

Save amendments and execute a system restart against the application service. Ensure your underlying server utilizes a local mail transmission utility (such as postfix) to handle outgoing relays correctly.

Enabling Nginx Application Metric Parsing

To collect detailed server metrics, ensure the Nginx stub_status configuration engine block is active locally on the server:

# Create /etc/nginx/conf.d/stub_status.conf
server {
     listen 127.0.0.1:80;
     server_name 127.0.0.1;
     location /nginx_status {
        stub_status on;
        allow 127.0.0.1;
        deny all;
     }
}

To calculate processing speeds and response delays, enhance the application log mapping arrays within your core /etc/nginx/nginx.conf file:

log_format netdata '$remote_addr - $remote_user [$time_local] '
              '"$request" $status $body_bytes_sent '
              '$request_length $request_time $upstream_response_time '
              '"$http_referer" "$http_user_agent"';

Append this custom logging format inside your active site virtual host configurations, map the data target path details to Netdata via the web_log.conf helper configuration utility, grant permissions, and restart the tracking processes:

sudo /etc/netdata/edit-config python.d/web_log.conf
# Append log details target mapping parameters:
# yourdomain.com:
#   name: 'yourdomain'
#   path: '/var/log/nginx/yourdomain.com.access.log'

sudo setfacl -R -m u:netdata:rx /var/log/nginx/
sudo systemctl restart netdata

Managing and Updating Netdata

Netdata provisions automated update checks daily via internal infrastructure script crontabs located at /etc/cron.daily/netdata-updater. If manual maintenance upgrades or structural file uninstalls are required, utilize the utilities included within the primary asset paths:

# Force manual upgrade
sudo /usr/libexec/netdata/netdata-updater.sh

# Remove software tree
sudo /usr/libexec/netdata/netdata-uninstaller.sh