Server Monitoring with Netdata: Install and Secure 2026

curl -sSL https://cp.lv/scripts/monitoring-servera-netdata.sh | sudo bash

wget -qO- https://cp.lv/scripts/monitoring-servera-netdata.sh | sudo bash

#!/usr/bin/env bash
# Install Netdata and expose it through nginx with basic auth
set -euo pipefail
export DEBIAN_FRONTEND=noninteractive

# 1. Install Netdata (official kickstart, stable channel)
wget -O /tmp/netdata-kickstart.sh https://get.netdata.cloud/kickstart.sh
sudo sh /tmp/netdata-kickstart.sh --stable-channel --disable-telemetry --non-interactive

# 2. Bind the agent to localhost only
sudo tee /etc/netdata/netdata.conf > /dev/null << 'EOF'
[web]
    bind to = 127.0.0.1
EOF
sudo systemctl restart netdata

# 3. nginx reverse proxy with basic auth
sudo apt-get update -y
sudo apt-get install -y nginx apache2-utils openssl
PASS="$(openssl rand -base64 12)"
sudo htpasswd -bc /etc/nginx/.netdata-htpasswd admin "$PASS"

# quoted 'EOF' keeps nginx variables ($host) from being expanded
sudo tee /etc/nginx/sites-available/netdata > /dev/null << 'EOF'
server {
    listen 80;
    server_name monitor.example.com;
    auth_basic "Netdata";
    auth_basic_user_file /etc/nginx/.netdata-htpasswd;
    location / {
        proxy_pass http://127.0.0.1:19999;
        proxy_set_header Host $host;
        proxy_http_version 1.1;
        proxy_set_header Connection "keep-alive";
    }
}
EOF

sudo ln -sf /etc/nginx/sites-available/netdata /etc/nginx/sites-enabled/netdata
sudo nginx -t && sudo systemctl reload nginx
echo "Done. Dashboard is served on the domain. Login: admin, password: $PASS"

Netdata installs with a single command and immediately gives you a web dashboard with real-time server metrics: CPU load, memory, disk, network and processes, all at one-second resolution. Below is the installation, how to lock down access and how to set up alerts.

Why Netdata

Unlike heavier stacks such as Prometheus + Grafana, Netdata installs in a minute, needs no configuration and shows hundreds of metrics out of the box. It is ideal when you need to see what the server is doing right now.

Requirements: any VPS with 512 MB RAM or more. The agent is light on resources.

Step 1. Installation

The official kickstart script detects your distribution on its own:

wget -O /tmp/netdata-kickstart.sh https://get.netdata.cloud/kickstart.sh
sh /tmp/netdata-kickstart.sh --stable-channel --disable-telemetry

The --disable-telemetry flag turns off anonymous statistics reporting.

After installation the service starts automatically:

systemctl status netdata

Step 2. Opening the dashboard

Netdata listens on port 19999. Open it in a browser:

http://<your_VPS_IP>:19999

You get a live dashboard. By default that port is open to everyone, which is unsafe — let’s restrict it.

Step 3. Closing direct access

Bind Netdata to localhost only. In /etc/netdata/netdata.conf:

[web]
    bind to = 127.0.0.1

Restart it:

systemctl restart netdata

The dashboard is now reachable only from the server itself; we will expose it externally through a password-protected reverse proxy.

Step 4. A reverse proxy with authentication (nginx)

Install the utilities and create a password:

apt install -y nginx apache2-utils
htpasswd -c /etc/nginx/.netdata-htpasswd admin

Open the config in an editor (sudo nano /etc/nginx/sites-available/netdata) and paste the contents:

server {
    listen 80;
    server_name monitor.example.com;

    auth_basic "Netdata";
    auth_basic_user_file /etc/nginx/.netdata-htpasswd;

    location / {
        proxy_pass http://127.0.0.1:19999;
        proxy_set_header Host $host;
        proxy_http_version 1.1;
        proxy_set_header Connection "keep-alive";
    }
}

Or create the whole config with one command (the quoted 'EOF' matters — it keeps the nginx variable $host intact):

sudo tee /etc/nginx/sites-available/netdata > /dev/null << 'EOF'
server {
    listen 80;
    server_name monitor.example.com;
    auth_basic "Netdata";
    auth_basic_user_file /etc/nginx/.netdata-htpasswd;
    location / {
        proxy_pass http://127.0.0.1:19999;
        proxy_set_header Host $host;
        proxy_http_version 1.1;
        proxy_set_header Connection "keep-alive";
    }
}
EOF

Activate it:

ln -s /etc/nginx/sites-available/netdata /etc/nginx/sites-enabled/
nginx -t && systemctl reload nginx

The dashboard now opens on your domain behind a login and password. Add HTTPS with certbot to encrypt the traffic.

Step 5. Setting up alerts

Netdata can send alerts to Telegram, email and Slack. For Telegram, edit /etc/netdata/health_alarm_notify.conf:

SEND_TELEGRAM="YES"
TELEGRAM_BOT_TOKEN="<bot_token>"
DEFAULT_RECIPIENT_TELEGRAM="<chat_id>"

Test the delivery:

/usr/libexec/netdata/plugins.d/alarm-notify.sh test

Metrics worth watching

Tuning the thresholds

Alert rules live in /etc/netdata/health.d/. The disk usage threshold, for example:

nano /etc/netdata/health.d/disk_space.conf

Reload the configuration after any change:

netdatacli reload-health

Encrypting access (HTTPS)

Basic authentication without HTTPS sends the password in clear text. Add a Let’s Encrypt certificate with certbot:

apt install -y certbot python3-certbot-nginx
certbot --nginx -d monitor.example.com

certbot adds the HTTPS redirect and sets up automatic renewal itself. Check the renewal timer:

systemctl status certbot.timer

Limiting the agent’s footprint

On a small VPS, lower the collection frequency to reduce the load. In /etc/netdata/netdata.conf:

[db]
    update every = 2

A value of 2 collects metrics every two seconds instead of every second — slightly less precision, noticeably less load. Unneeded collectors (for services you do not run, for example) can be switched off in the [plugins] section.

Useful dashboard sections

• System Overview — a summary of CPU, RAM, disk and network.
• Applications — resource usage by process group.
• Disks — latency and utilisation of each block device.
• Networking Stack — connections, retransmits and TCP errors.

The dashboard is fully interactive: hover over a chart to see exact values at a given moment, and drag across it to zoom into a range.

Updating and removing

Update Netdata to the latest stable version:

netdata-updater.sh

Remove the agent completely if you no longer need it:

/usr/libexec/netdata/netdata-uninstaller.sh --yes --force

Frequently asked questions

How much does Netdata consume? The agent is light, but at one-second resolution the load is noticeable on a small VPS. You can increase the collection interval in netdata.conf.

Is historical data stored? Yes, locally in the dbengine database. The retention depth is set in the [db] section of the config.

Can I monitor several servers? Yes, through Netdata Cloud or a parent node (streaming) that collects metrics from the children.

Is it safe to leave port 19999 open? No. Bind the agent to localhost and proxy it through nginx with a password and HTTPS.

Does Netdata replace Prometheus? For fast real-time monitoring, yes. For long retention and complex queries, Prometheus + Grafana is more flexible.

Monitoring is a mandatory part of running a server. Host your project on a VPS plan or a VPS for security and VPN. Monitoring and alerting can be set up by Server administration.