The only agent that thinks for itself

Autonomous Monitoring with self-learning AI built-in, operating independently across your entire stack.

Unlimited Metrics & Logs
Machine learning & MCP
5% CPU, 150MB RAM
3GB disk, >1 year retention
800+ integrations, zero config
Dashboards, alerts out of the box
> Discover Netdata Agents

Centralized metrics streaming and storage

Aggregate metrics from multiple agents into centralized Parent nodes for unified monitoring across your infrastructure.

Stream from unlimited agents
Long-term data retention
High availability clustering
Data replication & backup
Scalable architecture
Enterprise-grade security
> Learn about Parents

Fully managed cloud platform

Access your monitoring data from anywhere with our SaaS platform. No infrastructure to manage, automatic updates, and global availability.

Zero infrastructure management
99.9% uptime SLA
Global data centers
Automatic updates & patches
Enterprise SSO & RBAC
SOC2 & ISO certified
> Explore Netdata Cloud

Deploy Netdata Cloud in your infrastructure

Run the full Netdata Cloud platform on-premises for complete data sovereignty and compliance with your security policies.

Complete data sovereignty
Air-gapped deployment
Custom compliance controls
Private network integration
Dedicated support team
Kubernetes & Docker support
> Learn about Cloud On-Premises

Powerful, intuitive monitoring interface

Modern, responsive UI built for real-time troubleshooting with customizable dashboards and advanced visualization capabilities.

Real-time chart updates
Customizable dashboards
Dark & light themes
Advanced filtering & search
Responsive on all devices
Collaboration features
> Explore Netdata UI

Monitor on the go

Native iOS and Android apps bring full monitoring capabilities to your mobile device with real-time alerts and notifications.

iOS & Android apps
Push notifications
Touch-optimized interface
Offline data access
Biometric authentication
Widget support
> Download apps

The future of infrastructure observability

See our strategic direction across AI-native observability, full-stack signals, operational intelligence, and enterprise platform maturity.

AI-native observability
Full-stack signal coverage
Operational intelligence
Enterprise platform maturity
Agent releases every 6 weeks
Cloud continuous delivery
> Explore Product Roadmap

Best energy efficiency

True real-time per-second

100% automated zero config

Centralized observability

Multi-year retention

High availability built-in

Zero maintenance

Always up-to-date

Enterprise security

Complete data control

Air-gap ready

Compliance certified

Millisecond responsiveness

Infinite zoom & pan

Works on any device

Native performance

Instant alerts

Monitor anywhere

AI-native observability

Continuous delivery

Open source foundation

80% Faster Incident Resolution

AI-powered troubleshooting from detection, to root cause and blast radius identification, to reporting.

True Real-Time and Simple, even at Scale

Linearly and infinitely scalable full-stack observability, that can be deployed even mid-crisis.

90% Cost Reduction, Full Fidelity

Instead of centralizing the data, Netdata distributes the code, eliminating pipelines and complexity.

See and Map Your Entire Network

Live topology, flow analytics, and SNMP device and trap monitoring — unified with your full-stack observability.

Control Without Surrender

SOC 2 Type 2 certified with every metric kept on your infrastructure.

Integrations

800+ collectors and notification channels, auto-discovered and ready out of the box.

800+ data collectors
Auto-discovery & zero config
Cloud, infra, app protocols
Notifications out of the box
> Explore integrations
Real Results
46% Cost Reduction

Reduced monitoring costs by 46% while cutting staff overhead by 67%.

— Leonardo Antunez, Codyas

Zero Pipeline

No data shipping. No central storage costs. Query at the edge.

From Our Users
"Out-of-the-Box"

So many out-of-the-box features! I mostly don't have to develop anything.

— Simon Beginn, LANCOM Systems

No Query Language

Point-and-click troubleshooting. No PromQL, no LogQL, no learning curve.

Enterprise Ready
67% Less Staff, 46% Cost Cut

Enterprise efficiency without enterprise complexity—real ROI from day one.

— Leonardo Antunez, Codyas

SOC 2 Type 2 Certified

Zero data egress. Only metadata reaches the cloud. Your metrics stay on your infrastructure.

Full Coverage
800+ Collectors

Auto-discovered and configured. No manual setup required.

Any Notification Channel

Slack, PagerDuty, Teams, email, webhooks—all built-in.

Built for the People Who Get Paged

Because 3am alerts deserve instant answers, not hour-long hunts.

Every Industry Has Rules. We Master Them.

See how healthcare, finance, and government teams cut monitoring costs 90% while staying audit-ready.

Monitor Any Technology. Configure Nothing.

Install the agent. It already knows your stack.
From Our Users
"A Rare Unicorn"

Netdata gives more than you invest in it. A rare unicorn that obeys the Pareto rule.

— Eduard Porquet Mateu, TMB Barcelona

99% Downtime Reduction

Reduced website downtime by 99% and cloud bill by 30% using Netdata alerts.

— Falkland Islands Government

Real Savings
30% Cloud Cost Reduction

Optimized resource allocation based on Netdata alerts cut cloud spending by 30%.

— Falkland Islands Government

46% Cost Cut

Reduced monitoring staff by 67% while cutting operational costs by 46%.

— Codyas

Real Coverage
"Plugin for Everything"

Netdata has agent capacity or a plugin for everything, including Windows and Kubernetes.

— Eduard Porquet Mateu, TMB Barcelona

"Out-of-the-Box"

So many out-of-the-box features! I mostly don't have to develop anything.

— Simon Beginn, LANCOM Systems

Real Speed
Troubleshooting in 30 Seconds

From 2-3 minutes to 30 seconds—instant visibility into any node issue.

— Matthew Artist, Nodecraft

20% Downtime Reduction

20% less downtime and 40% budget optimization from out-of-the-box monitoring.

— Simon Beginn, LANCOM Systems

Pay per Node. Unlimited Everything Else.

One price per node. Unlimited metrics, logs, users, and retention. No per-GB surprises.

Free tier—forever
No metric limits or caps
Retention you control
Cancel anytime
> See pricing plans

What's Your Monitoring Really Costing You?

Most teams overpay by 40-60%. Let's find out why.

Expose hidden metric charges
Calculate tool consolidation
Customers report 30-67% savings
Results in under 60 seconds
> See what you're really paying

Your Infrastructure Is Unique. Let's Talk.

Because monitoring 10 nodes is different from monitoring 10,000.

On-prem & air-gapped deployment
Volume pricing & agreements
Architecture review for your scale
Compliance & security support
> Start a conversation

Monitoring That Sells Itself

Deploy in minutes. Impress clients in hours. Earn recurring revenue for years.

30-second live demos close deals
Zero config = zero support burden
Competitive margins & deal protection
Response in 48 hours
> Apply to partner

Per-Second Metrics at Homelab Prices

Same engine, same dashboards, same ML. Just priced for tinkerers.

Community: Free forever · 5 nodes · non-commercial
Homelab: $90/yr · unlimited nodes · fair usage
> Get the Homelab Plan

$1,000 Per Referral. Unlimited Referrals.

Your colleagues get 10% off. You get 10% commission. Everyone wins.

10% of subscriptions, up to $1,000 each
Track earnings inside Netdata Cloud
PayPal/Venmo payouts in 3-4 weeks
No caps, no complexity
> Get your referral link
Cost Proof
40% Budget Optimization

"Netdata's significant positive impact" — LANCOM Systems

Calculate Your Savings

Compare vs Datadog, Grafana, Dynatrace

Savings Proof
46% Cost Reduction

"Cut costs by 46%, staff by 67%" — Codyas

30% Cloud Bill Savings

"Reduced cloud bill by 30%" — Falkland Islands Gov

Enterprise Proof
"Better Than Combined Alternatives"

"Better observability with Netdata than combining other tools." — TMB Barcelona

Real Engineers, <24h Response

DPA, SLAs, on-prem, volume pricing

Why Partners Win
Demo Live Infrastructure

One command, 30 seconds, real data—no sandbox needed

Zero Tickets, High Margins

Auto-config + per-node pricing = predictable profit

Homelab Ready
Free Video Course

8-episode Netdata tutorial by LearnLinux.tv

76k+ GitHub Stars

3rd most starred monitoring project

Worth Recommending
Product That Delivers

Customers report 40-67% cost cuts, 99% downtime reduction

Zero Risk to Your Rep

Free tier lets them try before they buy

AI Support Assistant, Available 24/7

Nedi has access to all official documentation, source code, and resources. Ask any question about Netdata—responds in your language.

Deployment & configuration
Troubleshooting & sizing
Alerts & notifications
Evidence-based answers
> Ask Nedi now

Never Fight Fires Alone

Docs, community, and expert help—pick your path to resolution.

Learn.netdata.cloud docs
Discord, Forums, GitHub
Premium support available
> Get answers now

60 Seconds to First Dashboard

One command to install. Zero config. 850+ integrations documented.

Linux, Windows, K8s, Docker
Auto-discovers your stack
> Read our documentation

76,000+ Engineers Strong

615+ contributors. 1.5M daily downloads. One mission: simplify observability.

Per-Second. 90% Cheaper. Data Stays Home.

Side-by-side comparisons: costs, real-time granularity, and data sovereignty for every major tool.

See why teams switch from Datadog, Prometheus, Grafana, and more.

> Browse all comparisons
Edge-Native Observability, Born Open Source
Per-second visibility, ML on every metric, and data that never leaves your infrastructure.
Founded in 2016
615+ contributors worldwide
Remote-first, engineering-driven
Open source first
> Read our story
Promises We Publish—and Prove
12 principles backed by open code, independent validation, and measurable outcomes.
Open source, peer-reviewed
Zero config, instant value
Data sovereignty by design
Aligned pricing, no surprises
> See all 12 principles
Edge-Native, AI-Ready, 100% Open
76k+ stars. Full ML, AI, and automation—GPLv3+, not premium add-ons.
76,000+ GitHub stars
GPLv3+ licensed forever
ML on every metric, included
Zero vendor lock-in
> Explore our open source
Build Real-Time Observability for the World
Remote-first team shipping per-second monitoring with ML on every metric.
Remote-first, fully distributed
Open source (76k+ stars)
Challenging technical problems
Your code on millions of systems
> See open roles
Meet the Team Behind Netdata
Conferences, meetups, and tradeshows where you can see Netdata in action and talk to the engineers who build it.
Live demos and deep dives
Book 1-on-1 meetings
Talks and panel sessions
Event recaps and photos
> See all events
Talk to a Netdata Human in <24 Hours
Sales, partnerships, press, or professional services—real engineers, fast answers.
Discuss your observability needs
Pricing and volume discounts
Partnership opportunities
Media and press inquiries
> Book a conversation
Your Data. Your Rules.
On-prem data, cloud control plane, transparent terms.
Trust & Scale
76,000+ GitHub Stars

One of the most popular open-source monitoring projects

SOC 2 Type 2 Certified

Enterprise-grade security and compliance

Data Sovereignty

Your metrics stay on your infrastructure

Validated
University of Amsterdam

"Most energy-efficient monitoring solution" — ICSOC 2023, peer-reviewed

ADASTEC (Autonomous Driving)

"Doesn't miss alerts—mission-critical trust for safety software"

Community Stats
615+ Contributors

Global community improving monitoring for everyone

1.5M+ Downloads/Day

Trusted by teams worldwide

GPLv3+ Licensed

Free forever, fully open source agent

Why Join?
Remote-First

Work from anywhere, async-friendly culture

Impact at Scale

Your work helps millions of systems

$ guides / nvme / nvme-pcie-aer-errors ▌

Operations Guides

NVMe PCIe AER errors: correctable and uncorrectable transport-layer faults

You opened the kernel log because something felt off, and found lines like this repeating:

pcieport 0000:00:1b.0: AER: Corrected error received: 0000:01:00.0
nvme 0000:01:00.0: PCIe Bus Error: severity=Corrected, type=Physical Layer, (Receiver ID)

That is PCI Express Advanced Error Reporting (AER), the transport layer underneath NVMe telling you the link between the root port and the drive is producing errors. These errors happen below the NVMe protocol: the drive’s SMART data can look perfectly healthy while the PCIe link is retransmitting constantly, quietly adding latency to every I/O.

The first decision is severity. AER splits errors into two classes. Correctable errors (RxErr, BadTLP, BadDLLP, and friends) are fixed by hardware retransmission: no data is lost, but each retry costs time, and a high rate means the physical link is marginal. Uncorrectable errors, fatal or non-fatal, mean the link layer could not recover: these precede link retraining, controller resets, or the device falling off the bus entirely.

This article covers how to read the kernel messages, pull the persistent counters from sysfs, and decide whether you are looking at a loose connector or an impending device loss. For the broader NVMe signal model, see how NVMe actually works in production.

What this means

PCIe is a packet-based serial transport. Data moves in TLPs (transaction layer packets) protected by CRCs and a link-layer replay mechanism. When a packet arrives corrupted, the receiver NAKs it and the sender retransmits. That retry is a correctable error: functionally invisible, temporally real. When retries are exhausted or the error class is not recoverable (a malformed TLP that breaks protocol, or a link training failure), the error is uncorrectable.

AER is the standardized mechanism by which PCIe devices and root ports report these events. On Linux, the pcieport AER driver logs them, and the kernel exposes per-device counters in sysfs. NVMe sits on top of all of this and knows nothing about it. The controller sees slightly slower completions; your application sees slightly higher latency; the filesystem sees nothing at all. That is why transport errors are the blind spot of NVMe monitoring: every standard tool watches the drive, nobody watches the bus.

The practical escalation model:

flowchart TD
  A[AER messages in kernel log] --> B{Severity?}
  B -->|Corrected| C[Check TOTAL_ERR_COR rate]
  B -->|Uncorrectable non-fatal| D[Check TOTAL_ERR_NONFATAL + dmesg context]
  B -->|Uncorrectable fatal| E[Device likely frozen or removed]
  C -->|Low or zero rate| F[Baseline noise - document and watch]
  C -->|Sustained rate| G[Physical layer fault: connector, cable, slot, retimer]
  D --> H[Driver-level recovery - watch for recurrence]
  E --> I[Check /sys/class/nvme/nvmeX/state and device presence]
  G --> J[Reseat drive, inspect slot, monitor counters after]

Common causes

CauseWhat it looks likeFirst thing to check
Poorly seated M.2 or U.2 driveThousands of correctable RxErr errors, often after the chassis was moved or servicedPower down, reseat the drive, check screw/retention, watch counters after reboot
Marginal signal integritySustained correctable error rate, sometimes correlated with temperature or link speed downgradesCompare current_link_speed/current_link_width against the max values
Riser, cable, or backplane faultCorrectable storm plus occasional non-fatal errors; may affect one slot onlyMove the drive to a different slot to isolate drive vs. slot
Retimer/redriver failure on backplaneErrors on multiple drives behind the same backplaneCompare AER counters across all devices on the same root complex
Root port or chipset issueErrors reported by the root port for the endpoint; may survive drive replacementCheck the root port’s own aggregate AER counters and vendor errata
PCIe power management (ASPM) transitionsCorrectable errors correlating with idle/load transitionsTest with link power management disabled and see if the rate drops
Failing drive electronicsUncorrectable errors escalating toward fatal, controller resets, device removalCheck /sys/class/nvme/nvmeX/state and the SMART critical warning

A loose M.2 connector deserves special mention because it is the single most common root cause: vibration or thermal cycling breaks contact on a lane, and the link starts generating thousands of correctable errors while the drive reports perfectly healthy SMART data. Latency gets measurably worse and nothing else alerts.

Quick checks

All of these are read-only and safe to run during an incident.

# 1. Find the AER messages and their severity
dmesg -T | grep -i "aer\|pcie bus error" | tail -50

# 2. Read the persistent correctable-error counter for the device
cat /sys/class/nvme/nvme0/device/aer_dev_correctable

# 3. Read the uncorrectable counters (root-only)
sudo cat /sys/class/nvme/nvme0/device/aer_dev_fatal
sudo cat /sys/class/nvme/nvme0/device/aer_dev_nonfatal

# 4. Check whether the link has trained down
cat /sys/class/nvme/nvme0/device/current_link_speed
cat /sys/class/nvme/nvme0/device/max_link_speed
cat /sys/class/nvme/nvme0/device/current_link_width
cat /sys/class/nvme/nvme0/device/max_link_width

# 5. Check controller state (fatal errors can freeze or remove the device)
cat /sys/class/nvme/nvme0/state

# 6. Rule out drive-level health problems
nvme smart-log /dev/nvme0 | grep -E "critical_warning|media_errors|num_err_log_entries"

The three aer_dev_* files each list per-error-type counts followed by a total: TOTAL_ERR_COR, TOTAL_ERR_FATAL, and TOTAL_ERR_NONFATAL respectively. All three files are world-readable (the kernel exposes each as mode 0444), so the sudo in the examples below is not strictly required. All three appear on AER-capable devices, the NVMe endpoint included, whenever the kernel initialized AER for that device. If the files are missing entirely, check dmesg | grep -i aer at boot to see whether AER initialized; some platforms run in firmware-first mode where the BIOS handles errors and Linux never sees them.

Two things about these counters that trip people up:

  • transport_err_cnt does not exist in sysfs. Operators regularly go looking for it. The AER counters are the only transport error signal the kernel exposes.
  • The counters are cumulative and read-only. They are in-memory statistical counters with no reset mechanism in any kernel version, so they cannot be cleared short of a reboot; track deltas over time, not absolute values.

How to diagnose it

  1. Classify the severity from the log. Look at the most recent AER lines in dmesg -T. severity=Corrected means retransmission is handling it. severity=Uncorrectable (Non-Fatal) means the error reached the driver layer but recovery was possible. severity=Uncorrectable (Fatal) means the hierarchy was reset; check immediately whether the device is still present (ls /sys/class/nvme/ and cat /sys/class/nvme/nvme0/state).

  2. Quantify the correctable rate. Read aer_dev_correctable, note TOTAL_ERR_COR and the per-type breakdown (RxErr, BadTLP, BadDLLP are the usual suspects). Wait a fixed interval under typical load and read it again. A rate of zero to a handful per hour on a platform that has always done that is baseline noise. A sustained rate, or thousands accumulating, is a physical-layer problem.

  3. Check for a trained-down link. Compare current vs. max link speed and width. A Gen4 x4 drive running at Gen3 x2 delivers a quarter of the bandwidth with no errors at the NVMe layer. AER errors plus a degraded link strongly suggests signal integrity problems rather than a drive problem.

  4. Isolate drive vs. slot vs. platform. If you can schedule a maintenance window: reseat the drive first (this fixes the majority of correctable storms on M.2), then move it to a different slot. If errors follow the drive, the drive or its connector is at fault. If errors stay with the slot, suspect the riser, backplane, retimer, or root port.

  5. Correlate with the NVMe layer. Pull nvme smart-log and check critical_warning, media_errors, and num_err_log_entries. Transport errors with a clean SMART log point at the physical link. Transport errors plus rising media errors or a nonzero critical warning means the drive itself is sick and the AER errors may be a symptom of failing device electronics.

  6. Watch for the downstream pattern. Uncorrectable errors are the early edge of a worse failure: they precede link retraining, controller resets (“Resetting controller” in dmesg), and in the fatal case, device removal. If non-fatal uncorrectable errors are recurring, treat it as a pre-incident for the patterns in the reset-loop and device-disappeared guides linked below.

Metrics and signals to monitor

SignalWhy it mattersWarning sign
TOTAL_ERR_COR rate (aer_dev_correctable)Physical layer signal integrity; each error is a retransmission that adds latencyAny sustained non-zero rate above your platform baseline
TOTAL_ERR_NONFATAL (aer_dev_nonfatal)Uncorrectable errors that the driver had to recover fromAny occurrence; recurrence is a pre-incident signal
TOTAL_ERR_FATAL (aer_dev_fatal)Errors that froze the hierarchy and forced a resetAny occurrence; investigate before the next one removes the device
current_link_speed / current_link_width vs. maxSilent bandwidth capping from retraining or marginal lanesCurrent lower than max on either
Controller state (/sys/class/nvme/nvmeX/state)Whether the device survived the error eventsAnything other than live persisting more than about 30 seconds
NVMe media_errors and critical_warningSeparates “the bus is noisy” from “the drive is dying”Any increment alongside AER errors
Block-layer latency on the deviceThe actual cost of retransmissions shows up here, nowhere elseLatency rising with no corresponding NVMe or application errors

Fixes

Reseat and physically remediate

For a correctable-error storm, the highest-probability fix is physical: power down, remove the drive, inspect the connector for debris or damage, reseat with proper retention (M.2 screw fully seated, U.2/U.3 carrier fully latched), and reboot. Watch TOTAL_ERR_COR after. If the rate drops to zero, you are done. Do not attempt to reseat a live drive unless your chassis and configuration explicitly support NVMe hot-plug.

Isolate and replace the failing component

If reseating does not help, move the drive to a known-good slot. Errors that follow the drive mean drive-side electronics or connector damage: replace the drive. Errors that stay with the slot mean riser, cable, backplane, or root port: replace that component or re-route to a different slot. On systems with retimers in the backplane, errors affecting multiple drives behind the same backplane point there rather than at any single drive.

If correctable errors correlate with idle-to-load transitions and the rate is otherwise low, test with PCIe active state power management disabled (a kernel boot parameter or BIOS setting, depending on platform) and observe whether the rate drops. This trades power efficiency for link stability; on latency-sensitive production NVMe that trade is usually correct, but validate on your hardware rather than applying it blindly.

Do not paper over uncorrectable errors

Boot parameters exist that suppress AER logging entirely (pci=noaer). That hides the messages; it does not fix the link. If you use it to stop a log flood from a known-noisy platform, keep the sysfs counters under monitoring so the signal is not lost. Fatal uncorrectable errors are never a logging problem: the device was reset or isolated, and the next occurrence may take it off the bus. Treat those as hardware incidents.

Prevention

  • Baseline per platform. Some hardware generates a low background rate of correctable errors that the vendor considers normal. Record the baseline per machine model so you can tell noise from regression.
  • Reseat after any chassis service. The highest-correlation event with new AER storms is someone opening the chassis. Add “check AER counters” to the post-maintenance checklist.
  • Alert on rate, not on messages. AER messages in dmesg are ratelimited and easy to miss in log volume; the sysfs counters are not. Alert on any sustained increase in TOTAL_ERR_COR and any increment of the fatal or non-fatal totals.
  • Track link speed/width continuously. A trained-down link is the silent companion of signal integrity problems. Alert on current != max.
  • Correlate before replacing drives. AER errors with clean SMART data is a platform problem, not a drive problem. Swapping the drive without checking the slot wastes hardware and leaves the fault in place.

How Netdata helps

Netdata’s NVMe collector covers the drive side of this picture: SMART health, media errors, critical warning bits, temperature, and endurance. That is exactly the correlation you need when AER errors appear, because the first question is always “is the bus noisy or is the drive dying.” Specifically:

  • nvme.device_media_errors_rate and nvme.device_error_log_entries_rate tell you whether the drive is reporting its own errors alongside the transport noise.
  • nvme.device_critical_warnings_state shows whether the controller itself considers its reliability degraded.
  • Block-layer and disk latency metrics let you quantify what the retransmissions are actually costing in I/O time, which is otherwise invisible.
  • Temperature and throughput charts help confirm or rule out the adjacent failure patterns (thermal throttling, link degradation) that share symptoms with AER storms.

One honest limitation: Netdata’s NVMe collector does not read the AER sysfs counters, and the fatal/nonfatal files require root plus host sysfs access, so they are not visible in containers either. If you want AER rates in your dashboards alongside the NVMe signals, collect the TOTAL_ERR_* values with a small custom collector or node-exporter-style textfile job and graph the deltas.