The only agent that thinks for itself

Autonomous Monitoring with self-learning AI built-in, operating independently across your entire stack.

Unlimited Metrics & Logs
Machine learning & MCP
5% CPU, 150MB RAM
3GB disk, >1 year retention
800+ integrations, zero config
Dashboards, alerts out of the box
> Discover Netdata Agents

Centralized metrics streaming and storage

Aggregate metrics from multiple agents into centralized Parent nodes for unified monitoring across your infrastructure.

Stream from unlimited agents
Long-term data retention
High availability clustering
Data replication & backup
Scalable architecture
Enterprise-grade security
> Learn about Parents

Fully managed cloud platform

Access your monitoring data from anywhere with our SaaS platform. No infrastructure to manage, automatic updates, and global availability.

Zero infrastructure management
99.9% uptime SLA
Global data centers
Automatic updates & patches
Enterprise SSO & RBAC
SOC2 & ISO certified
> Explore Netdata Cloud

Deploy Netdata Cloud in your infrastructure

Run the full Netdata Cloud platform on-premises for complete data sovereignty and compliance with your security policies.

Complete data sovereignty
Air-gapped deployment
Custom compliance controls
Private network integration
Dedicated support team
Kubernetes & Docker support
> Learn about Cloud On-Premises

Powerful, intuitive monitoring interface

Modern, responsive UI built for real-time troubleshooting with customizable dashboards and advanced visualization capabilities.

Real-time chart updates
Customizable dashboards
Dark & light themes
Advanced filtering & search
Responsive on all devices
Collaboration features
> Explore Netdata UI

Monitor on the go

Native iOS and Android apps bring full monitoring capabilities to your mobile device with real-time alerts and notifications.

iOS & Android apps
Push notifications
Touch-optimized interface
Offline data access
Biometric authentication
Widget support
> Download apps

The future of infrastructure observability

See our strategic direction across AI-native observability, full-stack signals, operational intelligence, and enterprise platform maturity.

AI-native observability
Full-stack signal coverage
Operational intelligence
Enterprise platform maturity
Agent releases every 6 weeks
Cloud continuous delivery
> Explore Product Roadmap

Best energy efficiency

True real-time per-second

100% automated zero config

Centralized observability

Multi-year retention

High availability built-in

Zero maintenance

Always up-to-date

Enterprise security

Complete data control

Air-gap ready

Compliance certified

Millisecond responsiveness

Infinite zoom & pan

Works on any device

Native performance

Instant alerts

Monitor anywhere

AI-native observability

Continuous delivery

Open source foundation

80% Faster Incident Resolution

AI-powered troubleshooting from detection, to root cause and blast radius identification, to reporting.

True Real-Time and Simple, even at Scale

Linearly and infinitely scalable full-stack observability, that can be deployed even mid-crisis.

90% Cost Reduction, Full Fidelity

Instead of centralizing the data, Netdata distributes the code, eliminating pipelines and complexity.

See and Map Your Entire Network

Live topology, flow analytics, and SNMP device and trap monitoring — unified with your full-stack observability.

Control Without Surrender

SOC 2 Type 2 certified with every metric kept on your infrastructure.

Integrations

800+ collectors and notification channels, auto-discovered and ready out of the box.

800+ data collectors
Auto-discovery & zero config
Cloud, infra, app protocols
Notifications out of the box
> Explore integrations
Real Results
46% Cost Reduction

Reduced monitoring costs by 46% while cutting staff overhead by 67%.

— Leonardo Antunez, Codyas

Zero Pipeline

No data shipping. No central storage costs. Query at the edge.

From Our Users
"Out-of-the-Box"

So many out-of-the-box features! I mostly don't have to develop anything.

— Simon Beginn, LANCOM Systems

No Query Language

Point-and-click troubleshooting. No PromQL, no LogQL, no learning curve.

Enterprise Ready
67% Less Staff, 46% Cost Cut

Enterprise efficiency without enterprise complexity—real ROI from day one.

— Leonardo Antunez, Codyas

SOC 2 Type 2 Certified

Zero data egress. Only metadata reaches the cloud. Your metrics stay on your infrastructure.

Full Coverage
800+ Collectors

Auto-discovered and configured. No manual setup required.

Any Notification Channel

Slack, PagerDuty, Teams, email, webhooks—all built-in.

Built for the People Who Get Paged

Because 3am alerts deserve instant answers, not hour-long hunts.

Every Industry Has Rules. We Master Them.

See how healthcare, finance, and government teams cut monitoring costs 90% while staying audit-ready.

Monitor Any Technology. Configure Nothing.

Install the agent. It already knows your stack.
From Our Users
"A Rare Unicorn"

Netdata gives more than you invest in it. A rare unicorn that obeys the Pareto rule.

— Eduard Porquet Mateu, TMB Barcelona

99% Downtime Reduction

Reduced website downtime by 99% and cloud bill by 30% using Netdata alerts.

— Falkland Islands Government

Real Savings
30% Cloud Cost Reduction

Optimized resource allocation based on Netdata alerts cut cloud spending by 30%.

— Falkland Islands Government

46% Cost Cut

Reduced monitoring staff by 67% while cutting operational costs by 46%.

— Codyas

Real Coverage
"Plugin for Everything"

Netdata has agent capacity or a plugin for everything, including Windows and Kubernetes.

— Eduard Porquet Mateu, TMB Barcelona

"Out-of-the-Box"

So many out-of-the-box features! I mostly don't have to develop anything.

— Simon Beginn, LANCOM Systems

Real Speed
Troubleshooting in 30 Seconds

From 2-3 minutes to 30 seconds—instant visibility into any node issue.

— Matthew Artist, Nodecraft

20% Downtime Reduction

20% less downtime and 40% budget optimization from out-of-the-box monitoring.

— Simon Beginn, LANCOM Systems

Pay per Node. Unlimited Everything Else.

One price per node. Unlimited metrics, logs, users, and retention. No per-GB surprises.

Free tier—forever
No metric limits or caps
Retention you control
Cancel anytime
> See pricing plans

What's Your Monitoring Really Costing You?

Most teams overpay by 40-60%. Let's find out why.

Expose hidden metric charges
Calculate tool consolidation
Customers report 30-67% savings
Results in under 60 seconds
> See what you're really paying

Your Infrastructure Is Unique. Let's Talk.

Because monitoring 10 nodes is different from monitoring 10,000.

On-prem & air-gapped deployment
Volume pricing & agreements
Architecture review for your scale
Compliance & security support
> Start a conversation

Monitoring That Sells Itself

Deploy in minutes. Impress clients in hours. Earn recurring revenue for years.

30-second live demos close deals
Zero config = zero support burden
Competitive margins & deal protection
Response in 48 hours
> Apply to partner

Per-Second Metrics at Homelab Prices

Same engine, same dashboards, same ML. Just priced for tinkerers.

Community: Free forever · 5 nodes · non-commercial
Homelab: $90/yr · unlimited nodes · fair usage
> Get the Homelab Plan

$1,000 Per Referral. Unlimited Referrals.

Your colleagues get 10% off. You get 10% commission. Everyone wins.

10% of subscriptions, up to $1,000 each
Track earnings inside Netdata Cloud
PayPal/Venmo payouts in 3-4 weeks
No caps, no complexity
> Get your referral link
Cost Proof
40% Budget Optimization

"Netdata's significant positive impact" — LANCOM Systems

Calculate Your Savings

Compare vs Datadog, Grafana, Dynatrace

Savings Proof
46% Cost Reduction

"Cut costs by 46%, staff by 67%" — Codyas

30% Cloud Bill Savings

"Reduced cloud bill by 30%" — Falkland Islands Gov

Enterprise Proof
"Better Than Combined Alternatives"

"Better observability with Netdata than combining other tools." — TMB Barcelona

Real Engineers, <24h Response

DPA, SLAs, on-prem, volume pricing

Why Partners Win
Demo Live Infrastructure

One command, 30 seconds, real data—no sandbox needed

Zero Tickets, High Margins

Auto-config + per-node pricing = predictable profit

Homelab Ready
Free Video Course

8-episode Netdata tutorial by LearnLinux.tv

76k+ GitHub Stars

3rd most starred monitoring project

Worth Recommending
Product That Delivers

Customers report 40-67% cost cuts, 99% downtime reduction

Zero Risk to Your Rep

Free tier lets them try before they buy

AI Support Assistant, Available 24/7

Nedi has access to all official documentation, source code, and resources. Ask any question about Netdata—responds in your language.

Deployment & configuration
Troubleshooting & sizing
Alerts & notifications
Evidence-based answers
> Ask Nedi now

Never Fight Fires Alone

Docs, community, and expert help—pick your path to resolution.

Learn.netdata.cloud docs
Discord, Forums, GitHub
Premium support available
> Get answers now

60 Seconds to First Dashboard

One command to install. Zero config. 850+ integrations documented.

Linux, Windows, K8s, Docker
Auto-discovers your stack
> Read our documentation

76,000+ Engineers Strong

615+ contributors. 1.5M daily downloads. One mission: simplify observability.

Per-Second. 90% Cheaper. Data Stays Home.

Side-by-side comparisons: costs, real-time granularity, and data sovereignty for every major tool.

See why teams switch from Datadog, Prometheus, Grafana, and more.

> Browse all comparisons
Edge-Native Observability, Born Open Source
Per-second visibility, ML on every metric, and data that never leaves your infrastructure.
Founded in 2016
615+ contributors worldwide
Remote-first, engineering-driven
Open source first
> Read our story
Promises We Publish—and Prove
12 principles backed by open code, independent validation, and measurable outcomes.
Open source, peer-reviewed
Zero config, instant value
Data sovereignty by design
Aligned pricing, no surprises
> See all 12 principles
Edge-Native, AI-Ready, 100% Open
76k+ stars. Full ML, AI, and automation—GPLv3+, not premium add-ons.
76,000+ GitHub stars
GPLv3+ licensed forever
ML on every metric, included
Zero vendor lock-in
> Explore our open source
Build Real-Time Observability for the World
Remote-first team shipping per-second monitoring with ML on every metric.
Remote-first, fully distributed
Open source (76k+ stars)
Challenging technical problems
Your code on millions of systems
> See open roles
Meet the Team Behind Netdata
Conferences, meetups, and tradeshows where you can see Netdata in action and talk to the engineers who build it.
Live demos and deep dives
Book 1-on-1 meetings
Talks and panel sessions
Event recaps and photos
> See all events
Talk to a Netdata Human in <24 Hours
Sales, partnerships, press, or professional services—real engineers, fast answers.
Discuss your observability needs
Pricing and volume discounts
Partnership opportunities
Media and press inquiries
> Book a conversation
Your Data. Your Rules.
On-prem data, cloud control plane, transparent terms.
Trust & Scale
76,000+ GitHub Stars

One of the most popular open-source monitoring projects

SOC 2 Type 2 Certified

Enterprise-grade security and compliance

Data Sovereignty

Your metrics stay on your infrastructure

Validated
University of Amsterdam

"Most energy-efficient monitoring solution" — ICSOC 2023, peer-reviewed

ADASTEC (Autonomous Driving)

"Doesn't miss alerts—mission-critical trust for safety software"

Community Stats
615+ Contributors

Global community improving monitoring for everyone

1.5M+ Downloads/Day

Trusted by teams worldwide

GPLv3+ Licensed

Free forever, fully open source agent

Why Join?
Remote-First

Work from anywhere, async-friendly culture

Impact at Scale

Your work helps millions of systems

$ guides / nvme / nvme-throughput-collapse ▌

Operations Guides

NVMe throughput collapse: busy controller, low IOPS, and internal contention

The drive is flat out. Whatever metric you look at says the controller is working constantly. And yet the application is starving: IOPS are a fraction of what the drive is rated for, write throughput has fallen off a cliff, and latency is climbing. Nothing in the kernel log looks broken. No media errors. No resets. The drive is busy, and it is delivering almost nothing.

The standard instinct (“the disk is saturated”) is both right and wrong here. The controller is saturated. The host-visible I/O path is not. The drive is burning its internal capacity on work you cannot see: garbage collection, FTL remapping, wear leveling, or simply running its clocks slower because it is too hot.

The diagnostic pivot is a single comparison: controller busy time against host-delivered IOPS. A drive that is 100% busy and delivering its rated IOPS is healthy and saturated. A drive that is 100% busy and delivering far less has an internal problem. This guide is about telling those two apart and finding which internal problem you have.

What this means

Every NVMe controller is a small embedded computer running a flash translation layer (FTL). The FTL maps logical block addresses to physical NAND pages, and it does housekeeping the host never sees: garbage collection (NAND must erase whole blocks before rewriting, so valid pages get moved out of partially used blocks), wear leveling, and read-disturb relocation. That housekeeping consumes the same controller resources as host I/O.

The SMART log exposes exactly one window into this: controller_busy_time, a cumulative counter in minutes. The controller counts itself as busy whenever it has at least one outstanding command. Sampled over time, the delta tells you the fraction of wall time the controller considered itself occupied.

The failure mode this article covers has a precise signature:

  • Busy time ratio near 100%: controller_busy_time advances roughly one minute per real minute.
  • Host throughput far below expectation: IOPS and bandwidth from block-layer counters are well under the drive’s capability for the workload.
  • No error signals: media_errors steady, no critical warnings, no resets in dmesg.

That combination means the controller’s effort is not reaching the host. The usual suspects, in rough order of frequency: a write amplification or garbage collection storm (especially on a nearly full drive), SLC cache exhaustion on consumer-class drives, or silent thermal throttling. A degraded PCIe link is a fourth possibility that produces a similar “healthy but slow” profile without the busy-time signature.

flowchart TD
  A[Busy time ratio near 100 percent] --> B{Host IOPS at expected level?}
  B -->|yes| C[Healthy saturation: capacity limit]
  B -->|no| D{Composite temp near or above WCTEMP?}
  D -->|yes| E[Thermal throttling]
  D -->|no| F{Drive more than 80 percent full?}
  F -->|yes| G[GC storm / write amplification]
  F -->|no| H{Sustained sequential writes?}
  H -->|yes| I[SLC cache exhaustion]
  H -->|no| J[Check PCIe link and error log]

Common causes

CauseWhat it looks likeFirst thing to check
GC storm / write amplification (drive nearly full)Write throughput down 50-90%, latency spikes, temperature normal, media errors steadyDrive fill level; whether TRIM/discard is enabled
SLC cache exhaustionStep-function drop in sustained write throughput, no errors, recovers after idleWhether the workload is sustained large sequential writes on a consumer drive
Thermal throttlingGradual throughput decline, rising composite temperature, TMT transition counters increasingComposite temperature vs WCTEMP from nvme id-ctrl
Worn drive, FTL overhead risingLatency creeping up over weeks, high percentage_used, spare decliningpercentage_used and available_spare trends
PCIe link degradedThroughput capped below spec, latency normal at light load, no busy-time anomalycurrent_link_speed and current_link_width vs max

Quick checks

All of these are read-only and safe to run during an incident.

# Host-side IOPS, bandwidth, and per-request latency (two 1-second samples)
iostat -xp nvme0n1 1 2

# Controller busy time: sample twice, 5 minutes apart
nvme smart-log /dev/nvme0 | grep controller_busy_time
sleep 300
nvme smart-log /dev/nvme0 | grep controller_busy_time

# Temperature and thermal management counters
nvme smart-log /dev/nvme0 | grep -i "temperature\|Thermal Management"

# Vendor thermal thresholds (not in the SMART log)
nvme id-ctrl /dev/nvme0 | grep -i temp

# Wear and error state
nvme smart-log /dev/nvme0 | grep -i "percentage_used\|available_spare\|media_errors\|num_err_log_entries"

# PCIe link: current vs maximum negotiated
cat /sys/class/nvme/nvme0/device/current_link_speed
cat /sys/class/nvme/nvme0/device/max_link_speed
cat /sys/class/nvme/nvme0/device/current_link_width
cat /sys/class/nvme/nvme0/device/max_link_width

# Filesystem fill level and discard configuration
df -h
findmnt -o TARGET,SOURCE,FSTYPE,OPTIONS | grep nvme
cat /sys/block/nvme0n1/queue/scheduler

# Rule out a controller hang masquerading as slowness
dmesg | grep -i nvme | grep -iE "timeout|reset" | tail -20

Two reading notes on the output:

Do not trust iostat %util on NVMe. The kernel computes %util as “any I/O in flight at any moment,” a metric designed for single-queue spinning disks. A device that processes thousands of requests in parallel across hardware queues can sit at 100% %util while operating at a fraction of its real capacity. On NVMe, read r_await, w_await, and aqu-sz instead: if read latency stays around or under 1 ms and the average queue is comfortably below what the device can handle, the drive is not host-side saturated regardless of what %util says. The svctm column is deprecated in current sysstat versions; ignore it.

controller_busy_time has minute resolution. It cannot see sub-minute stalls. What it can see is exactly the condition this article is about: a controller that spends effectively all of its time occupied while the host gets little out of it.

How to diagnose it

  1. Establish the busy ratio. Take two controller_busy_time samples a few minutes apart. If the delta roughly equals the wall-clock interval, the controller was busy 100% of the time. A busy ratio above 90% during a period of low host IOPS means the drive is sick, not loaded. You can also compute the lifetime ratio controller_busy_time / (power_on_hours * 60), but the sampled delta is what reflects the current incident.

  2. Quantify what the host is actually getting. From the same window, compute IOPS and bandwidth from /sys/block/nvme0n1/stat deltas (or iostat -x). Compare against the drive’s datasheet rating for your I/O pattern, and against your own baseline. A drive rated for hundreds of thousands of random read IOPS that is delivering a few thousand while fully busy has internal contention.

  3. Check temperature against vendor thresholds. Get composite temperature from the SMART log and WCTEMP/CCTEMP from nvme id-ctrl (they are in Identify Controller data, not the SMART log, so many monitoring tools never show them). If temperature is at or above WCTEMP, check thm_temp1_trans_count, thm_temp2_trans_count, and warning_temp_time: increasing values confirm the drive has been entering thermal management states. Thermal throttling is gradual and produces no errors, which is why it is so often misdiagnosed as an application problem.

  4. If temperature is normal, check space pressure. GC competes directly with host I/O when free blocks run low. Check filesystem fill level and, critically, whether the filesystem is telling the drive about deleted blocks: no discard mount option and no fstrim schedule means the FTL treats the drive as fuller than it logically is, and GC pressure becomes chronic. Drives above roughly 80-90% fill enter the zone where this dominates. The classic pattern: throughput down 50-90%, latency spikes, controller_busy_time pinned, temperature normal, media_errors flat.

  5. Match the write pattern to SLC cache behavior. If the collapse happens specifically during sustained sequential writes and the throughput drop is a step function rather than a slope, you are watching SLC cache exhaustion. This is by design, not a fault: the drive absorbs bursts in fast pseudo-SLC and destages to TLC/QLC during idle. The cliff arrives sooner as the drive fills, because the dynamic cache shrinks. Recovery after a few idle minutes confirms it.

  6. Check wear state. A heavily worn drive spends more controller effort on error recovery and remapping. If percentage_used is high and available_spare is trending down, internal overhead rising with age is a plausible contributor, and the drive belongs on a replacement plan regardless of what else you find.

  7. Eliminate lookalikes. A degraded PCIe link (current_link_speed or current_link_width below max) caps bandwidth with zero errors, but does not produce the busy-time anomaly. Repeated controller resets in dmesg are a different failure (a firmware hang, not contention); see the reset guide linked below. Also confirm the I/O scheduler is none: running mq-deadline or bfq on NVMe adds host-side queuing that muddies the picture.

One thing you cannot get from standard SMART: true write amplification factor. data_units_written counts host-visible writes only, not NAND writes. Real WAF requires vendor-specific telemetry (vendor log pages, exposed on some drives through nvme smart-log-add, with vendor-specific units), and not all drives expose it. Do not try to derive WAF from standard SMART counters; you will underestimate NAND wear.

Metrics and signals to monitor

SignalWhy it mattersWarning sign
Busy time ratio (delta controller_busy_time / interval)The core signal: controller effort vs host outputAbove ~90% with low host IOPS
IOPS and bandwidth (block stat deltas)Ground truth for what the host receivesSustained drop below 50% of baseline without workload change
Read/write latency (r_await, w_await)The metric to trust instead of %utilSustained rise, or p99 above a few ms
Composite temperature vs WCTEMPConfirms or eliminates thermal throttlingApproaching WCTEMP under load
TMT transition counts and total timeProof the drive has been throttling, even if you missed the live eventIncreasing counts
warning_temp_time / critical_comp_timeCumulative minutes above thermal thresholdsAny sustained rate of increase
Filesystem fill levelDrives GC pressureAbove 80%
percentage_used, available_spare trendWear-driven internal overheadHigh value or accelerating decline
PCIe current vs max linkSilent bandwidth capCurrent below max

Fixes

GC storm and space pressure

  • Run fstrim on the mounted filesystems for immediate relief, then make sure deletion information reaches the drive continuously: a discard mount option or a scheduled fstrim job. Without this, the problem returns.
  • Reduce fill level below 80%. This is not wasted capacity; it is FTL working room. If the workload genuinely needs the capacity, the drive is undersized.
  • Increasing overprovisioning (leaving unpartitioned space) enlarges the pool the FTL has for GC and wear leveling, and improves write consistency.

SLC cache exhaustion

  • This is hardware behavior, not a defect. The question is whether your workload requires sustained write throughput above native TLC/QLC speed.
  • If it does, options are workload-side (smooth the write burst), provisioning-side (more free space grows the dynamic cache), or hardware-side (an enterprise drive with sustained-write ratings instead of a consumer drive relying on burst cache).

Thermal throttling

  • Reduce write load to let the drive cool, then fix the thermal path: airflow, heatsink contact, adjacent heat sources like GPUs. M.2 drives with no heatsink throttle aggressively under sustained load.
  • Watch for hysteresis: controllers often do not leave the throttled state until temperature drops well below the threshold, so throughput may stay depressed for a while after load is removed.

Worn drive

  • No fix restores FTL headroom on a worn-out drive. Verify replication or backups, and schedule replacement. The endurance and spare guides below cover runway estimation.
  • Reseat the drive and power cycle to force renegotiation. If it persists, try another slot to isolate drive from slot. Check AER counters for a noisy physical layer.

Prevention

  • Alert on the divergence, not the components. The actionable condition is busy ratio high AND host IOPS low. Either half alone is ambiguous.
  • Baseline per drive model. “Low IOPS” is meaningless without the drive’s rated numbers for your I/O pattern and your own historical baseline at similar queue depths.
  • Keep drives under 80% full and TRIM working. This removes the most common cause entirely.
  • Track thermal history, not just live temperature. warning_temp_time and TMT counters reveal throttling that happened between your samples.
  • Match drive class to workload. Consumer drives without power-loss protection, with small overprovisioning and aggressive cache cliffs, need different expectations and thresholds than enterprise drives.

How Netdata helps

  • Netdata’s NVMe collector gathers controller_busy_time from the SMART log, the field at the center of this diagnosis. Note that it is collected but currently has no dedicated chart, so for the busy-ratio calculation use nvme smart-log samples as shown above.
  • The nvme.device_composite_temperature chart plus thermal management transition and time charts (nvme.device_thermal_mgmt_temp*_transitions_rate, nvme.device_thermal_mgmt_temp*_time) let you confirm or eliminate throttling without being on the box during the event.
  • Per-bit critical warning charts (nvme.device_critical_warnings_state) catch the thermal threshold bit and reliability degradation bit that sometimes accompany a collapse.
  • nvme.device_estimated_endurance_perc and nvme.device_available_spare_perc trends tell you whether wear-driven FTL overhead is a contributing factor.
  • Netdata’s block-device IOPS, bandwidth, and latency charts give the host-side half of the correlation: overlaying delivered throughput against temperature and busy state is what separates “healthy saturation” from “sick drive” in minutes instead of hours.