The only agent that thinks for itself

Autonomous Monitoring with self-learning AI built-in, operating independently across your entire stack.

Unlimited Metrics & Logs
Machine learning & MCP
5% CPU, 150MB RAM
3GB disk, >1 year retention
800+ integrations, zero config
Dashboards, alerts out of the box
> Discover Netdata Agents

Centralized metrics streaming and storage

Aggregate metrics from multiple agents into centralized Parent nodes for unified monitoring across your infrastructure.

Stream from unlimited agents
Long-term data retention
High availability clustering
Data replication & backup
Scalable architecture
Enterprise-grade security
> Learn about Parents

Fully managed cloud platform

Access your monitoring data from anywhere with our SaaS platform. No infrastructure to manage, automatic updates, and global availability.

Zero infrastructure management
99.9% uptime SLA
Global data centers
Automatic updates & patches
Enterprise SSO & RBAC
SOC2 & ISO certified
> Explore Netdata Cloud

Deploy Netdata Cloud in your infrastructure

Run the full Netdata Cloud platform on-premises for complete data sovereignty and compliance with your security policies.

Complete data sovereignty
Air-gapped deployment
Custom compliance controls
Private network integration
Dedicated support team
Kubernetes & Docker support
> Learn about Cloud On-Premises

Powerful, intuitive monitoring interface

Modern, responsive UI built for real-time troubleshooting with customizable dashboards and advanced visualization capabilities.

Real-time chart updates
Customizable dashboards
Dark & light themes
Advanced filtering & search
Responsive on all devices
Collaboration features
> Explore Netdata UI

Monitor on the go

Native iOS and Android apps bring full monitoring capabilities to your mobile device with real-time alerts and notifications.

iOS & Android apps
Push notifications
Touch-optimized interface
Offline data access
Biometric authentication
Widget support
> Download apps

The future of infrastructure observability

See our strategic direction across AI-native observability, full-stack signals, operational intelligence, and enterprise platform maturity.

AI-native observability
Full-stack signal coverage
Operational intelligence
Enterprise platform maturity
Agent releases every 6 weeks
Cloud continuous delivery
> Explore Product Roadmap

Best energy efficiency

True real-time per-second

100% automated zero config

Centralized observability

Multi-year retention

High availability built-in

Zero maintenance

Always up-to-date

Enterprise security

Complete data control

Air-gap ready

Compliance certified

Millisecond responsiveness

Infinite zoom & pan

Works on any device

Native performance

Instant alerts

Monitor anywhere

AI-native observability

Continuous delivery

Open source foundation

80% Faster Incident Resolution

AI-powered troubleshooting from detection, to root cause and blast radius identification, to reporting.

True Real-Time and Simple, even at Scale

Linearly and infinitely scalable full-stack observability, that can be deployed even mid-crisis.

90% Cost Reduction, Full Fidelity

Instead of centralizing the data, Netdata distributes the code, eliminating pipelines and complexity.

See and Map Your Entire Network

Live topology, flow analytics, and SNMP device and trap monitoring — unified with your full-stack observability.

Control Without Surrender

SOC 2 Type 2 certified with every metric kept on your infrastructure.

Integrations

800+ collectors and notification channels, auto-discovered and ready out of the box.

800+ data collectors
Auto-discovery & zero config
Cloud, infra, app protocols
Notifications out of the box
> Explore integrations
Real Results
46% Cost Reduction

Reduced monitoring costs by 46% while cutting staff overhead by 67%.

— Leonardo Antunez, Codyas

Zero Pipeline

No data shipping. No central storage costs. Query at the edge.

From Our Users
"Out-of-the-Box"

So many out-of-the-box features! I mostly don't have to develop anything.

— Simon Beginn, LANCOM Systems

No Query Language

Point-and-click troubleshooting. No PromQL, no LogQL, no learning curve.

Enterprise Ready
67% Less Staff, 46% Cost Cut

Enterprise efficiency without enterprise complexity—real ROI from day one.

— Leonardo Antunez, Codyas

SOC 2 Type 2 Certified

Zero data egress. Only metadata reaches the cloud. Your metrics stay on your infrastructure.

Full Coverage
800+ Collectors

Auto-discovered and configured. No manual setup required.

Any Notification Channel

Slack, PagerDuty, Teams, email, webhooks—all built-in.

Built for the People Who Get Paged

Because 3am alerts deserve instant answers, not hour-long hunts.

Every Industry Has Rules. We Master Them.

See how healthcare, finance, and government teams cut monitoring costs 90% while staying audit-ready.

Monitor Any Technology. Configure Nothing.

Install the agent. It already knows your stack.
From Our Users
"A Rare Unicorn"

Netdata gives more than you invest in it. A rare unicorn that obeys the Pareto rule.

— Eduard Porquet Mateu, TMB Barcelona

99% Downtime Reduction

Reduced website downtime by 99% and cloud bill by 30% using Netdata alerts.

— Falkland Islands Government

Real Savings
30% Cloud Cost Reduction

Optimized resource allocation based on Netdata alerts cut cloud spending by 30%.

— Falkland Islands Government

46% Cost Cut

Reduced monitoring staff by 67% while cutting operational costs by 46%.

— Codyas

Real Coverage
"Plugin for Everything"

Netdata has agent capacity or a plugin for everything, including Windows and Kubernetes.

— Eduard Porquet Mateu, TMB Barcelona

"Out-of-the-Box"

So many out-of-the-box features! I mostly don't have to develop anything.

— Simon Beginn, LANCOM Systems

Real Speed
Troubleshooting in 30 Seconds

From 2-3 minutes to 30 seconds—instant visibility into any node issue.

— Matthew Artist, Nodecraft

20% Downtime Reduction

20% less downtime and 40% budget optimization from out-of-the-box monitoring.

— Simon Beginn, LANCOM Systems

Pay per Node. Unlimited Everything Else.

One price per node. Unlimited metrics, logs, users, and retention. No per-GB surprises.

Free tier—forever
No metric limits or caps
Retention you control
Cancel anytime
> See pricing plans

What's Your Monitoring Really Costing You?

Most teams overpay by 40-60%. Let's find out why.

Expose hidden metric charges
Calculate tool consolidation
Customers report 30-67% savings
Results in under 60 seconds
> See what you're really paying

Your Infrastructure Is Unique. Let's Talk.

Because monitoring 10 nodes is different from monitoring 10,000.

On-prem & air-gapped deployment
Volume pricing & agreements
Architecture review for your scale
Compliance & security support
> Start a conversation

Monitoring That Sells Itself

Deploy in minutes. Impress clients in hours. Earn recurring revenue for years.

30-second live demos close deals
Zero config = zero support burden
Competitive margins & deal protection
Response in 48 hours
> Apply to partner

Per-Second Metrics at Homelab Prices

Same engine, same dashboards, same ML. Just priced for tinkerers.

Community: Free forever · 5 nodes · non-commercial
Homelab: $90/yr · unlimited nodes · fair usage
> Get the Homelab Plan

$1,000 Per Referral. Unlimited Referrals.

Your colleagues get 10% off. You get 10% commission. Everyone wins.

10% of subscriptions, up to $1,000 each
Track earnings inside Netdata Cloud
PayPal/Venmo payouts in 3-4 weeks
No caps, no complexity
> Get your referral link
Cost Proof
40% Budget Optimization

"Netdata's significant positive impact" — LANCOM Systems

Calculate Your Savings

Compare vs Datadog, Grafana, Dynatrace

Savings Proof
46% Cost Reduction

"Cut costs by 46%, staff by 67%" — Codyas

30% Cloud Bill Savings

"Reduced cloud bill by 30%" — Falkland Islands Gov

Enterprise Proof
"Better Than Combined Alternatives"

"Better observability with Netdata than combining other tools." — TMB Barcelona

Real Engineers, <24h Response

DPA, SLAs, on-prem, volume pricing

Why Partners Win
Demo Live Infrastructure

One command, 30 seconds, real data—no sandbox needed

Zero Tickets, High Margins

Auto-config + per-node pricing = predictable profit

Homelab Ready
Free Video Course

8-episode Netdata tutorial by LearnLinux.tv

76k+ GitHub Stars

3rd most starred monitoring project

Worth Recommending
Product That Delivers

Customers report 40-67% cost cuts, 99% downtime reduction

Zero Risk to Your Rep

Free tier lets them try before they buy

AI Support Assistant, Available 24/7

Nedi has access to all official documentation, source code, and resources. Ask any question about Netdata—responds in your language.

Deployment & configuration
Troubleshooting & sizing
Alerts & notifications
Evidence-based answers
> Ask Nedi now

Never Fight Fires Alone

Docs, community, and expert help—pick your path to resolution.

Learn.netdata.cloud docs
Discord, Forums, GitHub
Premium support available
> Get answers now

60 Seconds to First Dashboard

One command to install. Zero config. 850+ integrations documented.

Linux, Windows, K8s, Docker
Auto-discovers your stack
> Read our documentation

76,000+ Engineers Strong

615+ contributors. 1.5M daily downloads. One mission: simplify observability.

Per-Second. 90% Cheaper. Data Stays Home.

Side-by-side comparisons: costs, real-time granularity, and data sovereignty for every major tool.

See why teams switch from Datadog, Prometheus, Grafana, and more.

> Browse all comparisons
Edge-Native Observability, Born Open Source
Per-second visibility, ML on every metric, and data that never leaves your infrastructure.
Founded in 2016
615+ contributors worldwide
Remote-first, engineering-driven
Open source first
> Read our story
Promises We Publish—and Prove
12 principles backed by open code, independent validation, and measurable outcomes.
Open source, peer-reviewed
Zero config, instant value
Data sovereignty by design
Aligned pricing, no surprises
> See all 12 principles
Edge-Native, AI-Ready, 100% Open
76k+ stars. Full ML, AI, and automation—GPLv3+, not premium add-ons.
76,000+ GitHub stars
GPLv3+ licensed forever
ML on every metric, included
Zero vendor lock-in
> Explore our open source
Build Real-Time Observability for the World
Remote-first team shipping per-second monitoring with ML on every metric.
Remote-first, fully distributed
Open source (76k+ stars)
Challenging technical problems
Your code on millions of systems
> See open roles
Meet the Team Behind Netdata
Conferences, meetups, and tradeshows where you can see Netdata in action and talk to the engineers who build it.
Live demos and deep dives
Book 1-on-1 meetings
Talks and panel sessions
Event recaps and photos
> See all events
Talk to a Netdata Human in <24 Hours
Sales, partnerships, press, or professional services—real engineers, fast answers.
Discuss your observability needs
Pricing and volume discounts
Partnership opportunities
Media and press inquiries
> Book a conversation
Your Data. Your Rules.
On-prem data, cloud control plane, transparent terms.
Trust & Scale
76,000+ GitHub Stars

One of the most popular open-source monitoring projects

SOC 2 Type 2 Certified

Enterprise-grade security and compliance

Data Sovereignty

Your metrics stay on your infrastructure

Validated
University of Amsterdam

"Most energy-efficient monitoring solution" — ICSOC 2023, peer-reviewed

ADASTEC (Autonomous Driving)

"Doesn't miss alerts—mission-critical trust for safety software"

Community Stats
615+ Contributors

Global community improving monitoring for everyone

1.5M+ Downloads/Day

Trusted by teams worldwide

GPLv3+ Licensed

Free forever, fully open source agent

Why Join?
Remote-First

Work from anywhere, async-friendly culture

Impact at Scale

Your work helps millions of systems

$ guides / php-fpm / php-fpm-dynamic-mode-scaling-lag ▌

Operations Guides

PHP-FPM dynamic mode scaling lag: why the pool cannot keep up with bursts

During a traffic burst, your PHP-FPM pool reports total processes well below pm.max_children, yet the listen queue fills and latency spikes. The status page shows idle workers hitting zero, then climbing back a few seconds later as new workers come online. By then, requests have already queued and some users have already seen 502s or 504s.

This is dynamic mode scaling lag. The dynamic process manager is reactive, not predictive. It checks idle-worker counts once per second on a fixed internal timer and forks replacement workers after the deficit is already visible. When a burst arrives faster than the check-and-fork cycle can respond, the idle pool drains to zero and the listen backlog absorbs the overflow until new workers are ready.

The enabling condition is almost always pm.min_spare_servers set too low for the burst pattern. With min_spare at 1 or 2, a burst of 20 concurrent requests consumes the entire idle buffer before the master process has completed a single check cycle.

What this means

In dynamic mode (pm = dynamic), the master maintains workers between pm.min_spare_servers and pm.max_children. When idle count drops below min_spare_servers, it forks new workers. When idle exceeds max_spare_servers, it kills excess workers.

The critical limitation: this check runs on a fixed one-second internal timer, not on every incoming request. The master’s event loop processes signals and reaps children between checks, but the spare-server evaluation is not triggered by connection arrival. A burst of 50 requests in 100 milliseconds hits the pool before the next check cycle fires.

On PHP 8.1+, the master can fork up to pm.max_spawn_rate workers (default 32) per check cycle when it detects an idle deficit. If the deficit exceeds that cap, the master needs multiple check cycles to catch up. During those cycles, new requests queue in the socket backlog. On PHP versions before 8.1, pm.max_spawn_rate does not exist.

The interval is separate from systemd_interval, and current upstream PHP-FPM does not expose it as a pool directive.

During the gap between demand arrival and capacity readiness, the listen queue fills. If it reaches listen.backlog, the kernel drops connections and the web server returns 502.

flowchart TD
    A["Traffic burst arrives"] --> B["Idle workers drain to zero"]
    B --> C["One-second maintenance timer not yet fired"]
    C --> D["New requests enter socket backlog"]
    D --> E["Maintenance timer fires: master forks workers"]
    E --> F{"Deficit covered in one cycle?"}
    F -->|"No"| G["More cycles needed, queue grows"]
    F -->|"Yes"| H["Workers accept queued requests"]
    G --> H
    H --> I["Queue drains, latency normalizes"]
    D --> J{"Queue reaches listen.backlog?"}
    J -->|"Yes"| K["Kernel drops connections, 502s"]
    J -->|"No"| I

Common causes

CauseWhat it looks likeFirst thing to check
pm.min_spare_servers too lowIdle hits 0 during bursts, listen queue spikes, total processes well below max_childrenPool config: grep min_spare in pool .conf
pm.start_servers too lowCold pool after restart or reload takes too long to reach operating capacityCompare start_servers to typical peak active count
pm.max_spawn_rate too low (PHP 8.1+)Master forks workers but queue keeps growing for multiple check cyclesPHP version and pm.max_spawn_rate setting
Burst pattern exceeds fork rate“seems busy” warnings in error log, idle oscillates between 0 and min_spareError log for “seems busy” entries
listen.backlog too smallQueue fills quickly, 502s appear before workers are exhaustedStatus page: listen queue len vs max listen queue

Quick checks

# Check current pool state (idle, active, total, queue).
# Adjust URL to match your pm.status_path and web server config.
curl -s http://127.0.0.1/fpm-status?json | python3 -c "
import sys,json
d=json.load(sys.stdin)
for k in ['active processes','idle processes','total processes','listen queue','max listen queue','listen queue len','max children reached']:
    print(f'{k}: {d[k]}')"

# Check kernel-level socket backlog (Unix socket)
ss -xlnp | grep php

# Check kernel-level socket backlog (TCP)
ss -tlnp | grep 9000

# Check pm settings in pool config (path varies by distribution)
grep -E "^pm\.|^pm =|^listen\.backlog" /etc/php/*/fpm/pool.d/*.conf

# Check PHP version (determines pm.max_spawn_rate availability)
php-fpm -v 2>/dev/null | head -1 || php -v | head -1

# Look for "seems busy" warnings in the error log (path varies by distribution)
grep "seems busy" /var/log/php-fpm/error.log 2>/dev/null | tail -20
# or via journalctl (unit name varies: php-fpm, php8.1-fpm, etc.)
journalctl -u php-fpm --since "1 hour ago" | grep "seems busy" | tail -20

# Check if max_children was reached (counter since last restart)
curl -s http://127.0.0.1/fpm-status | grep "max children reached"

# Watch idle vs listen queue in real time (1-second poll)
watch -n 1 'curl -s http://127.0.0.1/fpm-status | grep -E "idle processes|listen queue|active processes"'

# Check kernel listen overflow counters
nstat | grep -i listen

How to diagnose it

  1. Confirm the pool is not at max_children. If active processes equals pm.max_children and the listen queue is growing, you have worker exhaustion, not scaling lag. The max children reached counter will be incrementing. See the related guide on active processes near max_children.

  2. Check whether idle processes hit zero during the burst. Poll the status page at 1-second intervals during a burst. If idle drops to 0 while total processes is still below max_children, the process manager has not yet forked enough workers. This is the signature of scaling lag.

  3. Compare the timing of idle depletion and listen queue growth. If the listen queue starts growing at the same moment idle hits zero, the pool had no buffer. If the queue grows a few seconds after idle hits zero, the master’s check cycle has not fired yet. Both point to min_spare_servers being too low, but the delay tells you whether the timer or the fork rate is the bottleneck.

  4. Check the error log for “seems busy” warnings. The master emits this warning when the idle count is below pm.min_spare_servers and it must spawn children. Frequent warnings during normal traffic confirm the pool is repeatedly caught without spare capacity.

  5. Verify the PHP version and pm.max_spawn_rate. On PHP 8.1+, pm.max_spawn_rate (default 32) caps how many workers the master can fork per check cycle. If your burst requires 100 new workers and max_spawn_rate is 32, the master needs at least 4 cycles to catch up. On PHP versions before 8.1, pm.max_spawn_rate does not exist.

  6. Rule out slow requests. If workers are stuck on a slow backend (database, external API), they are not returning to idle, which looks like scaling lag but is actually a slow-dependency drain. Check the slow log and per-worker request durations. See the related guide on 504 gateway timeout.

  7. Check kernel listen overflow counters. If ListenOverflows or ListenDrops are incrementing, the backlog has filled and the kernel is dropping connections. This is the end state of scaling lag left unaddressed.

Metrics and signals to monitor

SignalWhy it mattersWarning sign
Idle processesThe buffer that absorbs bursts before the master reactsDrops to 0 while total < max_children
Listen queueRequests waiting for a worker; earliest user-facing degradation signalNon-zero and growing while idle is 0
Max listen queueHigh water mark since restart; shows past saturation even if current queue is 0Approaching listen queue len
Total processesWhether the master is actually scaling the poolStuck at or near min_spare + active, not climbing toward max_children
Max children reachedCounter of times the master wanted to fork but hit the ceilingIncrementing (rules out max_children as the bottleneck if zero)
“seems busy” log entriesMaster warning that idle workers are below pm.min_spare_serversAny occurrence during normal traffic
Kernel ListenOverflowsConnections dropped at the kernel level when backlog is fullCounter incrementing

Fixes

Warning: All config changes require a graceful reload (SIGUSR2). The reload drains existing workers before the master re-execs, creating a brief window where no workers accept new connections. Plan config changes during low-traffic periods.

Raise pm.min_spare_servers

The primary fix. Set min_spare_servers high enough to absorb your typical burst before the master’s check cycle fires. If your burst pattern is 20 concurrent requests arriving within 200ms, min_spare should be at least 20, plus headroom.

The tradeoff: each idle worker consumes memory (typically 30-200MB RSS depending on the application). More spare workers means more memory reserved at all times, even during low traffic. Verify that min_spare_servers times average worker RSS fits within your memory budget. Use PSS (Proportional Set Size) from /proc/<pid>/smaps_rollup for accurate per-worker memory accounting, since RSS overestimates by counting shared opcache pages in each worker.

Raise pm.max_spare_servers

If you raise min_spare, also raise max_spare. The master kills idle workers above max_spare during low-traffic periods, so if max_spare is close to min_spare, the pool will oscillate: fork workers during a burst, then immediately kill them when traffic subsides, then fork again at the next burst. Set max_spare comfortably above min_spare. PHP requires max_spare to be greater than or equal to min_spare.

Raise pm.start_servers

start_servers controls how many workers exist immediately after a restart or reload. If start_servers is low, the pool starts with a deficit and must scale up under live traffic. The default formula is (min_spare_servers + max_spare_servers) / 2. If you raise min and max spare, start_servers should follow.

Raise pm.max_spawn_rate (PHP 8.1+)

If the master is forking workers but the queue keeps growing for multiple check cycles, the per-cycle fork cap may be the bottleneck. Raising pm.max_spawn_rate above the default 32 allows the master to fork more workers per check cycle, reducing the number of cycles needed to cover a large deficit.

The tradeoff: forking many workers simultaneously spikes CPU (page table copying, PHP runtime initialization) and memory. On memory-constrained hosts, a high spawn rate can trigger cgroup OOM kills in containers. See the related guide on cgroup OOM in containers.

Switch to static mode

If bursts are frequent and predictable, and memory is sufficient, pm = static eliminates scaling lag entirely. All workers are pre-forked at startup and always running. There is no timer check, no fork delay, no reaction gap. The cost is constant memory usage at peak levels even during idle periods.

Static mode is the right choice when traffic is bursty, memory headroom exists, and the application’s per-worker RSS is stable. If per-worker RSS grows over time, static mode still works but requires pm.max_requests for recycling, which reintroduces brief spawn delays during worker replacement.

Do not just raise listen.backlog

A larger listen.backlog gives the kernel more queue space, which buys time during the reaction delay. But it does not make workers appear faster. If the burst is sustained, a bigger backlog delays the 502s by a few seconds but does not fix the underlying spawn lag. Use this only as a stopgap while tuning spare servers or switching to static.

Prevention

  • Size min_spare_servers to your burst pattern. Measure the maximum concurrent request arrival rate during your peak traffic window. Set min_spare to at least that number plus 20% headroom.
  • Monitor idle-vs-listen-queue timing. The earliest signal of scaling lag is idle hitting zero followed by the listen queue growing. If you see this sequence repeatedly, the pool is under-provisioned for spare capacity, even if total processes never reaches max_children.
  • Poll at 1-second intervals. Scaling lag events unfold in seconds. A 10-second poll interval will miss the idle-to-zero spike and the brief queue buildup entirely. You will see a clean status page and wonder why users reported latency.
  • Test with realistic burst patterns. Load tests that ramp traffic gradually will not reproduce scaling lag. Use step-load or spike tests that simulate sudden concurrent request arrival.
  • Consider static mode for production. If your traffic is bursty and memory allows, static mode removes the reaction delay entirely. Dynamic mode is better suited for environments where memory pressure is the binding constraint and traffic is steady.

How Netdata helps

  • Per-second polling of PHP-FPM status page metrics catches the idle-to-zero spike and the listen queue growth that 10-second pollers miss entirely.
  • Correlation of idle processes with listen queue depth on the same timeline shows the reaction delay: idle drops, queue grows, workers appear seconds later. The gap between those events is your scaling lag.
  • The “max children reached” counter as a rate metric distinguishes scaling lag (counter is zero, total is below max) from true worker exhaustion (counter is incrementing, total is at max).
  • Kernel-level socket monitoring (Recv-Q on the listening socket, ListenOverflows counters) reveals backlog overflow that the FPM status page cannot see.
  • Per-worker RSS tracking helps you calculate the memory cost of raising min_spare_servers, so you can size the spare buffer without risking OOM.