Edge monitoring means running the full observability pipeline - collection, storage, anomaly detection, alerting, and dashboards - on or near the monitored device itself, instead of shipping all raw telemetry to a central system first. Each node in the fleet collects and processes its own metrics locally, and only forwards what is needed upstream. This model is essential for distributed fleets of thousands of devices where centralizing all telemetry is economically and technically impractical.
What is edge monitoring?
Traditional monitoring architectures follow a hub-and-spoke pattern: agents on each machine collect metrics and ship them to a central server or SaaS platform, which stores everything, runs queries, evaluates alerts, and renders dashboards. That central system is the bottleneck. If the network between a device and the central server fails, monitoring stops. If you have 10,000 devices each sending hundreds of metrics per second, the storage and egress costs become disqualifying.
Edge monitoring inverts the model. The observability pipeline runs on the device:
- Collection happens locally, at full resolution.
- Storage is local to the node or to a nearby regional parent.
- Anomaly detection runs on the node itself.
- Alerting is evaluated where the data lives.
- Dashboards are served from the edge, with a central UI providing unified views across the fleet.
The result is that monitoring survives network partitions, scales linearly with fleet size, and keeps data close to its source.
How edge monitoring works
An edge-native monitoring system has three logical tiers, but the work is distributed across them rather than concentrated at the top.
The node tier: collection and local intelligence
Each monitored device runs a monitoring agent that is self-sufficient. The agent auto-discovers what to monitor based on what is running on the host - containers, disks, network interfaces, applications, databases, and so on. It collects metrics at high granularity (per-second in Netdata’s case), stores them locally, runs anomaly detection on them, and evaluates alert rules without needing a round-trip to any external system.
This is the defining characteristic. The node is not a dumb forwarder. It is a complete monitoring system for itself.
The parent tier: regional aggregation and retention
In a fleet architecture, nodes push a continuous stream of metrics to one or more parent servers. Parents are positioned near the fleet - in a regional data center, a cloud region, or an on-premises server - rather than in a distant central cloud. The parent provides:
- Longer retention than a single small device can hold.
- Store-and-forward behavior: if a node loses connectivity to the parent, it keeps recording locally and backfills when the link returns.
- Aggregation so that dashboards and queries can span multiple nodes without contacting each one individually.
- High availability when parents are clustered.
Parents do not need to talk to each other unless explicitly clustered for HA.
The cloud tier: unified visibility, not a data sink
The cloud layer in an edge-native model does not receive bulk telemetry. It receives metadata - what nodes exist, where they are, how they are organized - and it provides:
- A unified dashboard across the entire fleet.
- Cross-node alerting and correlation.
- Distributed queries that fan out to the nodes and parents on demand.
This is a critical distinction from traditional centralized monitoring. The cloud is a control plane and a presentation layer, not a data warehouse for raw metrics.
Edge monitoring vs. centralized monitoring
| Aspect | Centralized monitoring | Edge monitoring |
|---|---|---|
| Where collection happens | On device, but forwarded immediately | On device, processed locally |
| Where data is stored | Central server or SaaS | On the node and/or regional parent |
| Network outage behavior | Gaps in data or monitoring stops | Monitoring continues; data backfills |
| Scaling cost | Grows with total telemetry volume | Grows with fleet size, not telemetry volume |
| Alert evaluation | Central server | On the node itself |
| Query path | Central database | Distributed to nodes/parents on demand |
| Best suited for | Small to mid-size estates, dense data centers | Distributed fleets, IoT, remote sites |
Why edge monitoring matters for distributed fleets
The economics of centralized monitoring break down at fleet scale. Consider a deployment of 5,000 remote Linux devices - IoT gateways, kiosks, POS terminals, EV chargers, or MSP-managed servers. Each device might expose hundreds or thousands of metrics per second. Shipping all of that to a central SaaS platform means:
- Egress costs for every byte of telemetry leaving each site.
- Ingest and storage costs that scale with total metric volume, not fleet size.
- Latency for dashboards and alerts that depend on a distant central system.
- Data gaps every time a WAN link flaps or a site goes offline.
Edge monitoring addresses each of these. Because collection, storage, and alerting run on the device, there is no per-byte egress cost for routine monitoring. Because parents are regional, latency is low. And because data is retained locally, network partitions cause no data loss.
Common use cases
Edge monitoring fits scenarios where devices are numerous, distributed, and individually important:
- IoT gateways and sensors spread across geographic sites, often on unreliable networks. See IoT monitoring for architectures tailored to these deployments.
- Kiosks, POS terminals, and digital signage in retail environments where each device is a standalone Linux endpoint.
- EV charging stations and other smart infrastructure deployed at scale.
- Robots and industrial controllers on factory floors or in warehouses.
- Remote servers managed by MSPs, where each customer environment is isolated. See MSP monitoring for how multi-tenant visibility works.
- Edge data centers and regional infrastructure that need infrastructure monitoring without depending on a central platform.
Common pitfalls and misconceptions
“Edge monitoring means no central visibility.” No. Edge monitoring keeps data at the edge but still provides unified dashboards and cross-fleet queries. The difference is that the cloud queries the edge on demand rather than storing everything centrally.
“You have to choose between edge or cloud.” A well-designed edge monitoring architecture uses both. The edge handles collection, storage, and alerting. The cloud handles aggregation, presentation, and fleet-wide correlation.
“Edge monitoring is just a buzzword.” There is a simple binary test: does the monitoring tool actually see every device in the fleet at full resolution, without a central bottleneck? If the answer is yes - collection is local, data is retained at the edge, and the central layer is a control plane - it is genuine edge monitoring. If the agent is just forwarding raw metrics to a central store, it is not.
“Per-second collection is too expensive at the edge.” This conflates collection cost with storage cost. Local collection and storage on the device is cheap. What gets expensive is shipping high-resolution telemetry across the WAN and storing it in a central SaaS. Edge monitoring avoids that.
Edge monitoring with Netdata
Netdata is edge-native by design. Each Netdata Agent is a complete monitoring system for its own node: it collects metrics at per-second granularity without sampling or pre-aggregation, stores them locally, visualizes them, evaluates alerts, and runs ML-based anomaly detection on the device itself.
The fleet architecture works as follows:
- Agents run on each monitored device. They auto-discover what to monitor with 800+ collectors and integrations, and they restart in 2-3 seconds.
- Agents push a continuous metrics stream to Netdata Parents, which are positioned near the fleet. Parents provide longer retention, store-and-forward buffering, and can be clustered for high availability with zero-downtime updates.
- Netdata Cloud receives metadata only - not bulk telemetry. It provides unified dashboards, cross-node alerting, and runs distributed queries against the connected Agents and Parents on demand.
Because data and processing live at the edge, monitoring continues during network partitions. History is retained locally and reconciled when connectivity returns. Agents are free and open source, and Netdata Cloud uses transparent per-node pricing.
This model is built for distributed fleets - thousands of Linux endpoints across many sites where centralizing all telemetry is the wrong architecture. Learn more in the edge fleet monitoring overview.
FAQ
What is the difference between edge monitoring and edge computing?
Edge computing is about running application workloads close to where data is generated. Edge monitoring is about observing those workloads and devices. Edge monitoring can run on edge computing devices, but it also applies to any distributed fleet: kiosks, IoT gateways, remote servers, and so on.
Does edge monitoring work without internet connectivity?
Yes. In an edge-native architecture, each node collects, stores, and alerts locally. If the connection to a parent or to the cloud is lost, monitoring continues. When connectivity returns, locally stored data is reconciled and backfilled upstream.
How is edge monitoring different from agent-based monitoring?
Traditional agent-based monitoring still forwards raw metrics to a central server for storage, alerting, and dashboards. The agent is essentially a collector and forwarder. Edge monitoring makes the agent self-sufficient: it stores, alerts, and serves dashboards on its own, with the central layer providing unified visibility rather than acting as the data store.
Is edge monitoring more expensive than centralized monitoring?
For small estates, centralized monitoring can be simpler and cheaper. For distributed fleets at scale, edge monitoring is typically more cost-effective because it avoids shipping and storing all telemetry centrally. Costs scale with the number of nodes, not with total telemetry volume.
Can you do per-second monitoring at the edge?
Yes. Netdata Agents collect at per-second (1-second) granularity without sampling or pre-aggregation. Because collection and storage are local, high resolution does not incur WAN or central storage costs.