The only agent that thinks for itself

Autonomous Monitoring with self-learning AI built-in, operating independently across your entire stack.

Unlimited Metrics & Logs
Machine learning & MCP
5% CPU, 150MB RAM
3GB disk, >1 year retention
800+ integrations, zero config
Dashboards, alerts out of the box
> Discover Netdata Agents

Centralized metrics streaming and storage

Aggregate metrics from multiple agents into centralized Parent nodes for unified monitoring across your infrastructure.

Stream from unlimited agents
Long-term data retention
High availability clustering
Data replication & backup
Scalable architecture
Enterprise-grade security
> Learn about Parents

Fully managed cloud platform

Access your monitoring data from anywhere with our SaaS platform. No infrastructure to manage, automatic updates, and global availability.

Zero infrastructure management
99.9% uptime SLA
Global data centers
Automatic updates & patches
Enterprise SSO & RBAC
SOC2 & ISO certified
> Explore Netdata Cloud

Deploy Netdata Cloud in your infrastructure

Run the full Netdata Cloud platform on-premises for complete data sovereignty and compliance with your security policies.

Complete data sovereignty
Air-gapped deployment
Custom compliance controls
Private network integration
Dedicated support team
Kubernetes & Docker support
> Learn about Cloud On-Premises

Powerful, intuitive monitoring interface

Modern, responsive UI built for real-time troubleshooting with customizable dashboards and advanced visualization capabilities.

Real-time chart updates
Customizable dashboards
Dark & light themes
Advanced filtering & search
Responsive on all devices
Collaboration features
> Explore Netdata UI

Monitor on the go

Native iOS and Android apps bring full monitoring capabilities to your mobile device with real-time alerts and notifications.

iOS & Android apps
Push notifications
Touch-optimized interface
Offline data access
Biometric authentication
Widget support
> Download apps

The future of infrastructure observability

See our strategic direction across AI-native observability, full-stack signals, operational intelligence, and enterprise platform maturity.

AI-native observability
Full-stack signal coverage
Operational intelligence
Enterprise platform maturity
Agent releases every 6 weeks
Cloud continuous delivery
> Explore Product Roadmap

Best energy efficiency

True real-time per-second

100% automated zero config

Centralized observability

Multi-year retention

High availability built-in

Zero maintenance

Always up-to-date

Enterprise security

Complete data control

Air-gap ready

Compliance certified

Millisecond responsiveness

Infinite zoom & pan

Works on any device

Native performance

Instant alerts

Monitor anywhere

AI-native observability

Continuous delivery

Open source foundation

80% Faster Incident Resolution

AI-powered troubleshooting from detection, to root cause and blast radius identification, to reporting.

True Real-Time and Simple, even at Scale

Linearly and infinitely scalable full-stack observability, that can be deployed even mid-crisis.

90% Cost Reduction, Full Fidelity

Instead of centralizing the data, Netdata distributes the code, eliminating pipelines and complexity.

See and Map Your Entire Network

Live topology, flow analytics, and SNMP device and trap monitoring — unified with your full-stack observability.

Control Without Surrender

SOC 2 Type 2 certified with every metric kept on your infrastructure.

Integrations

800+ collectors and notification channels, auto-discovered and ready out of the box.

800+ data collectors
Auto-discovery & zero config
Cloud, infra, app protocols
Notifications out of the box
> Explore integrations
Real Results
46% Cost Reduction

Reduced monitoring costs by 46% while cutting staff overhead by 67%.

— Leonardo Antunez, Codyas

Zero Pipeline

No data shipping. No central storage costs. Query at the edge.

From Our Users
"Out-of-the-Box"

So many out-of-the-box features! I mostly don't have to develop anything.

— Simon Beginn, LANCOM Systems

No Query Language

Point-and-click troubleshooting. No PromQL, no LogQL, no learning curve.

Enterprise Ready
67% Less Staff, 46% Cost Cut

Enterprise efficiency without enterprise complexity—real ROI from day one.

— Leonardo Antunez, Codyas

SOC 2 Type 2 Certified

Zero data egress. Only metadata reaches the cloud. Your metrics stay on your infrastructure.

Full Coverage
800+ Collectors

Auto-discovered and configured. No manual setup required.

Any Notification Channel

Slack, PagerDuty, Teams, email, webhooks—all built-in.

Built for the People Who Get Paged

Because 3am alerts deserve instant answers, not hour-long hunts.

Every Industry Has Rules. We Master Them.

See how healthcare, finance, and government teams cut monitoring costs 90% while staying audit-ready.

Monitor Any Technology. Configure Nothing.

Install the agent. It already knows your stack.
From Our Users
"A Rare Unicorn"

Netdata gives more than you invest in it. A rare unicorn that obeys the Pareto rule.

— Eduard Porquet Mateu, TMB Barcelona

99% Downtime Reduction

Reduced website downtime by 99% and cloud bill by 30% using Netdata alerts.

— Falkland Islands Government

Real Savings
30% Cloud Cost Reduction

Optimized resource allocation based on Netdata alerts cut cloud spending by 30%.

— Falkland Islands Government

46% Cost Cut

Reduced monitoring staff by 67% while cutting operational costs by 46%.

— Codyas

Real Coverage
"Plugin for Everything"

Netdata has agent capacity or a plugin for everything, including Windows and Kubernetes.

— Eduard Porquet Mateu, TMB Barcelona

"Out-of-the-Box"

So many out-of-the-box features! I mostly don't have to develop anything.

— Simon Beginn, LANCOM Systems

Real Speed
Troubleshooting in 30 Seconds

From 2-3 minutes to 30 seconds—instant visibility into any node issue.

— Matthew Artist, Nodecraft

20% Downtime Reduction

20% less downtime and 40% budget optimization from out-of-the-box monitoring.

— Simon Beginn, LANCOM Systems

Pay per Node. Unlimited Everything Else.

One price per node. Unlimited metrics, logs, users, and retention. No per-GB surprises.

Free tier—forever
No metric limits or caps
Retention you control
Cancel anytime
> See pricing plans

What's Your Monitoring Really Costing You?

Most teams overpay by 40-60%. Let's find out why.

Expose hidden metric charges
Calculate tool consolidation
Customers report 30-67% savings
Results in under 60 seconds
> See what you're really paying

Your Infrastructure Is Unique. Let's Talk.

Because monitoring 10 nodes is different from monitoring 10,000.

On-prem & air-gapped deployment
Volume pricing & agreements
Architecture review for your scale
Compliance & security support
> Start a conversation

Monitoring That Sells Itself

Deploy in minutes. Impress clients in hours. Earn recurring revenue for years.

30-second live demos close deals
Zero config = zero support burden
Competitive margins & deal protection
Response in 48 hours
> Apply to partner

Per-Second Metrics at Homelab Prices

Same engine, same dashboards, same ML. Just priced for tinkerers.

Community: Free forever · 5 nodes · non-commercial
Homelab: $90/yr · unlimited nodes · fair usage
> Get the Homelab Plan

$1,000 Per Referral. Unlimited Referrals.

Your colleagues get 10% off. You get 10% commission. Everyone wins.

10% of subscriptions, up to $1,000 each
Track earnings inside Netdata Cloud
PayPal/Venmo payouts in 3-4 weeks
No caps, no complexity
> Get your referral link
Cost Proof
40% Budget Optimization

"Netdata's significant positive impact" — LANCOM Systems

Calculate Your Savings

Compare vs Datadog, Grafana, Dynatrace

Savings Proof
46% Cost Reduction

"Cut costs by 46%, staff by 67%" — Codyas

30% Cloud Bill Savings

"Reduced cloud bill by 30%" — Falkland Islands Gov

Enterprise Proof
"Better Than Combined Alternatives"

"Better observability with Netdata than combining other tools." — TMB Barcelona

Real Engineers, <24h Response

DPA, SLAs, on-prem, volume pricing

Why Partners Win
Demo Live Infrastructure

One command, 30 seconds, real data—no sandbox needed

Zero Tickets, High Margins

Auto-config + per-node pricing = predictable profit

Homelab Ready
Free Video Course

8-episode Netdata tutorial by LearnLinux.tv

76k+ GitHub Stars

3rd most starred monitoring project

Worth Recommending
Product That Delivers

Customers report 40-67% cost cuts, 99% downtime reduction

Zero Risk to Your Rep

Free tier lets them try before they buy

AI Support Assistant, Available 24/7

Nedi has access to all official documentation, source code, and resources. Ask any question about Netdata—responds in your language.

Deployment & configuration
Troubleshooting & sizing
Alerts & notifications
Evidence-based answers
> Ask Nedi now

Never Fight Fires Alone

Docs, community, and expert help—pick your path to resolution.

Learn.netdata.cloud docs
Discord, Forums, GitHub
Premium support available
> Get answers now

60 Seconds to First Dashboard

One command to install. Zero config. 850+ integrations documented.

Linux, Windows, K8s, Docker
Auto-discovers your stack
> Read our documentation

76,000+ Engineers Strong

615+ contributors. 1.5M daily downloads. One mission: simplify observability.

Per-Second. 90% Cheaper. Data Stays Home.

Side-by-side comparisons: costs, real-time granularity, and data sovereignty for every major tool.

See why teams switch from Datadog, Prometheus, Grafana, and more.

> Browse all comparisons
Edge-Native Observability, Born Open Source
Per-second visibility, ML on every metric, and data that never leaves your infrastructure.
Founded in 2016
615+ contributors worldwide
Remote-first, engineering-driven
Open source first
> Read our story
Promises We Publish—and Prove
12 principles backed by open code, independent validation, and measurable outcomes.
Open source, peer-reviewed
Zero config, instant value
Data sovereignty by design
Aligned pricing, no surprises
> See all 12 principles
Edge-Native, AI-Ready, 100% Open
76k+ stars. Full ML, AI, and automation—GPLv3+, not premium add-ons.
76,000+ GitHub stars
GPLv3+ licensed forever
ML on every metric, included
Zero vendor lock-in
> Explore our open source
Build Real-Time Observability for the World
Remote-first team shipping per-second monitoring with ML on every metric.
Remote-first, fully distributed
Open source (76k+ stars)
Challenging technical problems
Your code on millions of systems
> See open roles
Meet the Team Behind Netdata
Conferences, meetups, and tradeshows where you can see Netdata in action and talk to the engineers who build it.
Live demos and deep dives
Book 1-on-1 meetings
Talks and panel sessions
Event recaps and photos
> See all events
Talk to a Netdata Human in <24 Hours
Sales, partnerships, press, or professional services—real engineers, fast answers.
Discuss your observability needs
Pricing and volume discounts
Partnership opportunities
Media and press inquiries
> Book a conversation
Your Data. Your Rules.
On-prem data, cloud control plane, transparent terms.
Trust & Scale
76,000+ GitHub Stars

One of the most popular open-source monitoring projects

SOC 2 Type 2 Certified

Enterprise-grade security and compliance

Data Sovereignty

Your metrics stay on your infrastructure

Validated
University of Amsterdam

"Most energy-efficient monitoring solution" — ICSOC 2023, peer-reviewed

ADASTEC (Autonomous Driving)

"Doesn't miss alerts—mission-critical trust for safety software"

Community Stats
615+ Contributors

Global community improving monitoring for everyone

1.5M+ Downloads/Day

Trusted by teams worldwide

GPLv3+ Licensed

Free forever, fully open source agent

Why Join?
Remote-First

Work from anywhere, async-friendly culture

Impact at Scale

Your work helps millions of systems

$ guides / clickhouse / clickhouse-cache-hit-rate-low

Operations Guides

ClickHouse mark cache and uncompressed cache: reading low hit rates

ClickHouse query latency spikes after a restart, or monitoring shows a sustained drop in mark cache hit rate. Before increasing mark_cache_size, determine whether you are seeing normal warmup or a cache that is too small for the working set.

The mark cache stores primary key index granule positions. The uncompressed cache stores decompressed column blocks. Low hit rates in each produce different symptoms. This guide covers how to read the metrics, distinguish warmup from real problems, and decide when tuning is warranted.

What these caches are and why they matter

ClickHouse uses the primary key to locate column blocks. The mark cache keeps granule positions from mark files in memory. Without it, every query reads these small index files from disk, turning memory-bound seeks into random I/O. On a server with many parts, this random I/O dominates query latency.

The uncompressed cache sits downstream. When enabled, it holds decompressed column blocks in memory. Re-reading the same block returns the cached copy instead of reading compressed data from disk and decompressing it. The per-query use_uncompressed_cache setting defaults to 0; the server-side uncompressed_cache_size defaults to 8 GiB. This cache is optional and disabled per query by default.

Both are bounded by server settings. mark_cache_size limits the mark cache. uncompressed_cache_size limits the uncompressed cache. They compete for memory with query execution buffers, merges, and the OS page cache.

How the caches work

ClickHouse populates the mark cache lazily. The first query that touches a part reads its mark files from disk and inserts them into the cache. Subsequent queries reuse the cached positions. Mark files are small and numerous; a server with thousands of active parts generates heavy random read I/O during initial population. The aggregate footprint of all mark files across active parts represents the theoretical memory needed to cache the full working set, though in practice only hot parts need to be resident.

The uncompressed cache behaves similarly when enabled. A block is decompressed on first read and cached. It is most effective when a small set of column blocks is read repeatedly, such as dashboard queries scanning the same recent partition. Ad-hoc analytical queries that scan cold partitions rarely benefit and can pollute the cache.

Merges invalidate cached state. New parts have new mark files. Cached marks for old parts remain valid only until those parts are marked obsolete. Queries must then warm the cache for the new merged part. Merge storms produce temporary churn and higher miss rates. DROP TABLE or TRUNCATE also invalidate relevant entries immediately, which can appear as a sudden hit rate drop if a monitoring window overlaps with DDL.

After a restart, the mark cache is empty. ClickHouse reads mark files aggressively as queries arrive, causing a burst of disk read IOPS and elevated CPU. On servers with many parts, this can last from minutes to over an hour. Query latency during this window is often significantly higher than baseline. If the OS page cache still held mark files from before the restart, warmup may finish sooner; after memory reclamation or on a new node, the disk read burst is unavoidable. This is expected, not a configuration error.

Inspect cumulative counters in system.events:

SELECT event, value FROM system.events
WHERE event IN ('MarkCacheHits', 'MarkCacheMisses',
                'UncompressedCacheHits', 'UncompressedCacheMisses');

These are cumulative counters. Compute the hit rate across a time window by sampling twice and taking the ratio of deltas:

-- Run twice with a known interval, then calculate:
-- (MarkCacheHits_delta) / (MarkCacheHits_delta + MarkCacheMisses_delta)

Current memory footprint is visible in system.metrics:

SELECT metric, value FROM system.metrics
WHERE metric IN ('MarkCacheBytes', 'UncompressedCacheBytes');

Check whether the uncompressed cache is enabled:

SELECT name, value FROM system.settings WHERE name = 'use_uncompressed_cache';

Estimate the working set size in parts:

SELECT
    database,
    table,
    count() AS active_parts
FROM system.parts
WHERE active
GROUP BY database, table
ORDER BY active_parts DESC;
flowchart TD
    Query[Query planner] --> Marks{Mark cache lookup}
    Marks -->|Hit| Seek[Fast granule seek]
    Marks -->|Miss| DiskMarks[Read mark file from disk]
    DiskMarks --> PopMarks[Populate mark cache]
    Seek --> Data{Uncompressed cache lookup}
    PopMarks --> Data
    Data -->|Hit| Return[Return block]
    Data -->|Miss| ReadComp[Read compressed from disk]
    ReadComp --> Decomp[Decompress]
    Decomp --> PopUnc[Populate uncompressed cache if enabled]
    PopUnc --> Return

Where low hit rates show up in production

Low mark cache hit rate appears as elevated disk read IOPS during queries that should be cache-bound. If storage metrics show sustained random reads on small files while query latency is high and CPU is not saturated, the mark cache is likely undersized or cold. You may also see elevated FileOpen counts in system.events as queries open mark files.

Low uncompressed cache hit rate appears as elevated CPU usage during repeated scans of the same data. If the cache is enabled but hit rates stay low, the working set exceeds cache capacity, or the access pattern does not revisit blocks often enough.

After a restart, both metrics look bad by design. Latency spikes, disk IOPS surge, and CPU climbs. On large datasets, warming to steady-state can take hours. Monitoring that does not account for this warmup will false-fire.

Merge activity also produces transient drops. When a large merge completes, the new part’s marks are uncached until queries access it. During heavy merge backlogs, churn can keep hit rates depressed longer than a restart warmup.

Distinguishing normal warmup from real problems

A low hit rate is only a problem when it persists outside warmup and merge churn.

Restart warmup. Hit rate starts near zero and climbs. Disk IOPS and CPU spike together. Latency recovers as the cache fills. This is normal.

Merge churn. Hit rate dips when large merges complete and recovers as queries access new parts. The dip correlates with elevated entries in system.merges. Correlating system.merges start time with cache metrics confirms the pattern.

Chronic undersizing. Hit rate stays low during steady-state operation. Disk read IOPS remains elevated for index lookups, and query latency stays high. Before resizing, confirm that MarkCacheBytes is near mark_cache_size; if the cache is not full, the working set may simply be larger than the limit.

Memory pressure eviction. If MemoryTracking approaches the server limit or OSMemoryAvailable is low, ClickHouse may evict cache entries to make room for query buffers. Hit rates drop even though mark_cache_size is theoretically sufficient. In this case, add memory or reduce query concurrency before increasing cache limits.

Tradeoffs and tuning considerations

Increasing mark_cache_size reduces disk seeks but consumes memory that could otherwise hold query working sets or the uncompressed cache. Size it to the total mark file footprint across active parts. Many tables with wide primary keys and high part counts need more space than a single large table with few parts. Increase the setting incrementally; large jumps can starve queries and merges of memory, causing spill-to-disk or OOM kills elsewhere.

The uncompressed cache is not universally beneficial. It helps when queries repeatedly scan the same column blocks, but on workloads with large, non-repeating scans, it wastes memory. Enable it only after confirming that the workload revisits the same blocks and that memory headroom exists.

Do not react to hit rate alone. Production nodes must balance cache size against query concurrency and merge memory. If P99 latency is acceptable and disk IOPS is within capacity, a moderate hit rate may be fine.

Signals to watch in production

SignalWhy it mattersWarning sign
Mark cache hit rateIndex lookups from disk add latencySustained low rate outside restart or merge windows
Uncompressed cache hit rateRepeated decompression wastes CPUSustained low rate when the cache is enabled
Disk read IOPSSpikes indicate mark cache missesSustained elevation correlated with low mark cache hit rate
Query latency P99User-facing impact of cache missesSustained elevation above baseline during normal operation
Memory trackingCaches compete with query working memoryMemoryTracking approaching server limit, with hit rate dropping
Active parts countMore parts mean more marks to cachePart growth exceeding the cache’s ability to hold working set marks
Merge activityNew parts invalidate old cached marksHit rate dips that track with merge completion

How Netdata helps

Use Netdata to correlate mark cache hit rate with disk IOPS and query latency. This distinguishes cache misses from storage saturation. Track MemoryTracking alongside cache byte metrics to detect memory pressure evictions. Compare CPU with disk read IOPS to identify whether a spike is seek-bound or decompression-bound. Alert on sustained low mark cache hit rate only after excluding known warmup and merge windows.

The Netdata solution

ClickHouse monitoring with Netdata

Netdata monitors ClickHouse with per-second metrics and ML anomaly detection. Track merge debt, memory usage, replication lag, Keeper/ZooKeeper saturation, and disk headroom against the host signals that drive them.