The only agent that thinks for itself

Autonomous Monitoring with self-learning AI built-in, operating independently across your entire stack.

Unlimited Metrics & Logs
Machine learning & MCP
5% CPU, 150MB RAM
3GB disk, >1 year retention
800+ integrations, zero config
Dashboards, alerts out of the box
> Discover Netdata Agents

Centralized metrics streaming and storage

Aggregate metrics from multiple agents into centralized Parent nodes for unified monitoring across your infrastructure.

Stream from unlimited agents
Long-term data retention
High availability clustering
Data replication & backup
Scalable architecture
Enterprise-grade security
> Learn about Parents

Fully managed cloud platform

Access your monitoring data from anywhere with our SaaS platform. No infrastructure to manage, automatic updates, and global availability.

Zero infrastructure management
99.9% uptime SLA
Global data centers
Automatic updates & patches
Enterprise SSO & RBAC
SOC2 & ISO certified
> Explore Netdata Cloud

Deploy Netdata Cloud in your infrastructure

Run the full Netdata Cloud platform on-premises for complete data sovereignty and compliance with your security policies.

Complete data sovereignty
Air-gapped deployment
Custom compliance controls
Private network integration
Dedicated support team
Kubernetes & Docker support
> Learn about Cloud On-Premises

Powerful, intuitive monitoring interface

Modern, responsive UI built for real-time troubleshooting with customizable dashboards and advanced visualization capabilities.

Real-time chart updates
Customizable dashboards
Dark & light themes
Advanced filtering & search
Responsive on all devices
Collaboration features
> Explore Netdata UI

Monitor on the go

Native iOS and Android apps bring full monitoring capabilities to your mobile device with real-time alerts and notifications.

iOS & Android apps
Push notifications
Touch-optimized interface
Offline data access
Biometric authentication
Widget support
> Download apps

The future of infrastructure observability

See our strategic direction across AI-native observability, full-stack signals, operational intelligence, and enterprise platform maturity.

AI-native observability
Full-stack signal coverage
Operational intelligence
Enterprise platform maturity
Agent releases every 6 weeks
Cloud continuous delivery
> Explore Product Roadmap

Best energy efficiency

True real-time per-second

100% automated zero config

Centralized observability

Multi-year retention

High availability built-in

Zero maintenance

Always up-to-date

Enterprise security

Complete data control

Air-gap ready

Compliance certified

Millisecond responsiveness

Infinite zoom & pan

Works on any device

Native performance

Instant alerts

Monitor anywhere

AI-native observability

Continuous delivery

Open source foundation

80% Faster Incident Resolution

AI-powered troubleshooting from detection, to root cause and blast radius identification, to reporting.

True Real-Time and Simple, even at Scale

Linearly and infinitely scalable full-stack observability, that can be deployed even mid-crisis.

90% Cost Reduction, Full Fidelity

Instead of centralizing the data, Netdata distributes the code, eliminating pipelines and complexity.

See and Map Your Entire Network

Live topology, flow analytics, and SNMP device and trap monitoring — unified with your full-stack observability.

Control Without Surrender

SOC 2 Type 2 certified with every metric kept on your infrastructure.

Integrations

800+ collectors and notification channels, auto-discovered and ready out of the box.

800+ data collectors
Auto-discovery & zero config
Cloud, infra, app protocols
Notifications out of the box
> Explore integrations
Real Results
46% Cost Reduction

Reduced monitoring costs by 46% while cutting staff overhead by 67%.

— Leonardo Antunez, Codyas

Zero Pipeline

No data shipping. No central storage costs. Query at the edge.

From Our Users
"Out-of-the-Box"

So many out-of-the-box features! I mostly don't have to develop anything.

— Simon Beginn, LANCOM Systems

No Query Language

Point-and-click troubleshooting. No PromQL, no LogQL, no learning curve.

Enterprise Ready
67% Less Staff, 46% Cost Cut

Enterprise efficiency without enterprise complexity—real ROI from day one.

— Leonardo Antunez, Codyas

SOC 2 Type 2 Certified

Zero data egress. Only metadata reaches the cloud. Your metrics stay on your infrastructure.

Full Coverage
800+ Collectors

Auto-discovered and configured. No manual setup required.

Any Notification Channel

Slack, PagerDuty, Teams, email, webhooks—all built-in.

Built for the People Who Get Paged

Because 3am alerts deserve instant answers, not hour-long hunts.

Every Industry Has Rules. We Master Them.

See how healthcare, finance, and government teams cut monitoring costs 90% while staying audit-ready.

Monitor Any Technology. Configure Nothing.

Install the agent. It already knows your stack.
From Our Users
"A Rare Unicorn"

Netdata gives more than you invest in it. A rare unicorn that obeys the Pareto rule.

— Eduard Porquet Mateu, TMB Barcelona

99% Downtime Reduction

Reduced website downtime by 99% and cloud bill by 30% using Netdata alerts.

— Falkland Islands Government

Real Savings
30% Cloud Cost Reduction

Optimized resource allocation based on Netdata alerts cut cloud spending by 30%.

— Falkland Islands Government

46% Cost Cut

Reduced monitoring staff by 67% while cutting operational costs by 46%.

— Codyas

Real Coverage
"Plugin for Everything"

Netdata has agent capacity or a plugin for everything, including Windows and Kubernetes.

— Eduard Porquet Mateu, TMB Barcelona

"Out-of-the-Box"

So many out-of-the-box features! I mostly don't have to develop anything.

— Simon Beginn, LANCOM Systems

Real Speed
Troubleshooting in 30 Seconds

From 2-3 minutes to 30 seconds—instant visibility into any node issue.

— Matthew Artist, Nodecraft

20% Downtime Reduction

20% less downtime and 40% budget optimization from out-of-the-box monitoring.

— Simon Beginn, LANCOM Systems

Pay per Node. Unlimited Everything Else.

One price per node. Unlimited metrics, logs, users, and retention. No per-GB surprises.

Free tier—forever
No metric limits or caps
Retention you control
Cancel anytime
> See pricing plans

What's Your Monitoring Really Costing You?

Most teams overpay by 40-60%. Let's find out why.

Expose hidden metric charges
Calculate tool consolidation
Customers report 30-67% savings
Results in under 60 seconds
> See what you're really paying

Your Infrastructure Is Unique. Let's Talk.

Because monitoring 10 nodes is different from monitoring 10,000.

On-prem & air-gapped deployment
Volume pricing & agreements
Architecture review for your scale
Compliance & security support
> Start a conversation

Monitoring That Sells Itself

Deploy in minutes. Impress clients in hours. Earn recurring revenue for years.

30-second live demos close deals
Zero config = zero support burden
Competitive margins & deal protection
Response in 48 hours
> Apply to partner

Per-Second Metrics at Homelab Prices

Same engine, same dashboards, same ML. Just priced for tinkerers.

Community: Free forever · 5 nodes · non-commercial
Homelab: $90/yr · unlimited nodes · fair usage
> Get the Homelab Plan

$1,000 Per Referral. Unlimited Referrals.

Your colleagues get 10% off. You get 10% commission. Everyone wins.

10% of subscriptions, up to $1,000 each
Track earnings inside Netdata Cloud
PayPal/Venmo payouts in 3-4 weeks
No caps, no complexity
> Get your referral link
Cost Proof
40% Budget Optimization

"Netdata's significant positive impact" — LANCOM Systems

Calculate Your Savings

Compare vs Datadog, Grafana, Dynatrace

Savings Proof
46% Cost Reduction

"Cut costs by 46%, staff by 67%" — Codyas

30% Cloud Bill Savings

"Reduced cloud bill by 30%" — Falkland Islands Gov

Enterprise Proof
"Better Than Combined Alternatives"

"Better observability with Netdata than combining other tools." — TMB Barcelona

Real Engineers, <24h Response

DPA, SLAs, on-prem, volume pricing

Why Partners Win
Demo Live Infrastructure

One command, 30 seconds, real data—no sandbox needed

Zero Tickets, High Margins

Auto-config + per-node pricing = predictable profit

Homelab Ready
Free Video Course

8-episode Netdata tutorial by LearnLinux.tv

76k+ GitHub Stars

3rd most starred monitoring project

Worth Recommending
Product That Delivers

Customers report 40-67% cost cuts, 99% downtime reduction

Zero Risk to Your Rep

Free tier lets them try before they buy

AI Support Assistant, Available 24/7

Nedi has access to all official documentation, source code, and resources. Ask any question about Netdata—responds in your language.

Deployment & configuration
Troubleshooting & sizing
Alerts & notifications
Evidence-based answers
> Ask Nedi now

Never Fight Fires Alone

Docs, community, and expert help—pick your path to resolution.

Learn.netdata.cloud docs
Discord, Forums, GitHub
Premium support available
> Get answers now

60 Seconds to First Dashboard

One command to install. Zero config. 850+ integrations documented.

Linux, Windows, K8s, Docker
Auto-discovers your stack
> Read our documentation

76,000+ Engineers Strong

615+ contributors. 1.5M daily downloads. One mission: simplify observability.

Per-Second. 90% Cheaper. Data Stays Home.

Side-by-side comparisons: costs, real-time granularity, and data sovereignty for every major tool.

See why teams switch from Datadog, Prometheus, Grafana, and more.

> Browse all comparisons
Edge-Native Observability, Born Open Source
Per-second visibility, ML on every metric, and data that never leaves your infrastructure.
Founded in 2016
615+ contributors worldwide
Remote-first, engineering-driven
Open source first
> Read our story
Promises We Publish—and Prove
12 principles backed by open code, independent validation, and measurable outcomes.
Open source, peer-reviewed
Zero config, instant value
Data sovereignty by design
Aligned pricing, no surprises
> See all 12 principles
Edge-Native, AI-Ready, 100% Open
76k+ stars. Full ML, AI, and automation—GPLv3+, not premium add-ons.
76,000+ GitHub stars
GPLv3+ licensed forever
ML on every metric, included
Zero vendor lock-in
> Explore our open source
Build Real-Time Observability for the World
Remote-first team shipping per-second monitoring with ML on every metric.
Remote-first, fully distributed
Open source (76k+ stars)
Challenging technical problems
Your code on millions of systems
> See open roles
Meet the Team Behind Netdata
Conferences, meetups, and tradeshows where you can see Netdata in action and talk to the engineers who build it.
Live demos and deep dives
Book 1-on-1 meetings
Talks and panel sessions
Event recaps and photos
> See all events
Talk to a Netdata Human in <24 Hours
Sales, partnerships, press, or professional services—real engineers, fast answers.
Discuss your observability needs
Pricing and volume discounts
Partnership opportunities
Media and press inquiries
> Book a conversation
Your Data. Your Rules.
On-prem data, cloud control plane, transparent terms.
Trust & Scale
76,000+ GitHub Stars

One of the most popular open-source monitoring projects

SOC 2 Type 2 Certified

Enterprise-grade security and compliance

Data Sovereignty

Your metrics stay on your infrastructure

Validated
University of Amsterdam

"Most energy-efficient monitoring solution" — ICSOC 2023, peer-reviewed

ADASTEC (Autonomous Driving)

"Doesn't miss alerts—mission-critical trust for safety software"

Community Stats
615+ Contributors

Global community improving monitoring for everyone

1.5M+ Downloads/Day

Trusted by teams worldwide

GPLv3+ Licensed

Free forever, fully open source agent

Why Join?
Remote-First

Work from anywhere, async-friendly culture

Impact at Scale

Your work helps millions of systems

$ guides / cockroachdb / cockroachdb-sequential-key-hotspot

Operations Guides

CockroachDB sequential primary key hotspot: SERIAL, timestamps, and write skew

One node in your CockroachDB cluster runs hot while the others sit near idle. Write latency for specific tables climbs into hundreds of milliseconds. Transaction restarts tagged writetooold increase steadily alongside the insert rate. The cluster has plenty of aggregate CPU, memory, and disk headroom, but the workload cannot use it.

CockroachDB stores data in an ordered keyspace divided into ranges of approximately 512 MiB. Each range has a single leaseholder that serves all reads and coordinates all writes for keys in that range. When primary keys are sequential (SERIAL, auto-incrementing integers, timestamps), every new insert lands near the end of the keyspace, concentrated in the same range. That range’s leaseholder becomes a single-node bottleneck.

CockroachDB’s load-based splitter tries to break up hot ranges automatically, but sequential keys offer no balanced split point. The range stays intact and grows hotter. The fix requires changing key distribution, not tuning cluster settings.

Why sequential keys concentrate writes

CockroachDB’s SERIAL type maps to INT8 with a default of unique_rowid(). That function produces a 64-bit integer combining a timestamp component with a node identifier. The values are time-sortable: each new insert targets a key after all previous ones. All writes concentrate on the last range of the table.

unique_rowid() produces [1 leading zero bit][48 timestamp bits][15 node ID bits] at 10-microsecond granularity, which is what makes the values time-sortable.

Because the leaseholder for that single range serves every insert, that node saturates while the rest of the cluster idles. Concurrent transactions writing to overlapping keys conflict under CockroachDB’s serializable isolation, producing writetooold transaction restarts. A writetooold restart means the transaction tried to write a key that another transaction already wrote at a higher timestamp. Under a hotspot, many transactions target the same narrow keyspace region simultaneously.

Load-based splitting evaluates hot ranges for split opportunities. For uniformly distributed keys (UUID v4), the splitter finds a midpoint that evenly divides requests and creates two ranges. For sequential keys, no balanced split point exists. Every candidate split leaves nearly all traffic on one side. The splitter logs that it cannot find a balanced division and leaves the range alone. Repeated occurrences of this log message confirm a sequential hotspot.

The same problem affects timestamp-prefixed secondary indexes. Even when the primary key uses UUID v4, a secondary index whose leading column is a timestamp (INDEX (created_at), INDEX (last_seen_at)) creates a moving hotspot. All new inserts land at the end of the index, concentrating writes on one range.

flowchart LR
    A["App INSERT workload"] --> B{"Primary key pattern?"}
    B -->|SERIAL / timestamp| C["All writes to last range"]
    B -->|UUID v4 / hash| D["Writes spread across ranges"]
    C --> E["Leaseholder saturates"]
    E --> F["writetooold restarts climb"]
    E --> G["One node CPU hot"]
    G --> H["Splitter cannot balance range"]
    D --> I["Cluster scales horizontally"]

Common causes

CauseWhat it looks likeFirst thing to check
SERIAL or auto-increment primary keyAll inserts target one range; writetooold restarts rise with insert rateSHOW CREATE TABLE on the affected table
Timestamp-prefixed primary keySame concentration; may appear in composite keys starting with a timestampCheck PK and index definitions
Timestamp-prefixed secondary indexHotspot on an index even when the PK uses UUID v4Review all indexes, not just the PK
Single-row counter or hot rowOne key updated by most transactionsLook for UPDATE statements hitting the same row

Quick checks

These commands are read-only and safe to run during production traffic. The crdb_internal.ranges query is admin-only and performs an expensive cluster-wide RPC, so use it for diagnosis, not continuous monitoring.

crdb_internal.ranges does not expose per-range queries per second. Per-range QPS is available in the DB Console Hot Ranges/Top Ranges page and in the hot_ranges_stats log events; SHOW RANGES FROM TABLE <table> WITH DETAILS is the better alternative for a single table’s range layout.

-- Range layout and leaseholder per range (no per-range QPS column)
SELECT range_id, start_pretty, lease_holder, range_size
FROM crdb_internal.ranges
ORDER BY lease_holder
LIMIT 20;
# Check writetooold restart rate
curl -s http://localhost:8080/_status/vars | grep txn_restarts
# Check per-node CPU for asymmetry
curl -s http://localhost:8080/_status/vars | grep -E 'sys_cpu_(user|sys)_ns'
# Check leaseholder distribution across nodes
curl -s http://localhost:8080/_status/vars | grep replicas_leaseholders

The correct metric name is replicas_leaseholders (Prometheus form of replicas.leaseholders); CockroachDB exposes no leases_count metric.

-- Examine the primary key and index definitions
SHOW CREATE TABLE <database>.<table>;
# Check SQL latency for the affected tables
curl -s http://localhost:8080/_status/vars | grep sql_service_latency

How to diagnose it

  1. Confirm the asymmetry. Compare per-node CPU utilization. A hot range shows one node with CPU significantly elevated while peers with similar range counts sit at moderate levels. Compare replicas_leaseholders per node to rule out general lease imbalance.

  2. Identify the hot range. Use the DB Console Hot Ranges/Top Ranges page or the hot_ranges_stats log events, which rank ranges by queries per second, and look for a range at more than 10x the table or cluster average. Then use crdb_internal.ranges (or SHOW RANGES FROM TABLE ... WITH DETAILS) to confirm the range layout; crdb_internal.ranges has no queries_per_second column, so per-range QPS comes from the Hot Ranges/Top Ranges page or the hot ranges logs.

  3. Examine the key pattern. Run SHOW CREATE TABLE on the table from step 2. Look for SERIAL, unique_rowid(), auto-increment behavior, or timestamp columns in the primary key. Check secondary indexes for timestamp-prefixed columns.

  4. Confirm writetooold correlation. Check whether txn_restarts with writetooold cause tracks the insert volume for the affected table. If restarts rise and fall with insert rate, the hotspot is the source.

  5. Check for splitting failures. Search CockroachDB logs for messages about load-based splitting being unable to find a balanced split. Repeated messages on the same range confirm that automatic mitigation is not working.

Metrics and signals to monitor

SignalWhy it mattersWarning sign
txn_restarts (writetooold cause)Directly measures write contention on hot keysSustained nonzero rate that scales with insert volume
Per-node CPU (sys_cpu_user_ns, sys_cpu_sys_ns)Asymmetry reveals single-node bottleneckOne node more than 2x CPU of peers with similar range counts
sql_service_latency (per statement)Isolates latency to affected tablesP99 climbing for INSERTs on specific tables while other tables stay stable
replicas_leaseholders per storeShows leaseholder skewOne node holding disproportionate leases for the hot table
Hot Ranges/Top Ranges page or hot_ranges_stats logsConfirms the specific range and tableAny range with more than 10x average QPS

Fixes

Short-term: manual range splits

ALTER TABLE ... SPLIT AT forces a range split at a specific key value. This distributes the hot range across two leaseholders temporarily.

-- Force a split at a specific value (adjust to your keyspace)
ALTER TABLE <database>.<table> SPLIT AT VALUES (<value>);

This is a stopgap. Sequential keys immediately create a new hotspot at the end of the newly split range. Use this only to buy time while preparing a schema change.

Cockroach Labs recommends UUID v4 for all primary keys. UUID v4 values are randomly distributed, so inserts spread evenly across the keyspace and across ranges.

-- New table with UUID v4 primary key
CREATE TABLE events (
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    data BYTES
);

For existing tables, migrating from SERIAL to UUID requires a data backfill. Plan this as a schema change with sufficient time and disk I/O headroom.

If you need integer keys but want better distribution, consider setting serial_normalization to unordered_rowid mode. This uses unordered_unique_rowid(), which scrambles the key ordering. It does not guarantee ordering and may not scatter as uniformly as UUID v4.

Hash-sharded indexes

When you need sequential ordering for range scans but want to distribute writes, hash-sharded indexes distribute sequential traffic across ranges by hashing the index key into buckets.

-- Create a hash-sharded index on a sequential column
CREATE INDEX idx_events_created ON events (created_at)
    USING HASH WITH (bucket_count = 8);

Tradeoffs:

  • Write throughput improves because writes spread across bucket ranges instead of concentrating on one.
  • Read performance degrades for scans that must check each bucket separately.
  • Bucket count above node count yields diminishing returns. Start with a count close to your node count and increase as the cluster grows.
  • Cannot be used with explicit PARTITION BY (including REGIONAL BY ROW partitioning on crdb_region).
  • Since v22.1, the shard column is virtual (not stored), so new hash-sharded indexes do not require a backfill. Indexes created before v22.1 use a stored column and may backfill. Drop and recreate to avoid backfill overhead.

CockroachDB accepts any positive integer for bucket_count (official examples use 4, 16, and 20); there is no power-of-two requirement.

Timestamp-prefixed secondary indexes

Even with a UUID primary key, a secondary index like INDEX (created_at) creates the same hotspot. All new inserts land at the end of the index.

Options:

  • Use a hash-sharded version of the index (USING HASH WITH (bucket_count = N)).
  • Prefix the index with a higher-cardinality column to distribute writes: INDEX (user_id, created_at) instead of INDEX (created_at).

Prevention

  • Default to UUID v4 for all new tables. Use gen_random_uuid() as the primary key default.
  • Audit secondary indexes. Any index whose leading column is a timestamp, serial, or auto-increment value creates a hotspot under write load.
  • Monitor per-range QPS distribution. Per-range QPS is not exposed through _status/vars; use the DB Console Hot Ranges/Top Ranges page or the hot_ranges_stats logs. Avoid polling crdb_internal.ranges, which is an expensive cluster-wide RPC. Alert on any range exceeding 10x the average.
  • Watch writetooold restart rates. A rising writetooold rate that tracks insert volume is the earliest quantitative signal of a sequential hotspot.
  • Use hash-sharded indexes when sequential ordering is required. Accept the read scan penalty in exchange for write distribution.
  • Review table designs during schema review. Catch sequential key patterns before they reach production.

How Netdata helps

  • Per-second metric granularity catches CPU asymmetry between nodes before it becomes a user-visible latency problem. A hot range shows up as one node’s CPU diverging from its peers within seconds.
  • Correlating txn_restarts (writetooold cause) with per-node CPU and sql_service_latency on a single timeline makes the sequential hotspot pattern immediately recognizable. The combination of one node hot, writetooold climbing, and INSERT latency rising is diagnostic.
  • leases_count per store reveals leaseholder skew without requiring an expensive crdb_internal query. If one node holds disproportionate leases for a hot table, it confirms the bottleneck.
  • ML-based anomaly detection flags the CPU asymmetry and restart rate deviation even when no static threshold has been set, which is useful for gradually emerging hotspots as write volume grows over weeks.
  • The storage_l0_sublevels metric distinguishes a hot range problem from a compaction death spiral. If L0 is low but one node is CPU-saturated, the issue is key distribution, not storage health.

Netdata’s CockroachDB monitoring with Netdata brings these signals together with per-second metrics and ML anomaly detection.

The Netdata solution

CockroachDB monitoring with Netdata

Netdata monitors CockroachDB with per-second metrics and automatic dashboards. Watch LSM compaction, Raft liveness, clock skew, hot ranges, and intent buildup so the distributed-systems failure modes in these runbooks surface early.