The only agent that thinks for itself

Autonomous Monitoring with self-learning AI built-in, operating independently across your entire stack.

Unlimited Metrics & Logs
Machine learning & MCP
5% CPU, 150MB RAM
3GB disk, >1 year retention
800+ integrations, zero config
Dashboards, alerts out of the box
> Discover Netdata Agents

Centralized metrics streaming and storage

Aggregate metrics from multiple agents into centralized Parent nodes for unified monitoring across your infrastructure.

Stream from unlimited agents
Long-term data retention
High availability clustering
Data replication & backup
Scalable architecture
Enterprise-grade security
> Learn about Parents

Fully managed cloud platform

Access your monitoring data from anywhere with our SaaS platform. No infrastructure to manage, automatic updates, and global availability.

Zero infrastructure management
99.9% uptime SLA
Global data centers
Automatic updates & patches
Enterprise SSO & RBAC
SOC2 & ISO certified
> Explore Netdata Cloud

Deploy Netdata Cloud in your infrastructure

Run the full Netdata Cloud platform on-premises for complete data sovereignty and compliance with your security policies.

Complete data sovereignty
Air-gapped deployment
Custom compliance controls
Private network integration
Dedicated support team
Kubernetes & Docker support
> Learn about Cloud On-Premises

Powerful, intuitive monitoring interface

Modern, responsive UI built for real-time troubleshooting with customizable dashboards and advanced visualization capabilities.

Real-time chart updates
Customizable dashboards
Dark & light themes
Advanced filtering & search
Responsive on all devices
Collaboration features
> Explore Netdata UI

Monitor on the go

Native iOS and Android apps bring full monitoring capabilities to your mobile device with real-time alerts and notifications.

iOS & Android apps
Push notifications
Touch-optimized interface
Offline data access
Biometric authentication
Widget support
> Download apps

The future of infrastructure observability

See our strategic direction across AI-native observability, full-stack signals, operational intelligence, and enterprise platform maturity.

AI-native observability
Full-stack signal coverage
Operational intelligence
Enterprise platform maturity
Agent releases every 6 weeks
Cloud continuous delivery
> Explore Product Roadmap

Best energy efficiency

True real-time per-second

100% automated zero config

Centralized observability

Multi-year retention

High availability built-in

Zero maintenance

Always up-to-date

Enterprise security

Complete data control

Air-gap ready

Compliance certified

Millisecond responsiveness

Infinite zoom & pan

Works on any device

Native performance

Instant alerts

Monitor anywhere

AI-native observability

Continuous delivery

Open source foundation

80% Faster Incident Resolution

AI-powered troubleshooting from detection, to root cause and blast radius identification, to reporting.

True Real-Time and Simple, even at Scale

Linearly and infinitely scalable full-stack observability, that can be deployed even mid-crisis.

90% Cost Reduction, Full Fidelity

Instead of centralizing the data, Netdata distributes the code, eliminating pipelines and complexity.

See and Map Your Entire Network

Live topology, flow analytics, and SNMP device and trap monitoring — unified with your full-stack observability.

Control Without Surrender

SOC 2 Type 2 certified with every metric kept on your infrastructure.

Integrations

800+ collectors and notification channels, auto-discovered and ready out of the box.

800+ data collectors
Auto-discovery & zero config
Cloud, infra, app protocols
Notifications out of the box
> Explore integrations
Real Results
46% Cost Reduction

Reduced monitoring costs by 46% while cutting staff overhead by 67%.

— Leonardo Antunez, Codyas

Zero Pipeline

No data shipping. No central storage costs. Query at the edge.

From Our Users
"Out-of-the-Box"

So many out-of-the-box features! I mostly don't have to develop anything.

— Simon Beginn, LANCOM Systems

No Query Language

Point-and-click troubleshooting. No PromQL, no LogQL, no learning curve.

Enterprise Ready
67% Less Staff, 46% Cost Cut

Enterprise efficiency without enterprise complexity—real ROI from day one.

— Leonardo Antunez, Codyas

SOC 2 Type 2 Certified

Zero data egress. Only metadata reaches the cloud. Your metrics stay on your infrastructure.

Full Coverage
800+ Collectors

Auto-discovered and configured. No manual setup required.

Any Notification Channel

Slack, PagerDuty, Teams, email, webhooks—all built-in.

Built for the People Who Get Paged

Because 3am alerts deserve instant answers, not hour-long hunts.

Every Industry Has Rules. We Master Them.

See how healthcare, finance, and government teams cut monitoring costs 90% while staying audit-ready.

Monitor Any Technology. Configure Nothing.

Install the agent. It already knows your stack.
From Our Users
"A Rare Unicorn"

Netdata gives more than you invest in it. A rare unicorn that obeys the Pareto rule.

— Eduard Porquet Mateu, TMB Barcelona

99% Downtime Reduction

Reduced website downtime by 99% and cloud bill by 30% using Netdata alerts.

— Falkland Islands Government

Real Savings
30% Cloud Cost Reduction

Optimized resource allocation based on Netdata alerts cut cloud spending by 30%.

— Falkland Islands Government

46% Cost Cut

Reduced monitoring staff by 67% while cutting operational costs by 46%.

— Codyas

Real Coverage
"Plugin for Everything"

Netdata has agent capacity or a plugin for everything, including Windows and Kubernetes.

— Eduard Porquet Mateu, TMB Barcelona

"Out-of-the-Box"

So many out-of-the-box features! I mostly don't have to develop anything.

— Simon Beginn, LANCOM Systems

Real Speed
Troubleshooting in 30 Seconds

From 2-3 minutes to 30 seconds—instant visibility into any node issue.

— Matthew Artist, Nodecraft

20% Downtime Reduction

20% less downtime and 40% budget optimization from out-of-the-box monitoring.

— Simon Beginn, LANCOM Systems

Pay per Node. Unlimited Everything Else.

One price per node. Unlimited metrics, logs, users, and retention. No per-GB surprises.

Free tier—forever
No metric limits or caps
Retention you control
Cancel anytime
> See pricing plans

What's Your Monitoring Really Costing You?

Most teams overpay by 40-60%. Let's find out why.

Expose hidden metric charges
Calculate tool consolidation
Customers report 30-67% savings
Results in under 60 seconds
> See what you're really paying

Your Infrastructure Is Unique. Let's Talk.

Because monitoring 10 nodes is different from monitoring 10,000.

On-prem & air-gapped deployment
Volume pricing & agreements
Architecture review for your scale
Compliance & security support
> Start a conversation

Monitoring That Sells Itself

Deploy in minutes. Impress clients in hours. Earn recurring revenue for years.

30-second live demos close deals
Zero config = zero support burden
Competitive margins & deal protection
Response in 48 hours
> Apply to partner

Per-Second Metrics at Homelab Prices

Same engine, same dashboards, same ML. Just priced for tinkerers.

Community: Free forever · 5 nodes · non-commercial
Homelab: $90/yr · unlimited nodes · fair usage
> Get the Homelab Plan

$1,000 Per Referral. Unlimited Referrals.

Your colleagues get 10% off. You get 10% commission. Everyone wins.

10% of subscriptions, up to $1,000 each
Track earnings inside Netdata Cloud
PayPal/Venmo payouts in 3-4 weeks
No caps, no complexity
> Get your referral link
Cost Proof
40% Budget Optimization

"Netdata's significant positive impact" — LANCOM Systems

Calculate Your Savings

Compare vs Datadog, Grafana, Dynatrace

Savings Proof
46% Cost Reduction

"Cut costs by 46%, staff by 67%" — Codyas

30% Cloud Bill Savings

"Reduced cloud bill by 30%" — Falkland Islands Gov

Enterprise Proof
"Better Than Combined Alternatives"

"Better observability with Netdata than combining other tools." — TMB Barcelona

Real Engineers, <24h Response

DPA, SLAs, on-prem, volume pricing

Why Partners Win
Demo Live Infrastructure

One command, 30 seconds, real data—no sandbox needed

Zero Tickets, High Margins

Auto-config + per-node pricing = predictable profit

Homelab Ready
Free Video Course

8-episode Netdata tutorial by LearnLinux.tv

76k+ GitHub Stars

3rd most starred monitoring project

Worth Recommending
Product That Delivers

Customers report 40-67% cost cuts, 99% downtime reduction

Zero Risk to Your Rep

Free tier lets them try before they buy

AI Support Assistant, Available 24/7

Nedi has access to all official documentation, source code, and resources. Ask any question about Netdata—responds in your language.

Deployment & configuration
Troubleshooting & sizing
Alerts & notifications
Evidence-based answers
> Ask Nedi now

Never Fight Fires Alone

Docs, community, and expert help—pick your path to resolution.

Learn.netdata.cloud docs
Discord, Forums, GitHub
Premium support available
> Get answers now

60 Seconds to First Dashboard

One command to install. Zero config. 850+ integrations documented.

Linux, Windows, K8s, Docker
Auto-discovers your stack
> Read our documentation

76,000+ Engineers Strong

615+ contributors. 1.5M daily downloads. One mission: simplify observability.

Per-Second. 90% Cheaper. Data Stays Home.

Side-by-side comparisons: costs, real-time granularity, and data sovereignty for every major tool.

See why teams switch from Datadog, Prometheus, Grafana, and more.

> Browse all comparisons
Edge-Native Observability, Born Open Source
Per-second visibility, ML on every metric, and data that never leaves your infrastructure.
Founded in 2016
615+ contributors worldwide
Remote-first, engineering-driven
Open source first
> Read our story
Promises We Publish—and Prove
12 principles backed by open code, independent validation, and measurable outcomes.
Open source, peer-reviewed
Zero config, instant value
Data sovereignty by design
Aligned pricing, no surprises
> See all 12 principles
Edge-Native, AI-Ready, 100% Open
76k+ stars. Full ML, AI, and automation—GPLv3+, not premium add-ons.
76,000+ GitHub stars
GPLv3+ licensed forever
ML on every metric, included
Zero vendor lock-in
> Explore our open source
Build Real-Time Observability for the World
Remote-first team shipping per-second monitoring with ML on every metric.
Remote-first, fully distributed
Open source (76k+ stars)
Challenging technical problems
Your code on millions of systems
> See open roles
Meet the Team Behind Netdata
Conferences, meetups, and tradeshows where you can see Netdata in action and talk to the engineers who build it.
Live demos and deep dives
Book 1-on-1 meetings
Talks and panel sessions
Event recaps and photos
> See all events
Talk to a Netdata Human in <24 Hours
Sales, partnerships, press, or professional services—real engineers, fast answers.
Discuss your observability needs
Pricing and volume discounts
Partnership opportunities
Media and press inquiries
> Book a conversation
Your Data. Your Rules.
On-prem data, cloud control plane, transparent terms.
Trust & Scale
76,000+ GitHub Stars

One of the most popular open-source monitoring projects

SOC 2 Type 2 Certified

Enterprise-grade security and compliance

Data Sovereignty

Your metrics stay on your infrastructure

Validated
University of Amsterdam

"Most energy-efficient monitoring solution" — ICSOC 2023, peer-reviewed

ADASTEC (Autonomous Driving)

"Doesn't miss alerts—mission-critical trust for safety software"

Community Stats
615+ Contributors

Global community improving monitoring for everyone

1.5M+ Downloads/Day

Trusted by teams worldwide

GPLv3+ Licensed

Free forever, fully open source agent

Why Join?
Remote-First

Work from anywhere, async-friendly culture

Impact at Scale

Your work helps millions of systems

$ guides / vmware-vsphere / vmware-vsphere-cpu-co-stop-high

Operations Guides

vSphere CPU co-stop high (%CSTP): the SMP vCPU co-scheduling penalty

%CSTP in esxtop is the time a vCPU in a multi-vCPU VM sits halted because the ESXi scheduler is waiting to co-schedule the VM’s other vCPUs. In a healthy environment it is essentially zero. Sustained above a few percent on modern ESXi means a sizing or topology problem, not a performance problem you can tune away.

The classic shape: you give a database 16 vCPUs and it gets slower. The guest OS reports low CPU utilization because the vCPUs are not doing work. They are parked in COSTOP waiting for their siblings. From inside the VM this is invisible. The application runs slowly while the OS reports idle capacity.

What this means

The ESXi CPU scheduler co-schedules multi-vCPU VMs to keep the SMP group coherent: vCPUs the guest kernel assumes are progressing together must not run far out of step. The scheduler tracks per-vCPU skew and deliberately parks leading vCPUs so slower siblings catch up. This is relaxed co-scheduling, and it significantly reduces co-stop compared with older strict scheduling.

%CSTP is the time charged to that deliberate hold. The four VM runtime states account for 100% of VM time:

%RUN + %RDY + %CSTP + %WAIT = 100%

When %CSTP is non-trivial, some vCPUs are runnable but the scheduler is parking them to keep the SMP group coherent. That time is neither work nor idle. It is coordination overhead, and the guest cannot see it.

Important properties:

  • Only meaningful for VMs with 2 or more vCPUs. A single-vCPU VM always shows 0% because it has no siblings to wait for.
  • Should be near zero in healthy environments. Sustained above 3% on modern ESXi is a strong signal that the VM has more vCPUs than the scheduler can efficiently co-schedule. Above 1% is worth investigating.
  • Relaxed co-scheduling already suppresses this counter almost entirely. Any visible co-stop is more severe than it looks.

The counter is the smoking gun behind oversized SMP VMs, but it is easy to misread. The vCenter chart value is a summation in milliseconds, not a percentage. Convert it the same way you convert CPU ready time: divide by both the sample interval and the vCPU count to get a per-vCPU percentage.

flowchart TD
  A["Multi-vCPU VM
N runnable vCPUs"] --> B["Scheduler seeks
N simultaneously-free pCPUs"] B --> C{"Co-scheduling
feasible?"} C -->|"Yes"| D["vCPUs run together
%RUN accrues"] C -->|"Some vCPUs blocked
or NUMA-bound"| E["Leading vCPUs parked
to limit skew"] E --> F["%CSTP accrues
VM time lost to coordination"] F --> G["Guest sees low CPU%
but app runs slowly"]

Common causes

CauseWhat it looks likeFirst thing to check
vCPU oversizingHost CPU at 60-80% (not maxed), but one or two large VMs have elevated %CSTP and %RDY. In-guest CPU% is well below provisioned vCPUs.Compare in-guest CPU utilization against the vCPU count. If a 16-vCPU VM peaks at 25% guest CPU, it does not need 16 vCPUs.
Host CPU contentionAll multi-vCPU VMs on the host show elevated %CSTP and %RDY. Host %USED is above 85%.Check host CPU utilization. Co-stop here is a symptom, not the root cause.
NUMA straddling (“wide VM”)%CSTP elevated on a VM whose vCPU count exceeds the cores in a single NUMA node. NUMA locality below 80%.Check NUMA home node locality. The VM is spanning nodes and the scheduler must coordinate across NUMA domains.
Snapshot-induced co-stop%CSTP spikes correlate with active snapshots or backup windows. Datastore latency also elevated.Check snapshot age and chain depth, and DAVG/KAVG on the affected datastore.
SCA v1 scheduler modeElevated %CSTP cluster-wide on hosts where hyperthreading was disabled or restricted for side-channel mitigation.Check the scheduler mode. SCA v1 reduces available scheduling slots.

Quick checks

These are all read-only and safe to run during normal operation.

# Check %CSTP per multi-vCPU VM (interactive esxtop on the host)
esxtop
#   press 'c' for CPU view
#   press 'V' to filter to VM worlds only
#   look at the %CSTP column per VM world

# Pull co-stop from vCenter (realtime, 20s samples) via PowerCLI
Get-Stat -Entity (Get-VM "myvm") -Stat cpu.costop.summation -Realtime -MaxSamples 6
# Convert: value_ms / (20000 * vCPU_count) * 100 = %CSTP per vCPU

# Pull CPU ready alongside, since %RDY and %CSTP almost always move together
Get-Stat -Entity (Get-VM "myvm") -Stat cpu.ready.summation -Realtime -MaxSamples 6

# Rule out a CPU limit: if %MLMTD is high and %RDY is low, a limit is the real cause
# esxtop -> 'c' -> %MLMTD column per VM

# Check host CPU pressure from vCenter
Get-VMHost | Select Name, @{N='CpuPct';E={[math]::Round($_.Summary.QuickStats.OverallCpuUsage / ($_.Summary.Hardware.CpuMhz * $_.Summary.Hardware.NumCpuCores) * 100, 2)}}

# Check NUMA locality per VM (esxtop)
#   press 'm'
#   press 'f' to enable NUMA stats
#   look at N%L per VM (should be >90% for properly sized VMs)

# Check for snapshots that may be inducing co-stop via storage I/O
Get-VM | Get-Snapshot | Select VM, Name, Created, SizeGB

How to diagnose it

  1. Confirm the VM has 2 or more vCPUs. %CSTP is meaningless for single-vCPU VMs. Non-zero co-stop on a 1-vCPU VM means you are reading the wrong row in esxtop.

  2. Convert the vCenter chart value to a percentage. The raw cpu.costop.summation counter is in milliseconds accumulated over the sample interval. Apply the ready-time formula: (value_ms / (interval_ms * num_vCPUs)) * 100. A value of 300 in a 20-second realtime interval on a 4-vCPU VM is 300 / (20000 * 4) * 100 = 0.375%, not 300%.

  3. Look at host CPU utilization alongside %CSTP. This single correlation splits the diagnosis:

    • High %CSTP and host CPU above 85%: genuine host contention. The VM is collateral damage from a saturated host.
    • High %CSTP and host CPU in the 60-80% band: vCPU oversizing or NUMA misalignment. The host is not the bottleneck; the scheduler’s coordination overhead is.
    • High %CSTP and host CPU below 60%: almost certainly oversizing. The VM has more vCPUs than the workload can use.
  4. Check in-guest CPU utilization. The key comparison: how many vCPUs does the guest actually use at peak? An 8-vCPU VM that peaks at 25% in-guest CPU is consuming roughly 2 vCPUs of work. It does not need 8.

  5. Check NUMA locality. If the VM’s vCPU count exceeds the number of cores in one physical NUMA node, it is a “wide VM” by definition and the scheduler must coordinate across NUMA domains. Locality below 80% confirms cross-node traffic is amplifying the penalty.

  6. Check %MLMTD to rule out a CPU limit. A limit-constrained VM can show elevated co-stop because the scheduler hits the limit and then has to re-co-schedule the group. The fix is different: remove the limit, not the vCPU.

  7. Check for active snapshots and datastore latency if the spike correlates with a backup window or recent snapshot creation. Snapshot delta I/O can stall vCPUs in a way that shows up as elevated co-stop on I/O-heavy workloads.

  8. Check %RDY at the same time. Ready and co-stop usually move together on oversized SMP VMs, but their ratio tells you which mechanism dominates. High ready with low co-stop points to host contention or placement-layer oversizing. High co-stop with moderate ready points to SMP co-scheduling specifically.

Metrics and signals to monitor

SignalWhy it mattersWarning sign
cpu.costop.summation / %CSTP per VMThe SMP coordination tax. Definitive signal that the VM has more vCPUs than the scheduler can efficiently co-schedule.Sustained >3% on a 2+ vCPU VM.
cpu.ready.summation / %RDY per VMTime the VM was runnable but no pCPU was free. Moves with co-stop on oversized VMs.Sustained >5% indicates real contention.
cpu.maxlimited.summation / %MLMTD per VMTime the VM was runnable but a CPU limit stopped it. Misdiagnosed as ready or co-stop if unchecked.Any sustained non-zero value where the VM is slow.
Host CPU utilizationSplits the diagnosis between host contention and per-VM oversizing.Above 85% sustained with VM-level co-stop is host-bound.
NUMA home node localityCross-NUMA traffic amplifies co-stop for wide VMs.Locality below 80% on a latency-sensitive workload.
vCPU count vs cores-per-NUMA-nodeA VM sized larger than a NUMA node is wide by definition.Any VM with vCPUs > physical cores in one NUMA node.
Snapshot age and chain depthSnapshot I/O can induce co-stop during backup windows.Snapshot older than 72 hours, or chain deeper than 3.
Datastore latency (DAVG, KAVG, GAVG)Storage latency can masquerade as co-stop on I/O-heavy workloads.DAVG above 10ms on all-flash, KAVG above 2ms.

Fixes

Right-size the vCPU count

The most common fix: remove vCPUs. Reduce the VM’s vCPU count to match actual in-guest utilization. If a 16-vCPU database peaks at 25% guest CPU, drop it to 4 or 6 vCPUs. This requires a VM power cycle, so plan a maintenance window.

More vCPUs is more scheduling liability. The scheduler must find that many simultaneously-free pCPUs to make progress, and on a moderately-loaded host that is harder, not easier. Removing vCPUs reduces the co-scheduling problem and frequently makes the VM faster.

Fix NUMA alignment

If the VM is a wide VM (vCPUs exceed cores per NUMA node), either reduce vCPUs to fit inside a single node or accept the cross-node penalty and size accordingly. Size the vCPU count so the VM splits evenly across the smallest possible number of NUMA nodes. Odd vCPU counts that cross NUMA boundaries are the worst case.

Also verify the guest sees a sensible vNUMA topology. Cores-per-socket affects guest OS topology and licensing; a nonsensical cores-per-socket value can confuse the guest’s own scheduler even when ESXi placement is correct.

Reduce host contention

If host CPU is the bottleneck, the VM is collateral damage. Options, in order of preference:

  • vMotion the oversized VM to a less-loaded host with sufficient free pCPUs in a single NUMA node.
  • vMotion other VMs off the host to give the oversized VM more scheduling room.
  • Add compute capacity (more hosts, more cores per host).
  • Review whether DRS is actually balancing, or is constrained by affinity rules.

Do not try to fix host contention by adding vCPUs to the affected VM. That makes the co-scheduling problem worse.

Remove the CPU limit

If %MLMTD is non-zero, there is a CPU limit on the VM, a resource pool, or inherited from a template. Limits look identical to contention from inside the guest. Remove the limit (set to Unlimited / -1 in the API) and re-measure before concluding that co-stop is the problem.

Consolidate snapshots

If the co-stop spike correlates with active snapshots or a backup window, consolidate the snapshots during a maintenance window. Snapshot consolidation is I/O-intensive and stuns the VM briefly. Then review the backup job to confirm it is cleaning up its own snapshots.

Prevention

  • Right-size at provisioning time. Default templates with 8 or 16 vCPUs are the most common source of preventable co-stop. Start small and grow based on observed in-guest utilization, not application vendor recommendations that assume dedicated hardware.
  • Know the cores-per-NUMA-node on your hosts. Treat any VM sized above that as a wide VM requiring extra scrutiny.
  • Monitor %CSTP and %RDY together for every multi-vCPU VM. Ready without co-stop means one problem; co-stop without ready means another.
  • Audit for forgotten CPU limits. They survive template clones, resource pool moves, and operator turnover.

How Netdata helps

Netdata’s per-second collection shortens the window between “the database got slow” and “the host cannot co-schedule it” from hours of esxtop watching to a few correlated charts:

  • Per-VM cpu.ready.summation and cpu.costop.summation side by side, so the ratio between ready and co-stop is visible without manual conversion.
  • Host CPU utilization correlated against per-VM co-stop, which splits the diagnosis between host contention and per-VM oversizing immediately.
  • NUMA home node locality alongside vCPU count, so wide VMs are obvious rather than discovered during a performance investigation.
  • cpu.maxlimited.summation tracked alongside ready and co-stop, so forgotten CPU limits cannot hide behind scheduling metrics.
  • Snapshot age and datastore latency charts, so storage-induced co-stop during backup windows is visible in the same view as the CPU signals.

The co-stop value itself is most reliably read from esxtop on the host. Netdata’s value here is correlation: when you see elevated co-stop on a multi-vCPU VM, the adjacent signals that distinguish oversizing, NUMA issues, contention, a limit, or a snapshot are already in the same dashboard.

The Netdata solution

VMware vSphere monitoring with Netdata

Netdata auto-discovers vCenter, ESXi hosts, VMs, and datastores through the vSphere API and collects them per second with ML-powered anomaly detection. Correlate CPU ready and co-stop, ballooning and host swap, datastore latency, and snapshot growth against the host and guest signals behind them, so you catch the incidents in these runbooks before they page anyone.