458c73637 · cryptotaxi247/netdata-1

@@ -1,62 +1,58 @@

1 # Collectors

2

3 -When Netdata starts, and with zero configuration, it auto-detects thousands of data sources and immediately collects

4 -per-second metrics.

3 +Netdata automatically collects per-second metrics from thousands of data sources without any configuration:

4

6 -Netdata can immediately collect metrics from these endpoints thanks to 300+ **collectors**, which all come pre-installed

7 -when you [install Netdata](/packaging/installer/README.md).

5 +- **Zero-touch setup**: All collectors are pre-installed, allowing you to start collecting detailed metrics right after Netdata starts.

6 +- **Universal Monitoring**: Monitor virtually anything with Netdata's extensive collector library.

7

9 -All collectors are **installed by default** with every installation of Netdata. You do not need to install

10 -collectors manually to collect metrics from new sources.

11 -See how you can [monitor anything with Netdata](/src/collectors/COLLECTORS.md).

8 +If you don't see charts for your application, check our collectors' [configuration reference](/src/collectors/REFERENCE.md) to ensure both the collector and your application are properly configured.

9

13 -Upon startup, Netdata will **auto-detect** any application or service that has a collector, as long as both the collector

14 -and the app/service are configured correctly. If you don't see charts for your application, see

15 -our [collectors' configuration reference](/src/collectors/REFERENCE.md).

10 +## Collector Types

11

17 -## How Netdata's metrics collectors work

12 +Netdata's collectors are specialized data collection plugins that gather metrics from various sources. They are divided into two main categories:

13

19 -Every collector has two primary jobs:

14 +| Type | Description | Key Features |

15 +|----------|-----------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

16 +| Internal | Native collectors that gather system-level metrics | • Written in `C` for optimal performance • Run as threads within Netdata daemon • Zero external dependencies • Minimal system overhead |

17 +| External | Modular collectors that gather metrics from applications and services | • Support multiple programming languages • Run as independent processes • Communicate via pipes with Netdata • Managed by [plugins.d](/src/plugins.d/README.md) • Examples: MySQL, Nginx, Redis collectors |

18

21 -- Look for exposed metrics at a pre- or user-defined endpoint.

22 -- Gather exposed metrics and use additional logic to build meaningful, interactive visualizations.

19

24 -If the collector finds compatible metrics exposed on the configured endpoint, it begins a per-second collection job. The

25 -Netdata Agent gathers these metrics, sends them to the

26 -[database engine for storage](/docs/netdata-agent/configuration/optimizing-metrics-database/change-metrics-storage.md)

27 -, and immediately

28 -[visualizes them meaningfully](/docs/dashboards-and-charts/netdata-charts.md)

29 -on dashboards.

20 +## Collector Privileges

21

31 -Each collector comes with a pre-defined configuration that matches the default setup for that application. This endpoint

32 -can be a URL and port, a socket, a file, a web page, and more. The endpoint is user-configurable, as are many other

33 -specifics of what a given collector does.

22 +Netdata uses various plugins and helper binaries that require elevated privileges to collect system metrics.

23 +This section outlines the required privileges and how they are configured in different environments.

24

35 -## Collector architecture and terminology

25 +### Privileges

26

37 -- **Collectors** are the processes/programs that actually gather metrics from various sources.

27 +| Plugin/Binary | Privileges (Linux) | Privileges (Non-Linux or Containerized Environment) |

28 +|------------------------|-------------------------------------------------|-----------------------------------------------------|

29 +| apps.plugin | CAP_DAC_READ_SEARCH, CAP_SYS_PTRACE | setuid root |

30 +| debugfs.plugin | CAP_DAC_READ_SEARCH | setuid root |

31 +| systemd-journal.plugin | CAP_DAC_READ_SEARCH | setuid root |

32 +| perf.plugin | CAP_PERFMON | setuid root |

33 +| slabinfo.plugin | CAP_DAC_READ_SEARCH | setuid root |

34 +| go.d.plugin | CAP_DAC_READ_SEARCH, CAP_NET_ADMIN, CAP_NET_RAW | setuid root |

35 +| freeipmi.plugin | setuid root | setuid root |

36 +| nfacct.plugin | setuid root | setuid root |

37 +| xenstat.plugin | setuid root | setuid root |

38 +| ioping | setuid root | setuid root |

39 +| ebpf.plugin | setuid root | setuid root |

40 +| cgroup-network | setuid root | setuid root |

41 +| local-listeners | setuid root | setuid root |

42 +| network-viewer.plugin | setuid root | setuid root |

43 +| ndsudo | setuid root | setuid root |

44

39 -- **Plugins** help manage all the independent data collection processes in a variety of programming languages, based on

40 - their purpose and performance requirements. There are three types of plugins:

45 +**About ndsudo**:

46

42 - - **Internal** plugins organize collectors that gather metrics from `/proc`, `/sys` and other Linux kernel sources.

43 - They are written in `C`, and run as threads within the Netdata daemon.

47 +`ndsudo` is a purpose-built privilege escalation utility for Netdata that executes a predefined set of commands with root privileges. Unlike traditional `sudo`, it operates with a [hard-coded list of allowed commands](https://github.com/netdata/netdata/blob/master/src/collectors/utils/ndsudo.c), providing better security through reduced scope and eliminating the need for `sudo` configuration.

48

45 - - **External** plugins organize collectors that gather metrics from external processes, such as a MySQL database or

46 - Nginx web server. They can be written in any language, and the `netdata` daemon spawns them as long-running

47 - independent processes. They communicate with the daemon via pipes. All external plugins are managed by

48 - [plugins.d](/src/plugins.d/README.md), which provides additional management options.

49 +It’s used by the `go.d.plugin` to collect data by executing certain binaries that require root access.

50

50 -- **Orchestrators** are external plugins that run and manage one or more modules. They run as independent processes.

51 - The Go orchestrator is in active development.

51 +### File Permissions and Ownership

52

53 - - [go.d.plugin](/src/go/plugin/go.d/README.md): An orchestrator for data

54 - collection modules written in `go`.

53 +To ensure security, all plugin and helper binary files have the following permissions and ownership:

54

56 - - [python.d.plugin](/src/collectors/python.d.plugin/README.md):

57 - An orchestrator for data collection modules written in `python` v2/v3.

55 +- **Ownership**: `root:netdata`.

56 +- **Permissions**: `0750` (for non-setuid binaries) or `4750` (for setuid binaries).

57

59 - - [charts.d.plugin](/src/collectors/charts.d.plugin/README.md):

60 - An orchestrator for data collection modules written in`bash` v4+.

61 -

62 -- **Modules** are the individual programs controlled by an orchestrator to collect data from a specific application, or type of endpoint.

58 +This configuration limits access to the files to the `netdata` user and the `root` user, while allowing execution by the `netdata` user.

docs: add "Plugin Privileges" section (#18946)