| 1 | # Collectors |
| 2 | |
| 3 | Netdata automatically collects per-second metrics from thousands of data sources without any configuration: |
| 4 | |
| 5 | - **Zero-touch setup**: All collectors are pre-installed, allowing you to start collecting detailed metrics right after Netdata starts. |
| 6 | - **Universal Monitoring**: Monitor virtually anything with Netdata's extensive collector library. |
| 7 | |
| 8 | If you don't see charts for your application, check our collectors' [configuration reference](/src/collectors/REFERENCE.md) to ensure both the collector and your application are properly configured. |
| 9 | |
| 10 | ## Collector Types |
| 11 | |
| 12 | Netdata's collectors are specialized data collection plugins that gather metrics from various sources. They are divided into two main categories: |
| 13 | |
| 14 | | Type | Description | Key Features | |
| 15 | |----------|-----------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| |
| 16 | | Internal | Native collectors that gather system-level metrics | • Written in `C` for optimal performance<br/>• Run as threads within Netdata daemon<br/>• Zero external dependencies<br/>• Minimal system overhead | |
| 17 | | External | Modular collectors that gather metrics from applications and services | • Support multiple programming languages<br/>• Run as independent processes<br/>• Communicate via pipes with Netdata<br/>• Managed by [plugins.d](/src/plugins.d/README.md)<br/>• Examples: MySQL, Nginx, Redis collectors | |
| 18 | |
| 19 | ## Collector Privileges |
| 20 | |
| 21 | Netdata uses various plugins and helper binaries that require elevated privileges to collect system metrics. |
| 22 | This section outlines the required privileges and how they are configured in different environments. |
| 23 | |
| 24 | ### Privileges |
| 25 | |
| 26 | | Plugin/Binary | Privileges (Linux) | Privileges (Non-Linux or Containerized Environment) | |
| 27 | |------------------------|-------------------------------------------------|-----------------------------------------------------| |
| 28 | | apps.plugin | CAP_DAC_READ_SEARCH, CAP_SYS_PTRACE | setuid root | |
| 29 | | debugfs.plugin | CAP_DAC_READ_SEARCH | setuid root | |
| 30 | | systemd-journal.plugin | CAP_DAC_READ_SEARCH | setuid root | |
| 31 | | perf.plugin | CAP_PERFMON | setuid root | |
| 32 | | slabinfo.plugin | CAP_DAC_READ_SEARCH | setuid root | |
| 33 | | go.d.plugin | CAP_DAC_READ_SEARCH, CAP_NET_ADMIN, CAP_NET_RAW | setuid root | |
| 34 | | freeipmi.plugin | setuid root | setuid root | |
| 35 | | nfacct.plugin | setuid root | setuid root | |
| 36 | | xenstat.plugin | setuid root | setuid root | |
| 37 | | ioping | setuid root | setuid root | |
| 38 | | ebpf.plugin | setuid root | setuid root | |
| 39 | | cgroup-network | setuid root | setuid root | |
| 40 | | local-listeners | setuid root | setuid root | |
| 41 | | network-viewer.plugin | setuid root | setuid root | |
| 42 | | ndsudo | setuid root | setuid root | |
| 43 | |
| 44 | **About ndsudo**: |
| 45 | |
| 46 | `ndsudo` is a purpose-built privilege escalation utility for Netdata that executes a predefined set of commands with root privileges. Unlike traditional `sudo`, it operates with a [hard-coded list of allowed commands](https://github.com/netdata/netdata/blob/master/src/collectors/utils/ndsudo.c), providing better security through reduced scope and eliminating the need for `sudo` configuration. |
| 47 | |
| 48 | It’s used by the `go.d.plugin` to collect data by executing certain binaries that require root access. |
| 49 | |
| 50 | ### File Permissions and Ownership |
| 51 | |
| 52 | To ensure security, all plugin and helper binary files have the following permissions and ownership: |
| 53 | |
| 54 | - **Ownership**: `root:netdata`. |
| 55 | - **Permissions**: `0750` (for non-setuid binaries) or `4750` (for setuid binaries). |
| 56 | |
| 57 | This configuration limits access to the files to the `netdata` user and the `root` user, while allowing execution by the `netdata` user. |