skills

Use when migrating alerting rules from VictoriaMetrics (vmalert), Prometheus, Thanos Ruler, or Mimir/Cortex to Netdata health alerts. These tools share the same Prometheus alerting-rule YAML and PromQL/MetricsQL, so the method is identical. Covers the stock-first decision (Netdata already ships alerts for most common signals), the translation methodology from PromQL expressions to Netdata lookup/calc/warn/crit on a chart context, the constructs that do not map cleanly (cross-metric joins, predict_linear, histogram_quantile, fleet aggregations, absent), notification-routing parity with Alertmanager (agent roles and Netdata Cloud), and automatic verification over MCP. Pairs with netdata-mcp-integration to connect and netdata-custom-collector when a rule alerts on a metric Netdata does not yet collect.

Use when you need Netdata to collect metrics from something it does not already monitor, such as a custom application, an internal service, the output of a script or CLI tool, or a device. Covers the decision tree from the built-in StatsD server (zero collector code) through writing a collector in any language via the external-plugin line protocol (CHART/DIMENSION/BEGIN/SET/END on stdout), or the legacy python.d and charts.d module frameworks. Teaches how to pick the cheapest approach that works, scaffold it from a real example, and, when a Netdata MCP server is connected, automatically verify over MCP that the metrics are collected in the right format without user handholding.

Use when building or modifying an OpenTelemetry Collector pipeline that forwards telemetry to Netdata. Covers receivers, processors, exporters, and three deployment patterns (DaemonSet, gateway, and OpenTelemetry Operator). Teaches how to shape chart dimensions via an OTLP attribute plus a mapping file, since Netdata does not expose producer-driven annotations for chart layout.

Use when a customer or prospect has sent a written requirements document, architecture brief, or RFP and the deliverable is a config bundle (Netdata otel.yaml, OpenTelemetry Collector pipelines, per-language instrumentation handoff, verification playbook) that the customer applies themselves. Unlike netdata-instrumentation and netdata-otel-setup, this skill operates without access to the customer's codebase or running infrastructure: inputs are prose, outputs are YAML files, Markdown runbooks, and an explicit list of open questions for the account team. Covers requirements extraction, ambiguity flagging, bundle layout, and composition with netdata-otel-setup, netdata-collector-config, netdata-instrumentation, and netdata-migration.

Use when adding OpenTelemetry instrumentation to application code that will report to Netdata. Covers SDK setup, resource attributes, auto-instrumentation, and patterns for Node.js, Python, Java, Go, .NET, Ruby, and PHP. Emits metrics and logs via OTLP gRPC to Netdata. Traces are not yet supported by Netdata; use an alternative trace backend until Q2 2026.

Use when an AI coding agent needs to connect to a Netdata Agent, Parent, or Netdata Cloud via MCP to verify telemetry, query live metrics, cross-reference instrumentation with infrastructure signals, or troubleshoot services. Covers Claude Code, Cursor, Codex, and Gemini CLI client configs for both local (http://HOST:19999/mcp) and Netdata Cloud endpoints.

Use when migrating observability from Datadog, New Relic, Dynatrace, or Prometheus to Netdata. Covers SDK replacement, exporter reconfiguration, Prometheus endpoint passthrough, and dashboard parity expectations.

Use when enabling the Netdata otel.plugin, writing /etc/netdata/otel.yaml, defining metric-to-chart mappings, configuring TLS on the OTLP receiver, or debugging OTLP ingestion issues with Netdata. Covers OTLP gRPC ingestion for metrics (v2.7.0+) and logs (v2.9.0+). Traces are not yet supported.

Use when diagnosing issues with Apache ActiveMQ Classic 5.x: memory pressure cascade, store exhaustion spiral, gc pause death spiral, poison message / dlq storm, or connection/thread exhaustion. Queries Netdata via MCP for Apache ActiveMQ Classic 5.x health signals, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with Apache HTTPD: worker exhaustion, memory exhaustion, listen queue overflow, slow backend cascade, or log disk full / pipe stall. Queries Netdata via MCP for process presence, critical-path reachability, requests per second, bytes served per second, request processing duration, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with Apache Pulsar: availability, latency, saturation & resource utilization, or backlog & consumer health degradation. Queries Netdata via MCP for broker process health, bookie process health, bookie journal sync latency, metadata store request latency, bookie add entry in-progress count, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with BIND DNS: recursive client exhaustion, cache pressure spiral, upstream dependency failure, udp packet drops, or zone staleness cascade. Queries Netdata via MCP for BIND DNS health signals, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with Apache Cassandra: gc death spiral, compaction death spiral, tombstone storm, disk space exhaustion, or hint overflow. Queries Netdata via MCP for node liveness (failure detector), native transport active, client request rate (read/write), client request latency (coordinator), applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with Ceph: capacity exhaustion, stuck pgs, slow requests, mon quorum loss, or osd flapping. Queries Netdata via MCP for Ceph health signals, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with ClickHouse: merge debt spiral, memory exhaustion, replication lag cascade, zookeeper/keeper saturation, or disk space collapse. Queries Netdata via MCP for server process liveness, replicated table read/write availability, active part count per table, merge activity and progress, insert delays and rejections, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with Cockroachdb: lsm compaction death spiral, raft liveness failure, clock skew crisis, hot range, or intent accumulation. Queries Netdata via MCP for Cockroachdb health signals, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with Consul: leader instability, gossip partition / flapping, catalog bloat / memory exhaustion, blocking query accumulation, or certificate/ca failures. Queries Netdata via MCP for Consul health signals, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with CoreDNS: upstream black hole, cache collapse (thundering herd), kubernetes api disconnect, memory blowout, or forwarding loop. Queries Netdata via MCP for CoreDNS health signals, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with Docker Engine: Docker Engine operational issues. Queries Netdata via MCP for Docker Engine health signals, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with Docker: disk exhaustion, oom cascade, daemon hang/lockup, log explosion, or network isolation failure. Queries Netdata via MCP for Docker health signals, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with Elasticsearch: heap pressure death spiral, shard overallocation, disk watermark cascade, mapping explosion, or merge storms. Queries Netdata via MCP for Elasticsearch health signals, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with Envoy: connection pool exhaustion cascade, memory pressure spiral, xds control plane disconnect, retry amplification, or stats cardinality explosion. Queries Netdata via MCP for server state, upstream host health, upstream request rate, downstream request rate, upstream request duration, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with Fluentd: buffer saturation (backpressure), retry storm, memory bloat / oom, poison pill crash loop, or silent data loss. Queries Netdata via MCP for fluentd process alive, monitor agent api responsiveness, input emit records rate, output emit records rate, cumulative flush time, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with HAProxy: connection saturation, backend collapse, tls resource exhaustion, buffer starvation, or reload storms. Queries Netdata via MCP for process liveness, backend server health status, frontend session rate, http request rate, queue time (qtime), applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with Kafka: "the isr shrinks", "the partition goes leaderless", "the consumer falls behind", "the controller is overwhelmed", or "the broker runs out of disk". Queries Netdata via MCP for Kafka health signals, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with Kubernetes API Server: the webhook stall, the list storm, the etcd latency cascade, the memory cliff, or the rbac/auth slow bleed. Queries Netdata via MCP for Kubernetes API Server health signals, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with Kubernetes Cluster State: control plane unavailable, control plane slow, reconciliation stall, node failures, or admission blockage. Queries Netdata via MCP for api server health, etcd leader existence, api server request latency (p99), etcd wal fsync latency, etcd leader changes, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with Kubernetes Kube Proxy: "stale rules / zombie watch", "conntrack table full", "sync loop storm", "iptables lock starvation", or "silent conntrack leak". Queries Netdata via MCP for Kubernetes Kube Proxy health signals, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with Kubernetes Kubelet: pleg stall, resource pressure cascade, api server disconnection, volume mount stuck, or silent new-pod outage. Queries Netdata via MCP for Kubernetes Kubelet health signals, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with Logstash: Logstash operational issues. Queries Netdata via MCP for Logstash health signals, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with LVM (Linux Logical Volume Manager): space exhaustion, device loss, silent redundancy loss, metadata corruption, or snapshot collapse. Queries Netdata via MCP for physical volume accessibility, lv activation state, volume group free space, thin pool data usage, mirror/raid synchronization status, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with Memcached: availability, throughput, hit rate & efficiency, or connections degradation. Queries Netdata via MCP for process liveness, unexpected restart (uptime reset), command rates (cmd_get, cmd_set, cmd_touch), flush all events (cmd_flush), cache hit ratio, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with Microsoft SQL Server: log full / disk full, memory pressure spiral, worker thread exhaustion, tempdb contention, or blocking cascade. Queries Netdata via MCP for Microsoft SQL Server health signals, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with MongoDB: cache pressure cascade, oplog window collapse, connection storm spiral, checkpoint stall write freeze, or silent index regression. Queries Netdata via MCP for MongoDB health signals, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with MySQL: redo log stall, connection exhaustion, purge lag explosion, metadata lock cascade, or replication lag spiral. Queries Netdata via MCP for mysql server availability, connection utilization, query throughput (questions), slow query rate, active execution queue (threads_running), applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with NATS: slow consumer cascade, file descriptor exhaustion, jetstream raft instability, memory pressure / oom, or silent message loss (core nats). Queries Netdata via MCP for NATS health signals, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with nginx: connection exhaustion, file descriptor exhaustion, backend cascade failure, buffer spill to disk, or ssl cpu saturation. Queries Netdata via MCP for worker process count, stub status endpoint availability, requests per second, active connections, request processing time, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with NVIDIA DCGM: hbm degradation, thermal runaway/throttling, nvlink errors, gpu hang (xid 13/31/43/79), or silent performance degradation. Queries Netdata via MCP for NVIDIA DCGM health signals, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with Nvidia Gpu: memory exhaustion (oom), thermal runaway then throttling cascade, silent hardware degradation, interconnect degradation (straggler), or gpu hang / fallen off bus. Queries Netdata via MCP for gpu reachability (driver communication), management path latency / driver health, gpu die temperature, hbm memory temperature, framebuffer memory utilization (vram), applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.

Use when diagnosing issues with NVMe: availability, health & critical warnings, errors, or endurance & wear degradation. Queries Netdata via MCP for controller state, smart critical warning; read-only mode (bit 3), smart critical warning; nvm subsystem reliability degraded (bit 2), media and data integrity errors, error log entries, applies the diagnostic tree from the Netdata operator playbook, and recommends remediation.