New Relic eBPF observability

Modern application stacks comprise heterogeneous, interconnected services running across mixed infrastructure environments, from Kubernetes clusters to traditional Linux hosts. This complexity creates fundamental challenges that slow down troubleshooting, such as:

• Observability gaps between application and infrastructure: Application monitoring provides deep insights into code performance, while infrastructure monitoring tracks system health. However, the network layer between these components often remains invisible. During incidents, determining whether the root cause lies in application logic or network-related issues requires additional investigation.

• Operational overhead from heterogeneous agents: Microservices environments often require deploying multiple different monitoring agents. This creates operational complexity, potential agent conflicts, and demands application modifications and restarts—a significant pain point for DevOps teams.

• Siloed telemetry data: After data collection, correlating application logs with network spans and infrastructure metrics requires extensive manual work, leading to incomplete observability and delayed incident resolution.

• Limited platform team control: Platform engineers often lack the ability or permissions to easily instrument applications across their entire estate, yet they remain responsible for overall site reliability and performance.

The New Relic eBPF observability solution addresses these challenges through unification and simplification. Our single, lightweight, language-agnostic agent leverages eBPF technology to gain deep, "outside-in" insights directly from the Linux kernel.

Key features

• Complete visibility without intrusion: Get full observability into new, legacy, or third-party workloads across Kubernetes clusters and Linux hosts/containers, regardless of programming language.

• Unified data collection: Operating at the kernel level, our single agent simultaneously collects observability data including application spans, logs, network traffic, and infrastructure metrics—solving the data silo problem.

• Simplified deployment: By moving observability into the kernel, we eliminate the need to modify applications, simplifying rollout in microservices-heavy environments without requiring application restarts or code changes.

The unified eBPF agent delivers two powerful, complementary capabilities:

• eBPF-powered APM
• eBPF network metrics

Use cases

This solution addresses critical challenges for platform engineers:

• Faster troubleshooting: Correlate application telemetry with infrastructure and network insights. This enables rapid diagnosis of performance issues, especially those that originate in the underlying system.

• Automatic discovery: Get automated observability with zero instrumentation. The eBPF agent continuously identifies and maps all running services and their dependencies, providing a real-time architectural view of new or unknown workloads without requiring prior knowledge of the application's language.

• Unified monitoring: Monitor applications written in any language across diverse environments. This gives you consistent visibility and service-level performance analysis directly within the New Relic user interface.

eBPF-powered APM (eAPM)

The eBPF-powered APM (eAPM) is our standard for no-code, language-agnostic application monitoring. It automatically discovers all services running on your hosts or Kubernetes nodes and populates the New Relic APM UI with performance data. This capability is ideal for getting a complete inventory of all your services, including those you cannot instrument manually, such as unknown workloads or third-party applications.

Key features

• Continuous service discovery: Automatically discovers and maps all running application services, providing a real-time view of your architecture.
• Zero-code instrumentation: Provides deep visibility into application performance (including MELT data) without modifying application code or deploying language-specific agents.
• Broad environment support: Offers comprehensive support for Linux hosts (various distros) and Kubernetes clusters, across both x86 and ARM64 architectures.
• Advanced transaction tracing: Supports detailed segment linking for Java applications, breaking down transactions into individual components (application code, database calls, external service calls) to pinpoint performance bottlenecks. This level of visibility was previously only available through traditional APM agents.

Use cases

• For platform engineers: Get an immediate and complete inventory of all services running on your platform, even those you don't own or that were deployed without your knowledge.
• For teams with opaque workloads: Instantly monitor legacy applications, third-party binaries, or services written in languages where you can't (or don't want to) modify the code.
• For full-environment coverage: Complement your existing APM instrumentation by using eAPM to cover all the services that are not manually instrumented, ensuring 100% visibility.

eBPF network metrics

The eBPF network metrics provides deep visibility into the network communication of your applications. It captures granular TCP, IP, and DNS telemetry directly from the kernel, solving a major source of application performance issues. This capability is complementary to APM (both eAPM and traditional APM) and works independently to give you a complete picture of your application's communication health, helping you definitively answer the question: "Is it the application or the network?"

Deployment flexibility

• For existing New Relic APM customers: You can enable eBPF network metrics alongside your existing APM agents to gain network-layer visibility without disrupting current instrumentation. The eBPF agent operates in network-only mode, complementing your APM data with kernel-level network insights.

• For comprehensive monitoring: Deploy the full eBPF agent with both eAPM and network metrics capabilities for complete observability across application, infrastructure, and network layers.

To view the network metrics, refer to network-metrics documentation.

Key features

• Application-context network data: All network metrics are automatically correlated with the specific application, service, and process that initiated them, making troubleshooting easy.
• Granular DNS monitoring: Tracks DNS resolution failures and reports the associated Fully Qualified Domain Name (FQDN).
• Detailed TCP connection analysis: Measures connection health and latency, including:
  • Handshake: 3-Way handshake latency and success/failure counts.
  • Connection state: Connection duration, data transmit duration, and counts for SYN, ACK, FIN, and RST packets.
  • Errors: Tracks abnormal connection closures.
• Packet-level IP insights: Identifies packet loss and network optimization opportunities by monitoring:
  • Bytes sent & received
  • Packet retransmitted / dropped
  • Packet delivery latency

Use cases

• Troubleshooting slow external API calls: When applications show degraded response times to external services, network metrics help identify whether the issue stems from TCP handshake delays, packet loss, or retransmission problems rather than application logic.
• Root cause analysis for performance degradation: Correlate application performance issues with network-layer problems by examining TCP connection health, packet delivery latency, and connection state changes.
• Inter-service communication monitoring: Monitor the health of microservice-to-microservice communication across your entire cluster, identifying network congestion or routing issues between services.
• External dependency troubleshooting: Quickly identify when performance problems originate from external API endpoints or third-party services by analyzing outbound network patterns and connection quality.

How you can set up the eBPF agent

You can set up the New Relic eBPF agent on your Linux host or Kubernetes cluster.

Related articles