--- title: eBPF agent attributes reference source: https://docs.newrelic.com/docs/ebpf/attributes-reference --- This reference covers the attributes that are unique to the New Relic eBPF agent for eBPF APM and eBPF network metrics. eBPF data flows into standard NRDB data types (`Metric`, `Span`, and `Log`), and these attributes are available for querying, faceting, and alerting in NRQL. The eBPF agent also emits standard OpenTelemetry semantic convention attributes (for example, `http.request.method`, `db.system`, `jvm.memory.usage`) and standard OpenTelemetry span fields (`trace_id`, `span_id`, `kind`, and so on). Refer to the [OpenTelemetry semantic conventions](https://opentelemetry.io/docs/specs/semconv/) and the [trace API specification](https://opentelemetry.io/docs/specs/otel/trace/api/#span) for their definitions. All eBPF telemetry carries the following scope attributes: | Attribute | Value | | -------------------------- | ---------------------------------------------------------- | | `instrumentation.provider` | `newrelic-ebpf` | | `instrumentation.name` | `nr_ebpf` | | `instrumentation.version` | The reporting eBPF agent's version (for example, `1.4.0`). | ## eBPF-specific attributes [#ebpf-specific-attributes] The following attributes are unique to the New Relic eBPF agent. Expand each section to view the attributes. **TCP metrics** These metrics capture TCP connection and packet-level telemetry in the network monitoring context. | Attribute | Definition | Data type | | ------------------------------------ | ------------------------------------------------------------- | --------------------- | | `ebpf.tcp.tx` | The amount of data transmitted in bytes. | Gauge | | `ebpf.tcp.rx` | The amount of data received in bytes. | Gauge | | `ebpf.tcp.retransmits` | The number of TCP packet retransmissions. | Gauge | | `ebpf.tcp.packet_latency_avg` | The average TCP packet latency in nanoseconds. | Gauge | | `ebpf.tcp.data.packet.send` | The number of TCP data packets sent. | Gauge | | `ebpf.tcp.data.packet.receive` | The number of TCP data packets received. | Gauge | | `ebpf.tcp.packet_dropped` | The number of TCP packets dropped. | Gauge | | `ebpf.tcp.handshake_latency` | The TCP three-way handshake latency in nanoseconds. | Gauge | | `ebpf.tcp.connection_duration` | The distribution of TCP connection durations in milliseconds. | Exponential histogram | | `ebpf.tcp.data_transmit_duration` | The duration of TCP data transmission in milliseconds. | Gauge | | `ebpf.tcp.connection.open` | The number of TCP connections opened. | Gauge | | `ebpf.tcp.connection.close` | The number of TCP connections closed. | Gauge | | `ebpf.tcp.connection.error` | The number of TCP connections closed due to an error. | Gauge | | `ebpf.tcp.reset.send` | The number of TCP RST packets sent. | Gauge | | `ebpf.tcp.syn.send` | The number of TCP SYN packets sent. | Gauge | | `ebpf.tcp.ack.send` | The number of TCP ACK packets sent. | Gauge | | `ebpf.tcp.synack.send` | The number of TCP SYN-ACK packets sent. | Gauge | | `ebpf.tcp.fin.send` | The number of TCP FIN packets sent. | Gauge | | `ebpf.tcp.reset.receive` | The number of TCP RST packets received. | Gauge | | `ebpf.tcp.syn.receive` | The number of TCP SYN packets received. | Gauge | | `ebpf.tcp.ack.receive` | The number of TCP ACK packets received. | Gauge | | `ebpf.tcp.synack.receive` | The number of TCP SYN-ACK packets received. | Gauge | | `ebpf.tcp.fin.receive` | The number of TCP FIN packets received. | Gauge | | `process.file_descriptor.errors` | The total number of file descriptor allocation errors. | Gauge | | `process.file_descriptor.soft_limit` | The soft limit (`rlim_cur`) for file descriptors. | Gauge | | `process.file_descriptor.hard_limit` | The hard limit (`rlim_max`) for file descriptors. | Gauge | | `process.open_file_descriptor.count` | The number of open socket file descriptors. | Gauge | **TCP and network resource attributes** These attributes provide connection context and are attached to TCP metrics and related network telemetry. | Attribute | Definition | Data type | | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- | | `error` | The type of connection error. Only present on `ebpf.tcp.connection.error`. | String | | `upid` | The unique process ID, formatted as `asid:pid:start_time`. | String | | `protocol.name` | The protocol name. In network context, always `tcp` or `fd`. In APM context, one of: `http`, `mysql`, `redis`, `postgresql`, `mongodb`, `kafka`, `amqp`, `dns`, `cassandra`, `mssql`, or `dynamodb`. | String | | `tags.host.name` | The host name tag (New Relic specific). | String | | `tags.*` | Custom entity labels prefixed with `tags.`. | String | | `local_addr` | The local IP address of the connection. | String | | `local_port` | The local port of the connection. Present on incoming connections only. | Integer | | `remote_addr` | The remote IP address of the connection. | String | | `remote_port` | The remote port of the connection. | Integer | | `remote.host.name` | The resolved remote hostname, or `ip-` when resolution is not available. | String | | `direction` | The direction of the connection, either `OUTGOING` or `INCOMING`. | String | | `tcp_established` | Whether the TCP connection is established. | Boolean | | `operation` | The file descriptor operation type, always `socket`. Only present on `process.file_descriptor.errors`. | String | | `error.code` | The file descriptor allocation error code. Only present on `process.file_descriptor.errors`. | Integer | | `type` | The file descriptor type: `socket`, `file`, or `others`. Only present on `process.open_file_descriptor.count`. | String | | `trace_role` | The trace role of the connection, either `client` or `server`. | String | | `host.name` | The host machine's name. | String | | `resp_status` | The HTTP response status code. | Integer | **HTTP headers** | Attribute | Definition | Data type | | ------------------------------------- | ------------------------------------------------------------------------------ | --------- | | `http.request.headers.user_agent` | The value of the `User-Agent` request header. | String | | `http.request.headers.accept` | The value of the `Accept` request header, used for content negotiation. | String | | `http.request.headers.content_length` | The value of the `Content-Length` request header in bytes. | Integer | | `http.request.headers.referer` | The value of the `Referer` request header, used for navigation tracking. | String | | `http.response.headers.content_type` | The value of the `Content-Type` response header. | String | | `http.host` | The value of the HTTP `Host` header, or the HTTP/2 `:authority` pseudo-header. | String | **Database** | Attribute | Definition | Data type | | ---------------------- | --------------------------------------------------------------------------------------------- | --------- | | `db.sql.table` | The SQL table name targeted by the query. Applies to MySQL, PostgreSQL, Cassandra, and MSSQL. | String | | `mongodb.resp_latency` | The MongoDB response latency in milliseconds. | Gauge | | `dynamodb.table` | The DynamoDB table name targeted by the operation. | String | | `name` | The MongoDB command name. | String | | `db.instance` | Carries the database collection or table name. | String | | `db.span.linked` | Indicates if the span is part of a distributed trace. | Boolean | | `sql_obfuscated` | The SQL query string with sensitive values removed. | String | | `is_error` | Flag indicating if the database operation failed. | Boolean | | `mysql.req_cmd` | The specific MySQL protocol command performed. | String | | `pgsql.req_cmd` | The specific PostgreSQL protocol message type. | String | | `cql.query` | The Cassandra Query Language (CQL) text. | String | | `cql.req_cmd` | The specific Cassandra request opcode name. | String | | `redis.req_cmd` | The specific Redis command name. | String | | `network.peer.address` | The IP address of the remote database server. | String | **Kafka metrics** | Attribute | Definition | Data type | | ------------------- | --------------------------------------------------------------------------------------- | --------- | | `kafka.count` | The number of Kafka operations. | Gauge | | `kafka.latency_p50` | The 50th percentile of Kafka operation latency in milliseconds. | Gauge | | `kafka.latency_p90` | The 90th percentile of Kafka operation latency in milliseconds. | Gauge | | `kafka.latency_p99` | The 99th percentile of Kafka operation latency in milliseconds. | Gauge | | `kafka.latency` | A summary of Kafka operation latency, including min and max quantiles, in milliseconds. | Gauge | | `kafka.bytes` | The total number of bytes sent or received through Kafka. | Gauge | For Kafka producer and consumer metrics, refer to the [OpenTelemetry Kafka producer metrics](https://docs.newrelic.com/docs/opentelemetry/integrations/kafka/metrics-reference/#producer-metrics) and [consumer metrics](https://docs.newrelic.com/docs/opentelemetry/integrations/kafka/metrics-reference/#consumer-metrics) documentation. **Kafka resource attributes** | Attribute | Definition | Data type | | --------------------------- | ------------------------------------------------------- | --------- | | `kafka.service.name` | The name of the Kafka broker service. | String | | `kafka.broker.pod` | The name of the Kafka broker pod. | String | | `kafka.namespace.name` | The namespace the Kafka broker runs in. | String | | `client-id` | The Kafka client identifier. | String | | `kafka.client_type` | The Kafka client type, either `producer` or `consumer`. | String | | `kafka.has_error` | Whether the Kafka operation resulted in an error. | Boolean | | `kafka.partition_idx` | The index of the Kafka partition. | Integer | | `messaging.kafka.partition` | The identifier of the Kafka partition for the message. | Integer | | `kafka.req_cmd` | The name of the Kafka command in the request. | String | | `topic` | The name of the Kafka topic (per-partition only). | String | **DNS resource attributes** | Attribute | Definition | Data type | | ----------------------- | --------------------------------- | --------- | | `dns.server.name` | The name of the DNS server. | String | | `dns.server.namespace` | The namespace of the DNS server. | String | | `dns.server.cluster_id` | The cluster ID of the DNS server. | String | **DNS span attributes** | Attribute | Definition | Data type | | --------------------- | -------------------------------------------------------------------------------------------------------------------------- | --------- | | `dns.latency` | DNS query latency, in milliseconds. | Integer | | `dns.req_body` | The DNS query's request body. | String | | `dns.resp_body` | The DNS query's response body. | String | | `dns.query` | The domain name being looked up. | String | | `dns.rcode` | The DNS return code of a query. | Integer | | `dns.rcode_name` | The DNS return code name of a query, as an alphanumeric label. | String | | `dns.resolved` | Whether the DNS query was resolved successfully. | Boolean | | `dns.resolved_status` | The DNS query status, either `Success` or `Failure`. | String | | `dns.query_type` | The type of information requested, such as an IPv4 address (`A`), an IPv6 address (`AAAA`), or mail server details (`MX`). | String | **AMQP metrics** | Attribute | Definition | Data type | | ------------------ | -------------------------------------------------------------------------------------- | --------- | | `amqp.count` | The number of AMQP operations. | Gauge | | `amqp.latency_p50` | The 50th percentile of AMQP operation latency in milliseconds. | Gauge | | `amqp.latency_p90` | The 90th percentile of AMQP operation latency in milliseconds. | Gauge | | `amqp.latency_p99` | The 99th percentile of AMQP operation latency in milliseconds. | Gauge | | `amqp.latency` | A summary of AMQP operation latency, including min and max quantiles, in milliseconds. | Gauge | | `amqp.bytes` | The total number of bytes sent and received through the AMQP protocol. | Gauge | | `amqp.req_bytes` | The number of bytes sent in AMQP requests. | Gauge | | `amqp.resp_bytes` | The number of bytes received in AMQP responses. | Gauge | **AMQP resource attributes** | Attribute | Definition | Data type | | ---------------------- | ----------------------------------------------- | --------- | | `amqp.service.name` | The name of the AMQP broker service. | String | | `amqp.pod.name` | The name of the AMQP broker pod. | String | | `amqp.node.name` | The name of the AMQP broker node. | String | | `amqp.deployment.name` | The name of the AMQP broker deployment. | String | | `amqp.namespace.name` | The namespace the AMQP broker runs in. | String | | `amqp.frame_name` | The type of the AMQP frame. | String | | `amqp.req_name` | The name of the AMQP request method. | String | | `amqp.resp_name` | The name of the AMQP response method. | String | | `amqp.routing_key` | The AMQP routing key used to route the message. | String | | `amqp.consumer_tag` | The AMQP consumer tag identifying the consumer. | String | **AMQP span attributes** | Attribute | Definition | Data type | | ----------------------- | ------------------------------------------------------------------- | --------- | | `amqp.req_body` | Full raw request message JSON. | String | | `amqp.resp_body` | Full raw response message JSON. | String | | `amqp.span.linked` | True when span is linked to a distributed trace (`trace_id != ""`). | Boolean | | `translated_host_name` | DNAT-translated broker hostname. Server spans only. | String | | `translated_local_addr` | DNAT-translated local IP. Server spans only. | String | | `translated_local_port` | DNAT-translated local port. Server spans only. | Integer | | `service.instance.id` | Source pod name used as OTel service instance identifier. | String | **JVM metrics** | Attribute | Definition | Data type | | -------------------------------------- | ------------------------------------------------------- | --------- | | `process.runtime.jvm.memory.usage` | The amount of JVM memory used in bytes. | Gauge | | `process.runtime.jvm.memory.committed` | The amount of JVM memory committed in bytes. | Gauge | | `process.runtime.jvm.memory.max` | The maximum JVM memory obtainable in bytes. | Gauge | | `process.runtime.jvm.gc.duration` | The duration of JVM garbage collection in milliseconds. | Gauge | **JVM dimension attributes** | Attribute | Definition | Data type | | --------- | ------------------------------------------------- | --------- | | `type` | The JVM memory type, either `heap` or `non_heap`. | String | | `gc` | The name of the JVM garbage collector. | String | | `pool` | The name of the JVM memory pool. | String | **Other resource attributes** | Attribute | Definition | Data type | | --------------- | ---------------------------------------------------------- | --------- | | `jvm.id` | The JVM process ID. Present on JVM metrics only. | String | | `px.cluster.id` | The cluster ID. Present on Kafka, DNS, and AMQP telemetry. | String | [eBPF APM](https://docs.newrelic.com/docs/ebpf/ebpf-apm/) Learn how to use New Relic's eBPF APM for zero-code, language-agnostic application monitoring with automatic service discovery. [eBPF network metrics](https://docs.newrelic.com/docs/ebpf/network-metrics/) Learn about eBPF network monitoring capabilities. [eBPF observability overview](https://docs.newrelic.com/docs/ebpf/overview/) Learn how New Relic eBPF observability provides zero-code monitoring for Linux hosts and Kubernetes clusters.