--- title: New Relic eBPF observability source: https://docs.newrelic.com/docs/ebpf/overview --- /\* New Relic eBPF observability helps you to monitor modern and complex networks and environments by providing a new layer of visibility. \## What value does the eBPF agent provide? \[#value] New Relic eBPF observability provides unified, zero-code visibility across Kubernetes and Linux host environments. It uses the extended Berkeley Packet Filter (eBPF) technology in the Linux kernel to deliver automated, language-agnostic insights. This approach reduces operational overhead by eliminating the need for manual instrumentation or code changes. \## Impact \[#impact] You can achieve deeper observability and resolve issues more quickly with minimal resource overhead, ensuring that monitoring does not impact application performance. The agent provides unique kernel-level and network details for a comprehensive understanding of system dynamics. \*//\* Monitoring modern applications is challenging because they often run on complex and mixed infrastructure, from Kubernetes clusters to traditional Linux hosts such as, virtual machines and cloud instances. As you scale these environments, it becomes more difficult to gain visibility into performance without significant manual configuration. An engineer needs to know what applications are running in their cluster and which ones are causing performance degradation. Sometimes, application performance suffers due to issues in the underlying infrastructure that application owners cannot resolve with application-level tools alone. Imagine your team manages a diverse estate: \* You need to troubleshoot fast, but correlating application telemetry with infrastructure insights is not easy. \* New workloads are deployed, but instrumenting them is a challenge because you don't own the code, the development team is external, or you're simply unaware the service exists. In both scenarios, you need a solution that provides broad visibility across your entire estate without requiring you to have prior knowledge of every application's language or architecture. The New Relic eBPF agent addresses these challenges. It is a powerful, non-intrusive tool designed to address these challenges. It leverages the extended Berkeley Packet Filter (eBPF), an industry-leading technology that provides a safe and efficient way to gain insights directly from the Linux kernel. Using this eBPF agent, you can get a unified, automated view across your entire Linux estate by collecting rich, service-level telemetry directly from the kernel. This approach provides deep visibility into all your applications without requiring you to make any code changes. \*//\* \## Key features \[#key-features] The New Relic eBPF agent is designed to provide comprehensive observability for your Linux hosts and Kubernetes clusters. It offers a range of features that help you monitor your entire system health effectively: \* Zero-code instrumentation to gain deep visibility into application performance without modifying application code or deploying language-specific agents. This approach reduces operational overhead and accelerates time-to-value across your entire infrastructure. \* Automatically discover services to continuously identify and map all running services and their dependencies. This provides a real-time view of your application's architecture. \* In Kubernetes, the agent uses the cluster's service-level information to provide native context for your applications. \* On Linux hosts, it derives service names from environment variables or the underlying process information, giving you a clear view of application behavior. \* Unified telemetry across environments to provide consistent visibility across your entire estate, whether you are running applications in Kubernetes or on traditional Linux hosts. \* Service-level performance analysis to gain insights into service interactions, request rates, latency, and errors. This helps you understand how your applications perform in real-world scenarios. \* Language-agnostic visibility to monitor applications written in any language, whether they are modern microservices or legacy applications. This allows you to use a single tool for all your monitoring needs. \* Low-resource overhead to minimize the impact on system performance while collecting detailed telemetry data. This ensures that your monitoring does not interfere with application performance. \* Deep visibility of kernel and user space interactions to provide insights into how applications interact with the underlying system. This helps you to capture and trace events in real-time. \* Rich metadata to collect granular-level details about system operations to help you in troubleshooting and performance analysis. \*//\* \`IMAGE Needed\` \*//\* \## How the eBPF agent works \[#how-it-works] The New Relic eBPF agent is deployed using helm charts in Kubernetes and using Debian/RPM packages on Linux hosts. It runs as a \`daemonset\` in Kubernetes or as a system service on Linux hosts. Once installed, the agent automatically detects all the running services and applications in your environment. These applications are integrated into New Relic's APM & Service UI under the eBPF entities. The New Relic eBPF agent has two modes: \* \*\*Discover mode:\*\* To automatically discover applications in your environment without active monitoring. This mode is suitable for initial setup or less intrusive monitoring. \* \*\*eBPF APM mode:\*\* To unlock a deeper level of observability by actively monitoring applications and collecting low-level metrics for a comprehensive understanding of system dynamics. \## How eBPF compliments APM \[#ebpf-apm] \*/ Modern application stacks comprise heterogeneous, interconnected services running across mixed infrastructure environments, from Kubernetes clusters to traditional Linux hosts. This complexity creates fundamental challenges that slow down troubleshooting, such as: - **Observability gaps between application and infrastructure:** Application monitoring provides deep insights into code performance, while infrastructure monitoring tracks system health. However, the network layer between these components often remains invisible. During incidents, determining whether the root cause lies in application logic or network-related issues requires additional investigation. - **Operational overhead from heterogeneous agents:** Microservices environments often require deploying multiple different monitoring agents. This creates operational complexity, potential agent conflicts, and demands application modifications and restarts—a significant pain point for DevOps teams. - **Siloed telemetry data:** After data collection, correlating application logs with network spans and infrastructure metrics requires extensive manual work, leading to incomplete observability and delayed incident resolution. - **Limited platform team control:** Platform engineers often lack the ability or permissions to easily instrument applications across their entire estate, yet they remain responsible for overall site reliability and performance. The New Relic eBPF observability solution addresses these challenges through unification and simplification. Our single, lightweight, language-agnostic agent leverages eBPF technology to gain deep, "outside-in" insights directly from the Linux kernel. ## Key features [#key-features] - **Complete visibility without intrusion:** Get full observability into new, legacy, or third-party workloads across Kubernetes clusters and Linux hosts/containers, regardless of programming language. - **Unified data collection:** Operating at the kernel level, our single agent simultaneously collects observability data including application spans, logs, network traffic, and infrastructure metrics—solving the data silo problem. - **Simplified deployment:** By moving observability into the kernel, we eliminate the need to modify applications, simplifying rollout in microservices-heavy environments without requiring application restarts or code changes. > #### 💡 TIP > > The eBPF agent is HIPAA and FedRamp compliant, making it suitable for use in regulated environments. The unified eBPF agent delivers two powerful, complementary capabilities: - [eBPF APM](#ebpf-apm) - [eBPF network metrics](#ebpf-network-metrics) ## Use cases [#use-cases] This solution addresses critical challenges for platform engineers: - **Faster troubleshooting:** Correlate application telemetry with infrastructure and network insights. This enables rapid diagnosis of performance issues, especially those that originate in the underlying system. - **Automatic discovery:** Get automated observability with zero instrumentation. The eBPF agent continuously identifies and maps all running services and their dependencies, providing a real-time architectural view of new or unknown workloads without requiring prior knowledge of the application's language. - **Unified monitoring:** Monitor applications written in any language across diverse environments. This gives you consistent visibility and service-level performance analysis directly within the New Relic user interface. ## eBPF APM [#ebpf-apm] The New Relic eBPF APM is our standard for no-code, language-agnostic application monitoring. It automatically discovers all services running on your hosts or Kubernetes nodes and populates the New Relic APM UI with performance data. This capability is ideal for getting a complete inventory of all your services, including those you cannot instrument manually, such as unknown workloads or third-party applications. For more information, refer to [eBPF APM](https://docs.newrelic.com/docs/ebpf/ebpf-apm). /\* ### Key features \* \*\*Automatic service discovery:\*\* Continuously discovers and maps all running application services across your entire infrastructure, providing a real-time view of your architecture. This includes unknown workloads, third-party applications, and services deployed without your knowledge, ensuring complete visibility across your estate. \* \*\*Zero-code instrumentation:\*\* Delivers deep visibility into application performance (including MELT data) without modifying application code or deploying language-specific agents, eliminating operational overhead and accelerating time-to-value. \* \*\*Broad environment support:\*\* Offers comprehensive support for Linux hosts (various distros) and Kubernetes clusters, across both \*\*x86 and ARM64\*\* architectures. \* \*\*Advanced transaction tracing:\*\* Supports detailed segment linking for Java applications, breaking down transactions into individual components (application code, database calls, external service calls) to pinpoint performance bottlenecks. This level of visibility was previously only available through traditional APM agents. \### Use cases \* \*\*For platform engineers:\*\* Get an immediate and complete inventory of all services running on your platform, even those you don't own or that were deployed without your knowledge. \* \*\*For teams with opaque workloads:\*\* Instantly monitor legacy applications, third-party binaries, or services written in languages where you can't (or don't want to) modify the code. \* \*\*For full-environment coverage:\*\* Complement your existing APM instrumentation by using eBPF APM to cover all the services that are not manually instrumented, ensuring 100% visibility. \*//\* ### Transitioning from eBPF APM to traditional APM When you're ready to get deeper insights for critical applications, you can seamlessly transition from eBPF APM monitoring to traditional New Relic APM agents. This transition path allows you to: \* \*\*Start with broad coverage:\*\* Use eBPF APM to quickly identify all services and understand your application landscape without any code changes. \* \*\*Prioritize instrumentation efforts:\*\* Focus your traditional APM deployment on the most critical services identified through eBPF APM monitoring. \* \*\*Maintain continuous visibility:\*\* Keep eBPF APM running for less critical services while adding detailed APM instrumentation to high-priority applications. \* \*\*Avoid monitoring gaps:\*\* The transition can be done gradually without losing observability, as both eBPF APM and traditional APM can run simultaneously on the same infrastructure. This hybrid approach ensures you get comprehensive coverage quickly while still having the option to add deeper instrumentation where it matters most. \*/ ## eBPF network metrics [#ebpf-network-metrics] The eBPF network metrics provides deep visibility into the network communication of your applications. It captures granular TCP, IP, and DNS telemetry directly from the kernel, solving a major source of application performance issues. This capability is complementary to APM (both eBPF APM and traditional APM) and works independently to give you a complete picture of your application's communication health, helping you definitively answer the question: "Is it the application or the network?" ### Deployment flexibility - **For existing New Relic APM customers:** You can enable eBPF network metrics alongside your existing APM agents to gain network-layer visibility without disrupting current instrumentation. The eBPF agent operates in network-only mode, complementing your APM data with kernel-level network insights. - **For comprehensive monitoring:** Deploy the full eBPF agent with both eBPF APM and network metrics capabilities for complete observability across application, infrastructure, and network layers. To view the network metrics, refer to [network-metrics](https://docs.newrelic.com/docs/ebpf/network-metrics/) documentation. /\* ### Key features \* \*\*Application-context network data:\*\* All network metrics are automatically correlated with the specific application, service, and process that initiated them, making troubleshooting easy. \* \*\*Granular DNS monitoring:\*\* Tracks DNS resolution failures and reports the associated Fully Qualified Domain Name (FQDN). \* \*\*Detailed TCP connection analysis:\*\* Measures connection health and latency, including: \* \*\*Handshake:\*\* 3-Way handshake latency and success/failure counts. \* \*\*Connection state:\*\* Connection duration, data transmit duration, and counts for SYN, ACK, FIN, and RST packets. \* \*\*Errors:\*\* Tracks abnormal connection closures. \* \*\*Packet-level IP insights:\*\* Identifies packet loss and network optimization opportunities by monitoring: \* Bytes sent & received \* Packet retransmitted / dropped \* Packet delivery latency \### Use cases \* \*\*Troubleshooting slow external API calls:\*\* When applications show degraded response times to external services, network metrics help identify whether the issue stems from TCP handshake delays, packet loss, or retransmission problems rather than application logic. \* \*\*Root cause analysis for performance degradation:\*\* Correlate application performance issues with network-layer problems by examining TCP connection health, packet delivery latency, and connection state changes. \* \*\*Inter-service communication monitoring:\*\* Monitor the health of microservice-to-microservice communication across your entire cluster, identifying network congestion or routing issues between services. \* \*\*External dependency troubleshooting:\*\* Quickly identify when performance problems originate from external API endpoints or third-party services by analyzing outbound network patterns and connection quality.\*/ ## How you can set up the eBPF agent [#setup] You can set up the New Relic eBPF agent on your Linux host or Kubernetes cluster. 1. Ensure that your environments meets our [compatibility and requirements](https://docs.newrelic.com/docs/ebpf/requirements) for your environment. - [Linux requirements](https://docs.newrelic.com/docs/ebpf/requirements#linux) - [Kubernetes requirements](https://docs.newrelic.com/docs/ebpf/requirements#k8s) 2. Depending on your environment, follow the appropriate installation guide: - [Linux installation guide](https://docs.newrelic.com/docs/ebpf/linux-installation/) - [Kubernetes installation guide](https://docs.newrelic.com/docs/ebpf/k8s-installation/) ### Find your data in New Relic [#data] Once the eBPF agent is installed, it automatically starts collecting data from your Linux host. You can access this data in New Relic's OpenTelemetry UI. For more information on New Relic OpenTelemetry UI, refer [OpenTelemetry APM UI](https://docs.newrelic.com/docs/opentelemetry/get-started/apm-monitoring/opentelemetry-apm-ui). > #### 💡 TIP > > To view the list of attributes collected by the eBPF agent, refer to the [eBPF agent attributes reference](https://docs.newrelic.com/docs/ebpf/attributes-reference). ## Related articles [#related-articles] [Compatibility and requirements](https://docs.newrelic.com/docs/ebpf/requirements/) Learn about New Relic eBPF agent compatibility requirements, supported databases, platforms, and querying capabilities. [eBPF Kubernetes installation](https://docs.newrelic.com/docs/ebpf/k8s-installation/) Learn how to set up the New Relic eBPF agent for your Kubernetes cluster. [eBPF Linux installation](https://docs.newrelic.com/docs/ebpf/linux-installation/) Learn how to set up the New Relic eBPF agent for your Linux host.