---
title: Troubleshoot eBPF on Kubernetes
source: https://docs.newrelic.com/docs/ebpf/troubleshooting/troubleshoot-k8s
---

This guide provides solutions for common issues you might encounter with the eBPF agent in a Kubernetes environment. Find your problem in the list below for specific resolution steps.

**File descriptor limit exceeded**

### Problem

You're experiencing issues with the eBPF agent in your Kubernetes environment, such as file descriptor limits, privilege errors, or performance problems.

### Solution

If you encounter file descriptor limit errors, see our dedicated [file descriptor limit troubleshooting guide](https://docs.newrelic.com/docs/ebpf/troubleshooting/file-descriptor-limit) for detailed resolution steps.

**Privilege and permission issues**

### Problem

eBPF agent fails to start due to insufficient privileges.

### Solution

1.  Verify that the eBPF agent DaemonSet has the necessary privileges. The Helm chart should automatically configure required permissions.

2.  Check pod security context in your deployment:

    ```bash
       kubectl describe pod <ebpf-agent-pod> -n newrelic
    ```

3.  Ensure your cluster supports eBPF. Check kernel version on nodes:

    ```bash
    kubectl get nodes -o wide
    # Kernel version should be 5.8 or later
    ```

**Performance and resource issues**

### Problem

eBPF agent consuming excessive resources or causing performance degradation.

### Solution:

1.  Monitor resource usage:

    ```bash
       kubectl top pods -n newrelic
    ```

2.  Adjust memory limits in your Helm values:

    ```yaml
    agent:
    resources:
       limits:
          memory: "2Gi"  # Increase if needed
       requests:
          memory: "512Mi"
    ```

3.  Configure data filtering to reduce load:

    ```yaml
    allDataFilters:
      dropNamespaces: ["kube-system", "monitoring"]
      dropServiceNameRegex: "kube-dns|otel-collector"
    ```

4.  Limit protocol monitoring if not all protocols are needed:

    ```yaml
    protocols:
    http:
       enabled: true
    mysql:
       enabled: false  # Disable if not needed
    ```

**Pod startup and connectivity issues**

### Problem

eBPF agent pods not starting or unable to send data.

### Solution

1.  Check pod status:

    ```bash
    kubectl get pods -n newrelic
    kubectl describe pod <ebpf-agent-pod> -n newrelic
    ```

2.  Review pod logs:

    ```bash
       kubectl logs <ebpf-agent-pod> -n newrelic
    ```

3.  Verify network connectivity:

    ```bash
    # Test from within the cluster
    kubectl run test-connectivity --image=busybox --rm -it --restart=Never -- \
    nslookup otlp.nr-data.net
    ```

> #### ⚠️ IMPORTANT
>
> Ensure ports 4317 and 443 are unblocked at multiple levels:
>
> -   **Cluster level**: For Kubernetes deployments (e.g., AKS clusters), verify the cluster's network security groups allow outbound traffic on these ports
> -   **Infrastructure level**: Check that security software (e.g., Microsoft Defender, corporate firewalls) isn't blocking these ports at the infrastructure level
>
> Port blocking can occur at both levels simultaneously, causing connectivity issues even if one level is properly configured.

4.  Check service account and RBAC:

    ```bash
    kubectl get serviceaccount -n newrelic
    kubectl get clusterrole,clusterrolebinding -l app.kubernetes.io/name=nr-ebpf-agent
    ```

**Kubernetes-specific configuration issues**

### Problem

Entity names not appearing correctly or data not attributed to correct services.

### Solution

-   The eBPF agent uses Kubernetes `Service` objects to name entities. Ensure your applications have a corresponding service defined.

    ````yaml
    apiVersion: v1
    kind: Service
    metadata:
    name: my-service  # This becomes the entity name
    spec:
    selector:
       app: my-app
    ```

    ````

-   If you are missing data, ensure the namespace is not being excluded in your `values.yaml`.
    ````yaml
    # In values.yaml
    allDataFilters:
      dropNamespaces: []  # Remove namespaces you want to monitor
    ```

    ````

-   In Kubernetes, entity names are derived from the Kubernetes service name for example, `mysql-database-service`. On hosts or in Docker, names are a combination of the process name, its directory or container ID, and the listening port for example, `ruby:/home/ubuntu/app:[5678]`.

### Verification steps

1.  Check for successful startup log:

    ```bash
       kubectl logs <ebpf-agent-pod> -n newrelic | grep "STEP-7"
    ```

    Should show: `[STEP-7] => Successfully started the eBPF Agent.`

2.  Verify data flow in New Relic:
    -   In the New Relic UI, look for entities with `instrumentation.name = nr_ebpf`.
    -   Confirm that the entity names match your Kubernetes service names.

3.  Test OTLP endpoint connectivity:

    ```bash
    kubectl exec -it <ebpf-agent-pod> -n newrelic -- \
    curl -v https://otlp.nr-data.net:443
    ```