---
title: Query ATP data in New Relic
source: https://docs.newrelic.com/docs/opentelemetry/nrdot/atp/query
---

> #### 💡 PREVIEW
>
> We're still working on this feature, but we'd love for you to try it out!
>
> This feature is currently provided as part of a preview pursuant to our [pre-release policies](https://docs.newrelic.com/docs/licenses/license-information/referenced-policies/new-relic-pre-release-policy/).

ATP collects process metrics through the OpenTelemetry `hostmetricsreceiver` and enriches them with intelligent filtering metadata. You can query this data to:

-   Monitor process states and identify `stuck` or problematic processes
-   Track how ATP's dynamic thresholds adapt to your workload patterns
-   Measure filtering efficiency to understand data reduction effectiveness
-   Detect anomalies and unusual process behavior
-   Set up alerts for critical process monitoring

All process metrics are available under the `process.*` namespace in New Relic, with ATP-specific metadata stored in the `process.atp` field.

## Process state monitoring [#process-state]

**Process distribution by state**

This query shows you a breakdown of all processes running on your host, categorized by their execution state. It's essential for identifying `stuck` processes or resource exhaustion.

```sql
FROM Metric
SELECT uniqueCount(process.pid) as 'Process Count'
FACET process.state, CASES(
  WHERE process.state = 'R' AS 'Running',
  WHERE process.state = 'S' AS 'Sleeping (Interruptible)',
  WHERE process.state = 'D' AS 'Uninterruptible Sleep (Disk I/O)',
  WHERE process.state = 'Z' AS 'Zombie',
  WHERE process.state = 'T' AS 'Stopped',
  WHERE process.state = 'I' AS 'Idle Kernel Thread',
  WHERE process.state = 'X' AS 'Dead',
  WHERE process.state = 'W' AS 'Paging'
)
```

## ATP intelligence monitoring [#atp-intelligence]

**Dynamic thresholds tracking**

This query shows you the current dynamic threshold values compared to actual process metrics, helping you understand how close processes are to triggering ATP actions.

```sql
FROM Metric
SELECT
  latest(numeric(jparse(`process.atp`)[threshold_details][`process.cpu.utilization`][threshold])) * 100 AS 'Process CPU Utilization',
  latest(numeric(jparse(`process.atp`)[threshold_details][`process.memory.usage`][threshold])) AS 'Memory Usage'
WHERE host.name = 'YOUR_HOST_NAME'
TIMESERIES MAX
```

**How to use this query:**

-   Replace `YOUR_HOST_NAME` with your actual host name
-   You can modify the metric names in the `jparse` function to track thresholds for other metrics
-   Watch for patterns where actual values consistently approach threshold values

**ATP filtering efficiency**

This query measures how effectively ATP is reducing telemetry volume while retaining critical data.

```sql
FROM Metric
SELECT latest(numeric(jparse(`process.atp`)['filtering_summary']['efficiency_ratio'])) * 100 as 'Filtering Efficiency'
WHERE metricName like 'process.%'
AND `process.atp` IS NOT NULL
```

## Anomaly detection queries [#anomaly-detection]

**Anomaly count over time**

This query visualizes how frequently ATP detects anomalies across different executables, helping you identify which processes are most prone to unusual behavior.

```sql
FROM Metric
SELECT latest(numeric(jparse(`process.atp`, 'filtering_summary.stage_hits.anomaly_detection'))) AS 'Anomaly Count'
WHERE metricName like 'process.%'
FACET process.executable.name
TIMESERIES MAX
```

**Memory usage anomalies**

This query highlights specific processes that have experienced memory usage anomalies detected by ATP.

```sql
FROM Metric
SELECT max(process.memory.usage) as 'Memory Usage'
WHERE metricName = 'process.memory.usage'
AND numeric(jparse(`process.atp`)['filtering_summary']['stage_hits']['anomaly_detection']) > 0
AND process.atp IS NOT NULL
FACET process.pid, process.executable.name, host.name
TIMESERIES MAX
```

**CPU usage anomalies**

This query shows processes that have experienced CPU utilization anomalies.

```sql
FROM Metric
SELECT max(process.cpu.utilization) * 100 as 'CPU Utilization'
WHERE metricName like 'process.cpu.utilization'
AND numeric(jparse(`process.atp`)['filtering_summary']['stage_hits']['anomaly_detection']) > 0
AND process.atp IS NOT NULL
FACET process.pid, process.executable.name, host.name
TIMESERIES MAX
```

**Note**: You can modify these queries to monitor anomalies in any other process metric by changing the `metricName` filter.

## Performance monitoring [#performance-monitoring]

**Context switches per minute**

This query tracks the rate of context switching per process. High context switch rates often indicate CPU contention or inefficient multi-threading.

```sql
SELECT rate(sum(process.context_switches), 1 minute) AS 'Context Switches/min'
FROM Metric
WHERE metricName = 'process.context_switches'
FACET process.executable.name, process.pid
TIMESERIES MAX
```

## Setting up alerts

**Data gap alert**

Use this query to create an alert that triggers when process telemetry stops flowing entirely, indicating potential agent failure or network issues. For more information to setting up alerts, see [Creating alert conditions](https://docs.newrelic.com/docs/alerts/create-alert/create-alert-condition/alert-conditions/).

```sql
FROM Metric
SELECT count(*)
WHERE metricName LIKE 'process.%'
```

## Related resources [#related-resources]

[ATP for host](https://docs.newrelic.com/docs/opentelemetry/nrdot/atp/host)

Learn about setting up ATP for your host environment.

[ATP for Kubernetes](https://docs.newrelic.com/docs/opentelemetry/nrdot/atp/k8s)

Learn how to set up the ATP for your Kubernetes environment.

[Advanced-features](https://docs.newrelic.com/docs/opentelemetry/nrdot/atp/advanced-features)

Learn how to enable advanced features for your ATP deployment.