New Relic eBPF observability

Modern application stacks comprise heterogeneous, interconnected services running across mixed infrastructure environments, from Kubernetes clusters to traditional Linux hosts. This complexity creates fundamental challenges that slow down troubleshooting, such as:

• Observability gaps between application and infrastructure: Application monitoring provides deep insights into code performance, while infrastructure monitoring tracks system health. However, the network layer between these components often remains invisible. During incidents, determining whether the root cause lies in application logic or network-related issues requires additional investigation.

• Operational overhead from heterogeneous agents: Microservices environments often require deploying multiple different monitoring agents. This creates operational complexity, potential agent conflicts, and demands application modifications and restarts—a significant pain point for DevOps teams.

• Siloed telemetry data: After data collection, correlating application logs with network spans and infrastructure metrics requires extensive manual work, leading to incomplete observability and delayed incident resolution.

• Limited platform team control: Platform engineers often lack the ability or permissions to easily instrument applications across their entire estate, yet they remain responsible for overall site reliability and performance.

The New Relic eBPF observability solution addresses these challenges through unification and simplification. Our single, lightweight, language-agnostic agent leverages eBPF technology to gain deep, "outside-in" insights directly from the Linux kernel.

Key features

• Complete visibility without intrusion: Get full observability into new, legacy, or third-party workloads across Kubernetes clusters and Linux hosts/containers, regardless of programming language.

• Unified data collection: Operating at the kernel level, our single agent simultaneously collects observability data including application spans, logs, network traffic, and infrastructure metrics—solving the data silo problem.

• Simplified deployment: By moving observability into the kernel, we eliminate the need to modify applications, simplifying rollout in microservices-heavy environments without requiring application restarts or code changes.

The unified eBPF agent delivers two powerful, complementary capabilities:

• eBPF-powered APM
• eBPF network metrics

Use cases

This solution addresses critical challenges for platform engineers:

• Faster troubleshooting: Correlate application telemetry with infrastructure and network insights. This enables rapid diagnosis of performance issues, especially those that originate in the underlying system.

• Automatic discovery: Get automated observability with zero instrumentation. The eBPF agent continuously identifies and maps all running services and their dependencies, providing a real-time architectural view of new or unknown workloads without requiring prior knowledge of the application's language.

• Unified monitoring: Monitor applications written in any language across diverse environments. This gives you consistent visibility and service-level performance analysis directly within the New Relic user interface.

eBPF APM

The New Relic eBPF APM is our standard for no-code, language-agnostic application monitoring. It automatically discovers all services running on your hosts or Kubernetes nodes and populates the New Relic APM UI with performance data. This capability is ideal for getting a complete inventory of all your services, including those you cannot instrument manually, such as unknown workloads or third-party applications. For more information, refer to eBPF APM.

eBPF network metrics

The eBPF network metrics provides deep visibility into the network communication of your applications. It captures granular TCP, IP, and DNS telemetry directly from the kernel, solving a major source of application performance issues. This capability is complementary to APM (both eBPF APM and traditional APM) and works independently to give you a complete picture of your application's communication health, helping you definitively answer the question: "Is it the application or the network?"

Deployment flexibility

• For existing New Relic APM customers: You can enable eBPF network metrics alongside your existing APM agents to gain network-layer visibility without disrupting current instrumentation. The eBPF agent operates in network-only mode, complementing your APM data with kernel-level network insights.

• For comprehensive monitoring: Deploy the full eBPF agent with both eBPF APM and network metrics capabilities for complete observability across application, infrastructure, and network layers.

To view the network metrics, refer to network-metrics documentation.

How you can set up the eBPF agent

You can set up the New Relic eBPF agent on your Linux host or Kubernetes cluster.

Related articles