New Relic APM Practitioner cheat sheet

APM 360 is a paid add-on SKU on top of APM that unlocks error profiles, service levels (SLIs/SLOs), and dependency/domain-level maps; core APM alone does not include those features.

Transaction naming priority: custom transaction name set in code or via API > instrumentation-provided name (framework route, servlet, controller action) > URI-based fallback based on the first path segment.

Apdex formula: (Satisfied + Tolerating/2) / Total, where Satisfied <= T and Tolerating is between T and 4T; the default Apdex T is 0.5 s for web transactions (0.5 s is the New Relic default, configurable per app).

Error rate = error transactions / total transactions for the same time window; errors are counted once per transaction even if multiple exceptions are captured.

Distributed tracing stitches traces across services using the traceparent W3C header (or New Relic's newrelic header when W3C is not enabled); spans roll up into the transaction's trace view.

Thread profiler samples JVM/.NET stacks to attribute CPU time to methods; it is not a heap analyzer - use the JVM heap or GC metrics for memory pressure.

Service levels use SLIs (good events / valid events) with a rolling window; SLOs alert when the SLI budget burn rate exceeds the configured threshold.

Key transaction flag designates a transaction as a separate entity for alerting and Apdex tracking, isolating it from the parent app's aggregate metrics.

Browser and mobile data are correlated to backend APM via the distributed trace header injected into the page or app request, not by matching user IDs.

Browser (RUM) agent captures Core Web Vitals: LCP (largest contentful paint), INP (interaction to next paint, replaced FID), and CLS (cumulative layout shift).

Page load timing phases: DNS, TCP connect, TLS/SSL, request/response, DOM processing, and page render; the browser agent reports them as separate attributes.

The browser agent is injected via a copy/paste JavaScript snippet, the New Relic Browser APM injection for server-side apps, or the New Relic agent for a single-page app (SPA) framework.

Session replay is an opt-in feature on the browser agent; it records DOM mutations rather than video, so it must be enabled explicitly and has privacy masking options.

Mobile agents (Android, iOS, React Native, .NET MAUI, Flutter) report crashes, handled exceptions, network requests, and mobile-specific vitals like app launch time.

Synthetic monitors come in three types: ping (single HTTP request), simple browser (scripted steps), and scripted browser (Selenium-style); they run from public or private (location-based) locations.

Synthetic monitor results feed the same alerting pipeline as APM; a failed monitor creates a SyntheticCheck event with the failure reason and the location that failed.

Real User Monitoring vs synthetic: RUM measures actual user sessions and is subject to sampling; synthetics are deterministic and run on a schedule regardless of traffic.

New Relic AI (the AI assistant) is a natural-language interface over your telemetry; it answers questions and can generate NRQL, dashboards, and alert conditions from prompts.

AI Monitoring (AI/LLM observability) instruments LLM calls to capture model name, token counts, latency, cost, and prompt/response metadata for supported providers.

Applied Intelligence groups related alerts into incidents using correlation rules; it does not replace alert policies, it sits on top of them.

Anomaly detection uses baseline/seasonal models on metric timeseries; it flags deviations from the learned baseline rather than fixed thresholds.

The AI assistant's answers are grounded in the account's data; it does not silently query external sources, so results depend on what telemetry exists in the account.

NRQL generation by AI should be validated against the schema; the assistant can produce syntactically valid queries that reference nonexistent attributes.

Intelligent alerting decisions (open/close/priority) can be driven by incident correlation and anomaly scores, not only by static thresholds.

AI Monitoring supports guardrails/evals for prompt and response safety when configured; treat these as optional instrumentation layers.

The infrastructure agent is a host-level daemon (Linux/Windows) that collects system metrics (CPU, memory, disk, network) and forwards logs and integrations.

Infrastructure integrations are on-host integrations (e.g., MySQL, NGINX, Apache, Redis) that run as part of the agent and report metrics under their own event types.

The Kubernetes integration uses a DaemonSet (for node-level metrics) and a Deployment (for cluster-level metrics and the kube-state-metrics scrape); both are required for full coverage.

Cloud integrations (AWS, Azure, GCP) are pull-based: New Relic polls the cloud provider's APIs via a linked account/role, so no agent is installed on the cloud resource.

Infrastructure alert conditions evaluate a metric over a time window with a threshold and a duration; the duration is the number of minutes the condition must hold before firing.

Host not reporting is a built-in condition type that fires when a host stops sending data for a configured threshold; it is separate from metric-based conditions.

The infrastructure agent configuration lives in newrelic-infra.yml; changes require a service restart, and the agent logs to /var/log/newrelic-infra/newrelic-infra.log on Linux by default.

Metric retention for infrastructure data is shorter than for APM; high-cardinality custom metrics should be aggregated before ingestion to control cost.

Logs in context links log lines to APM transactions via trace/span IDs or entity GUIDs; enabling it requires forwarding the trace context (e.g., via the log forwarder or agent).

The log forwarder (Fluent Bit-based) tails files, applies parsing rules, and ships to New Relic; the infrastructure agent can also forward logs directly.

Log parsing rules transform raw lines into attributes; grok patterns are used for unstructured logs, and the parsed fields become queryable attributes in NRQL.

Log retention is tiered: standard retention is 30 days for logs by default, with extended retention available as a paid option; retention differs from metric retention.

NRQL log queries use FROM Log; common aggregations include count(*), FACET by attribute, and TIMESERIES for trends.

Log-based alert conditions can trigger on a query result (e.g., count of error logs) and are configured in the same alert policy framework as metric conditions.

Dropping/obfuscation rules filter or mask sensitive log data at ingestion; they are configured in the log management settings and apply before storage.

The Logs UI supports live tailing for real-time inspection; live tail does not persist data, it streams matching lines as they arrive.

NRQL is the query language across all data types; SELECT ... FROM ... WHERE ... FACET ... TIMESERIES ... LIMIT is the core clause order.

Entities and the entity explorer model everything (apps, hosts, services, dashboards) as entities with a GUID; relationships between entities power the service map.

Dashboards support three modes: standard (grid), billboard (custom layout), and the newer dashboard with variables; variables are defined as NRQL queries and referenced with {{var}}.

Alert policies contain conditions; conditions produce incidents; incidents are grouped by policy and can be muted or routed via notification channels/workflows.

Workflows (the newer notification system) replace legacy notification channels and support destinations, filters, and enrichment; both may coexist during migration.

The NerdGraph GraphQL API is the programmatic interface for configuration (dashboards, alerts, entities) while the REST API v2 covers ingest and some queries.

Data retention by type: APM/metric data is retained longer than logs; check the current retention table because it changes and differs per data type.

Account structure: an organization contains accounts; users are granted roles (admin, user, restricted) at the account or organization level.

Synthetic and browser data both land in the same event store and are queryable with NRQL alongside APM events; there is no separate query language per product.

APM 360 adds error profiles, service levels, and dependency maps on top of APM; it is a separate SKU and not included in base APM.

Transaction naming precedence: custom name > instrumentation name > URI fallback.

Apdex = (Satisfied + Tolerating/2) / Total; default T = 0.5 s for web transactions.

Distributed tracing propagates via the W3C traceparent header or New Relic's newrelic header.

Key transactions are isolated for alerting and Apdex tracking.

Error rate = error transactions / total transactions in the window.

Thread profiler attributes CPU to methods; it is not a heap analyzer.

Core Web Vitals: LCP, INP (replaced FID), CLS.

Browser agent can be added via snippet, APM injection, or SPA framework agent.

Session replay is opt-in and records DOM mutations with privacy masking.

Synthetic monitors: ping, simple browser, scripted browser.

Synthetics run on a schedule from public or private locations, independent of real traffic.

Mobile agents report crashes, exceptions, network requests, and launch time.

RUM is sampled; synthetics are deterministic.

New Relic AI is a natural-language assistant grounded in account telemetry.

AI Monitoring captures LLM model, tokens, latency, cost, and prompt/response metadata.

Applied Intelligence correlates alerts into incidents via correlation rules.

Anomaly detection uses learned baselines, not fixed thresholds.

AI-generated NRQL must be validated against the schema.

Incident priority can be influenced by correlation and anomaly scores.

Evals/guardrails for prompts are optional instrumentation layers.

Infrastructure agent is a host daemon collecting CPU, memory, disk, network, and logs.

On-host integrations (MySQL, NGINX, Redis) run within the agent.

Kubernetes needs both a DaemonSet and a Deployment for full coverage.

Cloud integrations are pull-based via API polling; no agent on the resource.

Host-not-reporting is a built-in condition separate from metric conditions.

Agent config is newrelic-infra.yml; restart required after changes.

Custom high-cardinality metrics should be aggregated to control cost.

Logs in context links lines to transactions via trace/span IDs or entity GUIDs.

Log forwarder is Fluent Bit-based; the infra agent can also forward logs.

Grok patterns parse unstructured logs into queryable attributes.

Default log retention is 30 days; extended retention is a paid option.

NRQL log queries use FROM Log with count(*), FACET, and TIMESERIES.

Log-based alerts use the same alert policy framework as metric conditions.

Drop/obfuscation rules filter or mask data at ingestion.

NRQL clause order: SELECT ... FROM ... WHERE ... FACET ... TIMESERIES ... LIMIT.

Entities have GUIDs; relationships power the service map.

Dashboard variables are NRQL-defined and referenced as {{var}}.

Alert flow: policy -> condition -> incident -> notification (workflow).

Workflows replace legacy notification channels; both may coexist during migration.

NerdGraph (GraphQL) handles configuration; REST API v2 covers ingest and some queries.

Retention differs by data type; verify the current retention table.

Organization contains accounts; roles are admin, user, or restricted.