New Relic Performance Engineer cheat sheet

Apdex = (satisfied + tolerating/2) / total requests; satisfied ≤ T, tolerating is T to 4T, frustrated > 4T, where T is the apdex threshold in seconds.

Transaction trace captures a single slow request with segment breakdown; distributed tracing stitches segments across services via trace.id and span.id headers (W3C traceparent supported).

Error rate = error transactions / total transactions; error groups cluster by error class plus stack trace fingerprint, not by message text alone.

Throughput is measured in rpm (requests per minute); response time percentiles (p50/p95/p99) are computed from the transaction event stream, not averages.

Key transaction designation pins a business-critical transaction for separate alerting and dashboards; non-key transactions roll into the app-wide aggregate.

APM 360 bundles APM plus infrastructure, browser, mobile, synthetics, and applied intelligence; the entity is the unit of correlation across all signals.

External service segments show downstream dependency latency; database segments split into query time and connection/acquire time.

Thread profiler samples JVM/CLR stack traces to attribute CPU time to methods; it complements transaction traces when no single slow request dominates.

Service level objectives (SLOs) are defined on a good-events/total-events ratio over a rolling window; error budget remaining = 1 − (bad events / allowed bad events).

Browser (RUM) metrics: LCP, FCP, CLS, INP, TTFB come from real user sessions; Core Web Vitals thresholds are LCP ≤ 2.5 s, CLS ≤ 0.1, INP ≤ 200 ms at the 75th percentile.

Synthetic monitors run scripted or ping checks from public or private locations; they detect availability and step-level failures independent of real traffic volume.

Private locations are containers/agents you host, used for internal endpoints and to control source geography; public locations are managed by New Relic.

Session traces reconstruct a single user session's page loads, AJAX calls, and JS errors; session replay extends this with a visual reconstruction.

JS errors group by error message plus stack hash; source maps must be uploaded to de-minify minified bundle stack traces.

Browser instrumentation uses a JS agent snippet injected via the APM agent auto-injection or manually; the browser app entity links to the backend APM app through distributed tracing headers.

Mobile (Android/iOS) monitoring captures crashes, handled exceptions, HTTP requests, and mobile-specific vitals; crash symbolication requires dSYM (iOS) or mapping files (Android).

Synthetic broken links and certificate-check monitors validate availability without executing user flows; scripted browser monitors use Selenium-style steps with assertions.

Applied Intelligence alert policies evaluate static (threshold) or anomaly (baseline) conditions; anomaly conditions learn a seasonal baseline per signal and fire on deviation outside the learned band.

Alert severity levels are Critical, Warning, and Info; each condition produces incidents grouped by policy and condition, and incidents auto-close when the condition clears.

NRQL alert conditions evaluate a query over an aggregation window with a sliding window; the evaluation offset must exceed the aggregation window to avoid partial data.

Muting rules suppress notifications for a defined scope and schedule without deleting the condition; they do not stop incident creation unless configured to.

Workloads group entities for prioritized alerting and health rollup; a workload's health is the worst status among its member entities unless custom weighting is applied.

AI-assisted anomaly detection requires a learning period (typically days) before baselines stabilize; newly created signals will not fire anomaly conditions reliably.

Dashboards and alert conditions both consume NRQL; a condition's query must return a single scalar per evaluation to compare against thresholds.

Notification channels (destinations) route incidents to email, webhooks, Slack, PagerDuty, or ServiceNow; workflows bind a destination to a filter on incident attributes.

Infrastructure agent reports SystemSample (CPU, memory, disk, network) and ProcessSample events; host not reporting alerts fire when no data arrives for a configured threshold.

Dimensional metrics (Metric API) use the pattern metricName{tag1: value} and are queried with FROM Metric; they differ from event-based Infrastructure data queried with FROM SystemSample.

Container monitoring: Kubernetes integration collects K8sNodeSample, K8sPodSample, and K8sContainerSample; the nri-kubernetes integration runs as a DaemonSet.

Cloud integrations (AWS, Azure, GCP) poll provider APIs and ingest metrics at provider granularity (often 1–5 minutes), so they are not real-time.

Golden signals for hosts: CPU utilization, memory used %, disk I/O wait, network throughput, and filesystem free space; alert on sustained deviation, not single samples.

Prometheus/OpenMetrics endpoints can be scraped via the Prometheus integration or pushed via the Metric API using the dimensional metric data format.

Entity relationships: a host entity hosts application entities; the infrastructure agent and APM agent on the same host auto-correlate via the hostname and entity synthesis rules.

Synthetic and infrastructure data share the entity model, so a host's health rolls up to the workload and appears in the entity explorer.

Logs are ingested via the infrastructure agent (fluent-bit based), the Log API, or forwarders; they land in the Log event type and are queried with FROM Log.

Log parsing rules transform raw messages into attributes at ingest; parsing happens before storage, so unparsed fields are only searchable as the raw message.

Log-to-metric and log-to-event rules create metrics or events from log patterns, enabling alerting on log content without storing high-cardinality data as metrics.

Data retention differs by signal: APM and infrastructure events are short-lived, while metrics and logs have plan-dependent retention; the NRQL query window is bounded by retention.

NRQL clauses: SELECT ... FROM ... WHERE ... FACET ... TIMESERIES ... SINCE ... UNTIL ... LIMIT; FACET splits results into series, TIMESERIES buckets by time.

Cardinality: high-cardinality attributes (user IDs, request IDs) inflate metric and event storage; use them in logs or as FACET dimensions sparingly.

The NerdGraph GraphQL API manages entities, dashboards, alert policies, and account settings; the REST API (v2) handles ingest and some legacy queries.

Account structure: accounts roll up to an organization; data access is scoped by account, and cross-account queries require the appropriate role and account ID.