New Relic Reliability Engineer flashcards

34 cards. Read the term and the definition here. The deck at the top of this page is optional.

Apdex formula

Apdex equals satisfied plus half the tolerating transactions, divided by total transactions. Satisfied is response time at or below T, tolerating is above T up to 4T; T defaults to 0.5 seconds for web transactions.

APM 360 components

APM 360 bundles core APM with Error Tracking, Service Levels, Application Security, and CodeStream integrations. The APM agent must be installed first, because every bundled capability depends on the transaction data it reports.

Distributed trace stitching

A trace.id propagates across services so spans from different agents join one distributed trace. This stitching builds the service map and lets you follow a slow request from the frontend through every downstream call.

Error group fingerprint

Error Tracking groups occurrences by a fingerprint derived from the error class and stack. Triage operates on the group, and marking it resolved or ignored changes status only, leaving the underlying error events intact.

Service level error budget

An SLI is good events divided by valid events, measured against an SLO target over a rolling window such as 28 days. The error budget equals one minus the target, so a 99.9% SLO allows 0.1% bad events.

Transaction sampling default

APM agents report roughly ten percent of non-error transactions as traces by default, while error transactions are captured more aggressively. Metrics are extrapolated from all transactions, so trace counts differ from throughput counts.

Browser agent injection modes

Browser monitoring can be auto-instrumented through the APM agent, which injects the JavaScript, or deployed as a standalone browser agent snippet. The standalone agent works without APM, which suits static or third-party-hosted pages.

Core Web Vitals thresholds

Largest Contentful Paint is good at 2.5 seconds or less, Interaction to Next Paint is good at 200 milliseconds or less and replaced First Input Delay in 2024, and Cumulative Layout Shift is good at 0.1 or less.

PageView timing attributes

Browser PageView events carry duration, timeToFirstByte, firstContentfulPaint, largestContentfulPaint, and interactionToNextPaint. Query these attributes with NRQL to break down frontend performance by page, geography, or browser.

JavaScript source maps

Minified JavaScript stacks are unreadable until source maps are uploaded to New Relic. Source maps translate minified frames back to original file, line, and function, which makes JavaScriptError grouping and triage actionable.

Synthetic monitor types

Simple monitors ping a host, browser monitors run scripted user journeys, and API monitors execute multi-step HTTP checks. All three run on scheduled intervals from public or private minion locations and emit SyntheticCheck events.

Session trace versus replay

A session trace is a sampled waterfall of a single page load showing resource timing. Session replay records DOM interactions over a session and is privacy-gated by masking rules configured per browser application.

RUM versus synthetic tradeoff

Real user monitoring reflects actual traffic but is affected by ad blockers and sampling. Synthetic monitoring is deterministic, location-controlled, and scheduled, making it better for baselines and uptime checks than for population statistics.

AI assistant NRQL generation

The New Relic AI assistant converts natural-language questions into NRQL and runs it within the asking user's permissions. Generated queries should be reviewed for correct event types, time ranges, and facets before reuse.

Baseline anomaly conditions

Baseline alert conditions learn each entity's normal behavior and fire when actual values deviate from the predicted baseline. This replaces hand-tuned static thresholds and adapts automatically to seasonal traffic patterns.

Applied Intelligence correlation

Applied Intelligence detects anomalies and correlates related signals into issues rather than isolated alerts. Related-entity analysis compares signals across a service topology to suggest probable root causes during an incident.

Deployment markers in correlation

Deployment and Change events annotate dashboards with release timestamps. Correlating them with shifts in error rate or latency quickly links a regression to a specific deploy, and markers are written through NerdGraph mutations.

Workflows versus alert policies

Alert policies contain conditions that evaluate queries and open incidents. Workflows then decide what happens to those incidents, such as filtering by severity and sending notifications to Slack, PagerDuty, email, or webhooks.

AI prompt data hygiene

Never place secrets, credentials, or personal data into AI prompts. AI features operate within the account data boundary and honor the same role-based access controls as the rest of the platform.

Infrastructure agent event types

The host-based infrastructure agent reports SystemSample for CPU, memory, and load, ProcessSample for individual processes, StorageSample for disk, and NetworkSample for interfaces. On-host integrations add their own event types.

Cloud integration polling model

AWS, Azure, and GCP integrations are polled by New Relic through read-only credentials or a linked account. Unlike the infrastructure agent, nothing is installed on the monitored cloud resources to push data.

Kubernetes integration events

The Kubernetes integration deploys a DaemonSet plus kube-state-metrics and reports K8sNodeSample, K8sPodSample, and K8sDeploymentSample events. Cluster explorer views and pod-level alerting build on these event types.

Host not reporting signal

The infrastructure agent sends a regular heartbeat. When no data arrives for a configured period the host is flagged as not reporting, and alert conditions can target that signal to catch silent agent or host failures.

Infrastructure tagging strategy

Apply consistent tags such as environment, team, and service through agent configuration or cloud resource tags. Tags drive entity grouping, dashboard filtering, and alert scope, so inconsistent tagging breaks all three.

Log event structure

Each ingested log line becomes a Log event carrying message, level, and timestamp plus attributes. Adding entity.guid or trace.id links the log to an APM entity or a specific distributed trace for correlation.

Grok log parsing

Grok patterns and built-in parsing rules extract structured attributes from unstructured log messages. Extracted fields become queryable in NRQL, enabling facets and filters that raw message text cannot support.

Log patterns clustering

Log patterns cluster similar messages into templates so high-volume logs can be triaged by pattern instead of individual lines. This surfaces new or spiking message shapes that would be lost in raw counts.

Drop filters and partitions

Drop filters discard matching log events at ingest to control cost. Data partitions split data into named partitions with independent retention, which is how security logs get longer retention than application logs.

Alert condition evaluation window

A condition combines a sliding aggregation window, a threshold, and a duration. The aggregation type, such as average, sum, or count, must match the signal, or the condition fires on the wrong statistic.

OTLP ingest mapping

New Relic accepts OTLP over HTTP or gRPC using a license key. OpenTelemetry spans map to Span events and metrics map to dimensional Metric data, while service.name becomes the entity name and resource attributes become tags.

NerdGraph GraphQL API

NerdGraph is the GraphQL API behind dashboards, alert policies, entities, and deployment markers. The New Relic CLI and Terraform provider call it, making it the path for programmatic and infrastructure-as-code management.

Fleet Control purpose

Fleet Control centrally manages agents and integrations across many hosts using fleet policies. It supports version pinning and staged rollouts, so upgrades apply by policy instead of host by host, and hosts report health and version.

Exposure-based risk prioritization

Security risk ranking weighs severity, exploitability, and runtime exposure. A vulnerability in a library used by an internet-facing, high-traffic service outranks the identical vulnerability sitting in an unused dependency.

Runtime evidence in security

Runtime evidence shows which service actually calls a vulnerable code path. Static scanner findings without runtime exposure are deprioritized, because the vulnerable code may never execute in production traffic.