New Relic: Infrastructure and APM Agents

New Relic One is a hosted observability platform: agents on your servers and in your applications send metrics, traces, events and logs to one place, and you query them with the same language (NRQL, next post). The free tier includes 100 GB of data ingest per month and one full platform user (plus unlimited basic users at the time of writing), which is enough to learn the product and monitor a small service. Check the pricing page for current terms.

Versions in use on this date. Ubuntu 22.04 LTS hosts with the current infrastructure agent (it supports 22.04) and a current New Relic Node.js agent on Node.js 18. Pin the agent version in your package manager or package.json and read release notes before upgrading.

What sends what

flowchart TB
  subgraph HOST[Linux host - Ubuntu 22.04]
    INFRA[newrelic-infra service<br/>host, process and network metrics] 
    APP[Node.js app with newrelic module<br/>transactions, errors, traces]
    LOGS[Log forwarder optional<br/>tails files and journald]
  end
  INFRA -->|HTTPS 443, licence key| NR[(New Relic One<br/>region US or EU)]
  APP -->|HTTPS 443| NR
  LOGS -->|HTTPS 443| NR
  NR --> UI[Infrastructure, APM, Logs views]
  NR --> Q[NRQL queries, dashboards]
  NR --> AL[Alert conditions and workflows]
  AL --> N[Slack, email, PagerDuty]

Host metrics with the infrastructure agent

The guided installer needs a user API key and your account ID (Profile, API keys), and it installs the agent as a systemd service:

curl -Ls https://download.newrelic.com/install/newrelic-cli/scripts/install.sh | bash
sudo NEW_RELIC_API_KEY=<user-api-key> NEW_RELIC_ACCOUNT_ID=<account-id> NEW_RELIC_REGION=US \
  /usr/local/bin/newrelic install -n infrastructure-agent-installer
sudo systemctl status newrelic-infra
sudo journalctl -u newrelic-infra --since "10 min ago"

Piping a script to bash is convenient but you are trusting the download; in production review the script first or use the package repository (apt) directly and manage the agent with your configuration tool. Use NEW_RELIC_REGION=EU for EU data centre accounts.

Configuration lives in /etc/newrelic-infra.yml:

license_key: <ingest-licence-key>
display_name: shop-api-web-1
custom_attributes:
  environment: production
  service: shop-api
  team: platform
log:
  level: info
disable_cloud_metadata: false

Tags such as environment and service are what make hosts filterable later. A new host appears under Infrastructure, Hosts within a few minutes with CPU, memory, disk, network and process data. Cloud integrations (for example the AWS integration) add metadata like instance type and region.

Open egress to New Relic over HTTPS 443 only; the agent does not need inbound ports. If your hosts use a proxy, set proxy: in the config file.

Application traces with the Node.js agent

npm install newrelic
cp node_modules/newrelic/newrelic.js .

Keep secrets out of the file and use environment variables:

// newrelic.js
'use strict'
exports.config = {
  app_name: [process.env.NEW_RELIC_APP_NAME || 'shop-api'],
  license_key: process.env.NEW_RELIC_LICENSE_KEY,
  distributed_tracing: { enabled: true },
  logging: { level: 'info' },
  allow_all_headers: false,
  attributes: { exclude: ['request.headers.cookie', 'request.headers.authorization', 'response.headers.setCookie*'] }
}

Load the agent before any other module:

export NEW_RELIC_APP_NAME=shop-api-production
export NEW_RELIC_LICENSE_KEY=<ingest-licence-key>
node -r newrelic server.js
# or as the first line of server.js: require('newrelic')

In a systemd unit, put the variables in an EnvironmentFile with mode 0600, and in containers pass them as secrets rather than baking them into the image. APM then shows response time, throughput, error rate, slow transactions, database and external call breakdowns, and distributed traces across services.

Add deployment markers from your pipeline so you can see which release changed behaviour (the Change Tracking API or the newrelic deployment command).

Control what you send (and pay for)

Ingest is billed per GB, so volume discipline matters from day one:

Source	How it grows	Control
Logs	Verbose debug logs, health checks	Filter or drop noisy lines at the forwarder, log at `info`, use drop rules
Infrastructure	Processes sampled on big hosts	Limit process metrics with `enable_process_metrics` and include/exclude lists
APM	High traffic, many attributes	Sampling for traces, exclude large attributes, avoid per-user custom attributes
Custom events	Loops that send events per request	Batch, aggregate before sending

Check Data management, Data ingestion weekly at the start, set a usage alert for your monthly limit, and review which accounts or services produce the most. Verbose logs are the usual cause of surprise overages.

Security and privacy

Treat the licence key and user API keys as secrets; use separate keys per environment and rotate if leaked.
Never send personal data, tokens or full request bodies; use the attribute exclusion settings above.
Restrict who can create API keys and who has full platform access; use SSO if your plan includes it.

Troubleshooting missing data

Symptom	Check
Host never appears	`systemctl status newrelic-infra`, correct licence key and region, outbound 443 allowed
Host appears twice	Display name or cloud metadata changed; set a stable `display_name`
APM app missing	Agent required first, correct `app_name`, licence key set, `logs/newrelic_agent.log` for errors
Traces without database detail	Unsupported driver version; check agent compatibility notes
Gaps in charts	Host clock skew, network drops; check NTP and agent log

Enable debug logging temporarily (logging.level: debug), reproduce, then turn it back down. Never leave it on, since it increases volume and may expose sensitive details.