If you experience issues when installing or running the Python agent on a new host, test that the package is installed correctly and that it can contact New Relic's data collector service. If the data collector service is unreachable, it may be due to a blocked firewall. Perform these network connectivity tests to narrow down the cause of the problem.
Test connection to New Relic
The Python agent includes a built-in test app that can verify your connection to the New Relic collector. To verify with the test app, run this command with the path to your New Relic config file:
newrelic-admin validate-config LOCATION_OF_NEWRELIC.INI
This runs a test using the Python agent. The agent will report the sample data to the account that corresponds to the agent config file, and a test app named
Python Agent Test for the reported sample data will appear in the New Relic APM UI.
After the test is completed, the UI will show the app as inactive. Follow standard procedures to delete the test app from the New Relic APM index.
Check log for errors
If no data is transferred to the UI after five minutes, check the messages output from the test as well as the log file produced. If you encounter any problem that suggests an issue with being able to reach New Relic's data collector service, then try these troubleshooting procedures:
Here are examples of error messages you may find.
- A license key was not added to the agent configuration file.
ERROR - No license key was set in agent configuration.
Ensure that the license key has been specified in the agent configuration file or via the
NEW_RELIC_LICENSE_KEYenvironment variable. Correct the problem with the license key, or get support at support.newrelic.com.
- An invalid license key was added to the agent configuration file.
ERROR - Data collector indicates that an incorrect license key has been supplied by the agent.
- The data collector service cannot be contacted.
ERROR - Unable to register application for test, connection could not be established within 30.0 seconds.
This is a fallback message when a connection cannot be established. It indicates that the data collector service cannot be reached or there is an issue in resolving the hostname for the data collector host.
WARNING - Data collector is not contactable.
This is either due to a network issue or the data collector being restarted. If contact cannot be made after a period of time, get support at support.newrelic.com.
ERROR - ConnectionError(MaxRetryError('Max retries exceeded for url: ...,),)
This generally occurs when New Relic's data collector service is temporarily unavailable. Retry the test.
Verify network configuration
To verify the network connection, run the following:
newrelic-admin network-config newrelic.ini
Look for results similar to this:
host = 'collector.newrelic.com' port = 0 proxy_host = None proxy_port = None proxy_user = None proxy_pass = None ssl = True
- Port: A value of
0for the port setting indicates that the appropriate port, such as 80 or 443, will be used depending on whether or not SSL is enabled.
- Proxy: If you have configured the agent to use a proxy, make sure the proxy settings reflect this. If no proxy settings are specified but any HTTP connections to the wider Internet are necessary, then make sure the appropriate proxy settings appear in the agent configuration file.
Check hostname lookup
If the data collector appears unreachable:
- Check that the hostname for the primary data collector host can be resolved with UNIX system tools such as dig or nslookup.
- If this does not succeed, check the configuration of any domain name resolver files for your host.
Here is an example:
$ dig collector.newrelic.com ; <<>> DiG 9.8.3-P1 <<>> collector.newrelic.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62183 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 4 ;; QUESTION SECTION: ;collector.newrelic.com. IN A ;; ANSWER SECTION: collector.newrelic.com. 2453 IN A 188.8.131.52 ;; AUTHORITY SECTION: newrelic.com. 1163 IN NS ns2.p21.dynect.net. newrelic.com. 1163 IN NS ns1.p21.dynect.net. newrelic.com. 1163 IN NS ns4.p21.dynect.net. newrelic.com. 1163 IN NS ns3.p21.dynect.net. ;; ADDITIONAL SECTION: ns1.p21.dynect.net. 3198 IN A 184.108.40.206 ns2.p21.dynect.net. 8576 IN A 220.127.116.11 ns3.p21.dynect.net. 7364 IN A 18.104.22.168 ns4.p21.dynect.net. 8576 IN A 22.214.171.124 ;; Query time: 22 msec ;; SERVER: 192.168.178.1#53(192.168.178.1) ;; WHEN: Tue Jun 11 18:58:23 2013 ;; MSG SIZE rcvd: 206
Check network traffic routing
New Relic agents require your firewall to allow an outgoing connection to New Relic's network:
- TCP port 443 if using HTTPS over a SSL connection
- TCP port 80 if using a plain HTTP connection
If the hostname for the data collector host can be resolved, use UNIX system tools such as ping and traceroute to determine if network traffic can be routed to it. The network traffic path will vary. As long as the path reaches the final intended host, the length of the path and its hosts are not important.
If you cannot contact the data collector host, configure the agent to use any firewall HTTP proxy, or open the required outgoing ports in the firewall to allow connections to the data collector.
$ ping collector.newrelic.com PING collector.newrelic.com (126.96.36.199): 56 data bytes 64 bytes from 188.8.131.52: icmp_seq=0 ttl=239 time=234.204 ms 64 bytes from 184.108.40.206: icmp_seq=1 ttl=239 time=230.095 ms ...
When using traceroute, tell it to use ports 80 and 443.
$ traceroute -p 80 collector.newrelic.com traceroute to collector.newrelic.com (220.127.116.11), 64 hops max, 52 byte packets 1 ... 2 ... 3 ... 4 * * * 5 collector.newrelic.com (18.104.22.168) 232.590 ms 231.000 ms 232.041 ms $ traceroute -p 443 collector.newrelic.com traceroute to collector.newrelic.com (22.214.171.124), 64 hops max, 52 byte packets 1 ... 2 ... 3 ... 4 * * * 5 collector.newrelic.com (126.96.36.199) 253.513 ms 231.134 ms 232.511 ms