New Relic Infrastructure provides unprecedented data from your entire system by running comfortably on your hosts. In order to obtain this data, the agent must run as root.
Secure agent communication
Every piece of information exchanged between your hosts and the Infrastructure agent is delivered securely. All communication from the agent occurs over HTTPS, using Transport Layer Security (TLS). To ensure secure communication, the New Relic Infrastructure agent was designed with the following protective measures:
- All communication is established directly from the agent to the service.
- The agent does not require any incoming ports to be opened.
- The agent is read-only and cannot make changes to your system.
The infrastructure agent does not support high security mode.
Running as root
The Infrastructure agent must be run as root to deliver key pieces of your in-depth data. This includes user sessions, package information, file changes, kernel settings, etc.
New Relic is committed to the security of your data. All data derived while running as root is protected, and used only to deliver information related to your infrastructure back to you.
Sources of data collection
The Infrastructure agent gathers metrics, events, and inventory data from a variety of OS sources. While some of these sources can be read from a non-privileged account, others require elevated privileges.
For current agent versions, New Relic requires that it run as the root user (on Linux) or with full Administrator access (Windows). Here are additional details about how the Infrastructure agent accesses default directories and what packages and commands it uses.
- Default directories accessed by the agent
Unless otherwise noted, this information applies to any Linux operating system.
Directory or file Purpose Linux OS
Default configuration file any
Default binary install location any
Default inventory cache and plugin binaries any
Default pid file any
Depending on configuration, the agent writes logs to
stdout, which may connect to your system logging service
- Packages and commands used by the agent
Some data sources are specific to particular operating systems. Unless otherwise mentioned, New Relic Infrastructure uses the source on all variations of an operating system when the related software is detected. Many of the tools are on a path accessible to the agent. If not otherwise indicated, the Infrastructure agent typically searches for them in
New Relic uses some tools or data sources to gather information for multiple Infrastructure features. Here are some primary use cases. Unless otherwise noted, New Relic uses this information primarily for Infrastructure’s Inventory page.
Plugin or data Tool, directory, or file Linux OS
sestatus -b, semodule -l
dpkg-query -W -f
facter -p -j
any Various plugins gather system-wide details through this directory. Used for Infrastructure Inventory and metrics.
any Various plugins gather
sysctlsettings through this directory. Used for Infrastructure Inventory and metrics.
any Various plugins (
hostinfo) read specific configs in this directory. Used for Infrastructure Inventory and metrics.
External agent connections
The agent periodically sends JSON-formatted data describing compute metrics, events, and your inventory configuration to the Infrastructure endpoint at New Relic. These communications are associated with the agent using the License key generated for your account. Once New Relic Infrastructure receives data from any external agent, it will display the new metrics, events, or configuration data in the Infrastructure UI.