Query ATP data in New Relic

Preview

We're still working on this feature, but we'd love for you to try it out!

This feature is currently provided as part of a preview pursuant to our pre-release policies.

ATP collects process metrics through the OpenTelemetry hostmetricsreceiver and enriches them with intelligent filtering metadata. You can query this data to:

Monitor process states and identify stuck or problematic processes
Track how ATP's dynamic thresholds adapt to your workload patterns
Measure filtering efficiency to understand data reduction effectiveness
Detect anomalies and unusual process behavior
Set up alerts for critical process monitoring

All process metrics are available under the process.* namespace in New Relic, with ATP-specific metadata stored in the process.atp field.

Process state monitoring

This query shows you a breakdown of all processes running on your host, categorized by their execution state. It's essential for identifying stuck processes or resource exhaustion.

FROM Metric
SELECT uniqueCount(process.pid) as 'Process Count'
FACET process.state, CASES(
  WHERE process.state = 'R' AS 'Running',
  WHERE process.state = 'S' AS 'Sleeping (Interruptible)',
  WHERE process.state = 'D' AS 'Uninterruptible Sleep (Disk I/O)',
  WHERE process.state = 'Z' AS 'Zombie',
  WHERE process.state = 'T' AS 'Stopped',
  WHERE process.state = 'I' AS 'Idle Kernel Thread',
  WHERE process.state = 'X' AS 'Dead',
  WHERE process.state = 'W' AS 'Paging'
)

ATP intelligence monitoring

This query shows you the current dynamic threshold values compared to actual process metrics, helping you understand how close processes are to triggering ATP actions.

FROM Metric
SELECT
  latest(numeric(jparse(`process.atp`)[threshold_details][`process.cpu.utilization`][threshold])) * 100 AS 'Process CPU Utilization',
  latest(numeric(jparse(`process.atp`)[threshold_details][`process.memory.usage`][threshold])) AS 'Memory Usage'
WHERE host.name = 'YOUR_HOST_NAME'
TIMESERIES MAX

How to use this query:

Replace YOUR_HOST_NAME with your actual host name
You can modify the metric names in the jparse function to track thresholds for other metrics
Watch for patterns where actual values consistently approach threshold values

This query measures how effectively ATP is reducing telemetry volume while retaining critical data.

FROM Metric
SELECT latest(numeric(jparse(`process.atp`)['filtering_summary']['efficiency_ratio'])) * 100 as 'Filtering Efficiency'
WHERE metricName like 'process.%'
AND `process.atp` IS NOT NULL

Anomaly detection queries

This query visualizes how frequently ATP detects anomalies across different executables, helping you identify which processes are most prone to unusual behavior.

FROM Metric
SELECT latest(numeric(jparse(`process.atp`, 'filtering_summary.stage_hits.anomaly_detection'))) AS 'Anomaly Count'
WHERE metricName like 'process.%'
FACET process.executable.name
TIMESERIES MAX

This query highlights specific processes that have experienced memory usage anomalies detected by ATP.

FROM Metric
SELECT max(process.memory.usage) as 'Memory Usage'
WHERE metricName = 'process.memory.usage'
AND numeric(jparse(`process.atp`)['filtering_summary']['stage_hits']['anomaly_detection']) > 0
AND process.atp IS NOT NULL
FACET process.pid, process.executable.name, host.name
TIMESERIES MAX

This query shows processes that have experienced CPU utilization anomalies.

FROM Metric
SELECT max(process.cpu.utilization) * 100 as 'CPU Utilization'
WHERE metricName like 'process.cpu.utilization'
AND numeric(jparse(`process.atp`)['filtering_summary']['stage_hits']['anomaly_detection']) > 0
AND process.atp IS NOT NULL
FACET process.pid, process.executable.name, host.name
TIMESERIES MAX

Note: You can modify these queries to monitor anomalies in any other process metric by changing the metricName filter.

Performance monitoring

This query tracks the rate of context switching per process. High context switch rates often indicate CPU contention or inefficient multi-threading.

SELECT rate(sum(process.context_switches), 1 minute) AS 'Context Switches/min'
FROM Metric
WHERE metricName = 'process.context_switches'
FACET process.executable.name, process.pid
TIMESERIES MAX

Setting up alerts

Use this query to create an alert that triggers when process telemetry stops flowing entirely, indicating potential agent failure or network issues. For more information to setting up alerts, see Creating alert conditions.

FROM Metric
SELECT count(*)
WHERE metricName LIKE 'process.%'

ATP for host

Learn about setting up ATP for your host environment.

ATP for Kubernetes

Learn how to set up the ATP for your Kubernetes environment.

Advanced-features

Learn how to enable advanced features for your ATP deployment.

Preview

Process state monitoring

Process distribution by state

ATP intelligence monitoring

Dynamic thresholds tracking

ATP filtering efficiency

Anomaly detection queries

Anomaly count over time

Memory usage anomalies

CPU usage anomalies

Performance monitoring

Context switches per minute

Setting up alerts

Data gap alert

ATP for host

ATP for Kubernetes

Advanced-features

Query ATP data in New Relic

Preview

Process state monitoring .css-21sua1{background:none;border:none;width:0;padding:0;}

ATP intelligence monitoring

Dynamic thresholds tracking

ATP filtering efficiency

Anomaly detection queries

Anomaly count over time

Memory usage anomalies

CPU usage anomalies

Performance monitoring

Context switches per minute

Setting up alerts

Data gap alert

Related resources

ATP for host

ATP for Kubernetes

Advanced-features

Process state monitoring