eBPF logs

The New Relic eBPF agent can now collect your application logs directly from the same host or container where it already collects APM and network telemetry, using kernel-level visibility instead of "tailing" log files like a traditional forwarder. This gives you:

• Automatic metadata enrichment: Enriches captured logs with New Relic metadata by default, giving you troubleshooting context alongside the same agent's APM and network telemetry, with no customer configuration required.
• One fewer agent to manage: Eliminates the resource contention, correlation gaps, and maintenance overhead of running a dedicated log forwarder (such as Fluent Bit) next to the eBPF agent.
• A smaller attack surface: Removes the plugin-based logging middleware that a separate forwarder depends on, reducing both CVE exposure and dependencies on third-party log forwarding plugins.

Set up eBPF logs

transform/Logs:
  log_statements:
  - statements:
    - replace_pattern(log.body, "password:[^,]+", "password:***")
    conditions:
    - IsMatch(log.body, "password:")

Turn on eBPF logs by completing these steps:

1. Update your eBPF agent to version 1.5.0 or later, which New Relic recommends for log reporting.

   • For Kubernetes, refer to Upgrade the eBPF agent.
   • For Linux hosts, refer to Upgrade the eBPF agent.

2. Set the following parameters:

   • reportLogs: Set to "auto" or "true" to turn on log collection (see Automatic detection and backoff below for what each value does).
   • logDataFilters.applicationLogReporting.enabled: Confirm this is true (its default value), or set it explicitly if you've customized your configuration.

   For the full list of log-related parameters, refer to the Configuration parameters section of the Linux installation or Kubernetes installation guide.

3. Restart the eBPF agent.

Automatic detection and backoff

To avoid sending duplicate telemetry, the eBPF agent can automatically detect whether another agent is already reporting logs for an entity and back off accordingly. This is the same pattern it already uses for APM data and network metrics.

The reportLogs parameter accepts:

• "auto": The eBPF agent's behavior depends on the attached agent type:
  • New Relic APM agent: The eBPF agent collects and reports logs only if the APM agent isn't actively collecting or forwarding logs. If it detects active log collection from the APM agent, it suppresses its own to avoid duplication.
  • OpenTelemetry agent: The eBPF agent suppresses log collection entirely whenever an OpenTelemetry agent is attached.
• "true": The eBPF agent always collects and reports logs, regardless of other agents present.
• "false" (default): The eBPF agent never collects or reports logs.

This mirrors how reportApmData and reportNetworkMetrics behave for eBPF APM and network metrics. For the equivalent pattern applied to network metrics, refer to Enable network metrics-only mode.

View your eBPF logs data

You can view eBPF logs in the New Relic UI:

1. Go to one.newrelic.com > APM & Services.
2. Select the entity whose logs you want to view.
3. Click the Logs tab.

eBPF logs currently captures application logs only, and not infrastructure logs.