Skip to main content

New Relic

SocketX ships JSON logs to stdout/stderr, which New Relic parses into Log event attributes automatically — including the nested audit object as dotted attributes (audit.duration_seconds, audit.messages_to_client, …). The ready-made dashboard works with both v1 and v2 servers.

Download​

1. Ship the logs​

Keep USE_CONSOLE_LOGS=false (the default) in production. Then pick your deployment:

Docker / on-premise​

Use the New Relic Infrastructure agent with log forwarding — a logging.d config that tails the container log files — or run Fluent Bit with the newrelic output plugin and your license key.

AWS (ECS / CloudWatch)​

Keep the awslogs driver from the standard SocketX task definition and stream the CloudWatch log group to New Relic with either:

  1. Amazon Kinesis Data Firehose with the New Relic logs destination (recommended), or
  2. the newrelic-log-ingestion Lambda subscribed to the log group.

No change to the app or task definition.

Azure AKS / Kubernetes​

Install the nri-bundle Helm chart with logging enabled — a Fluent Bit DaemonSet ships all container stdout:

helm install newrelic-bundle newrelic/nri-bundle \
  --set global.licenseKey=<NEW_RELIC_LICENSE_KEY> \
  --set global.cluster=<CLUSTER_NAME> \
  --set newrelic-logging.enabled=true
tip

Tag the source with service: socketx-server in your forwarder config (Fluent Bit record_modifier, Firehose metadata, or logging.d attributes). v2 log lines carry the service field themselves; v1 lines do not.

2. Parsing and timestamps​

No parsing rules are needed — JSON fields become queryable Log attributes, and numeric fields (duration_ms, payload_size_bytes, audit.*) work with NRQL aggregate functions directly.

Timestamps: v2 emits time in Unix milliseconds, which New Relic maps to the event timestamp natively. v1 emits Unix seconds — if v1 lines show ingestion time instead of event time, add a log parsing rule mapping time to timestamp, or accept ingestion-time ordering.

3. Import the dashboard​

  1. Open the downloaded JSON and replace every "accountIds": [0] with your New Relic account ID (one find-and-replace).
  2. Go to Dashboards → Import dashboard and paste the JSON.

The dashboard mirrors the Grafana dashboard: billboards for totals and averages, time series for connections, latency percentiles (percentile(duration_ms, 95, 99)), throughput and direction, a recovery events chart faceted by recovery_action, and tables of recent session audits and MTE/recovery events.

4. Alerting​

Create NRQL alert conditions (Alerts → Alert conditions); thresholds are starting points:

-- Recovery event rate is elevated (critical: > 10 in 5 minutes)
SELECT count(*) FROM Log WHERE event_type = 'socketx_recovery'

-- Permanent connection failures (critical: > 0 in 5 minutes)
SELECT count(*) FROM Log WHERE recovery_action = 'fail_permanently'
  OR audit.recovery_action = 'fail_permanently'

-- Error-level log spike (critical: > 20 in 5 minutes)
SELECT count(*) FROM Log WHERE service = 'socketx-server' AND level = 'error'

The last condition uses the v2 service field — for v1, scope it with whatever service tag your forwarder applies.

5. Control ingest cost​

MTE operation events are emitted per proxied message and New Relic bills per ingested GB. Recommended, in order:

  1. Events-to-metrics rules: create a counter over MTE event logs and summary metrics on duration_ms / payload_size_bytes, then add a drop rule (or shorter retention) for the raw MTE event logs.
  2. Server-side sampling (v2): set MTE_EVENT_SAMPLE_RATE (e.g. 0.1). Count/sum widgets then show the sampled fraction; the close-time audit totals are never sampled and stay exact. See Configuration.