Route the New Relic Infrastructure agent through Sawmills

This guide routes New Relic Infrastructure agent traffic through Sawmills. Sawmills processes the metric samples and sends them to New Relic in their native format. It proxies identity, command, inventory, and security requests to the correct New Relic service.

Infrastructure agent
  -> Sawmills Collector
     -> processors -> New Relic Infrastructure data endpoint
     -> identity, commands, inventory, and security -> New Relic service endpoints

Prerequisites

Sawmills Collector v1.1097.0 or later
A pipeline with a New Relic source and New Relic destination
The same New Relic ingest license key in the Infrastructure agent and New Relic destination
Network access from the agent pods to the Sawmills HTTPS endpoint
newrelic-infrastructure Helm chart 4.0.1 or later

The validated target is nri-bundle chart 7.0.4, which contains newrelic-infrastructure chart and nri-kubernetes image 4.0.1.

1. Enable the Infrastructure source

Edit the New Relic source and turn on Enable Infrastructure agent. Keep the default advanced paths and upstream URLs for the first test. The source configuration contains:

infra_enabled: true

Configure a New Relic destination in the same pipeline. Its License Key must be the exact ingest license key that the Infrastructure agent uses. Deploy the pipeline and collector.

2. Copy the correct collector endpoint

Open the collector details. In New Relic ingestion endpoints, copy the URL with type Infrastructure agent. The URL has this format:

https://<collector-id>.collectors.sawmills.ai:<port>

Use the displayed port. Do not add a path to this URL. Do not use the APM agent or SDK URL.

3. Configure nri-bundle

For the nri-bundle chart, add the three base URLs under newrelic-infrastructure.common.agentConfig. This shared configuration applies to the kubelet, KSM, and control-plane agent instances.

newrelic-infrastructure:
  common:
    agentConfig:
      collector_url: "https://<collector-id>.collectors.sawmills.ai:<port>"
      identity_url: "https://<collector-id>.collectors.sawmills.ai:<port>"
      command_channel_url: "https://<collector-id>.collectors.sawmills.ai:<port>"

Keep the existing global.licenseKey or custom license secret configuration. Do not put the license key in this routing file. Apply the values to the existing release:

helm upgrade <release> newrelic/nri-bundle \
  --namespace <namespace> \
  --version 7.0.4 \
  --reuse-values \
  --values sawmills-newrelic-routing.yaml

Use the chart version that is already approved for your staging environment. Version 7.0.4 is the validated target. For more chart settings, see the New Relic Infrastructure chart values.

Direct agent environment variables

If you do not use nri-bundle, set these variables on every Infrastructure agent container:

env:
  - name: NRIA_COLLECTOR_URL
    value: "https://<collector-id>.collectors.sawmills.ai:<port>"
  - name: NRIA_IDENTITY_URL
    value: "https://<collector-id>.collectors.sawmills.ai:<port>"
  - name: NRIA_COMMAND_CHANNEL_URL
    value: "https://<collector-id>.collectors.sawmills.ai:<port>"

All three variables use the same base URL. The agent adds these paths:

/infra/v2/metrics/events/bulk
/inventory/deltas
/identity/v1/connect
/agent_commands/v1/commands

Warning: If you set only NRIA_COLLECTOR_URL, identity or command traffic can bypass Sawmills. Set all three variables.

4. Verify the rollout

Wait for all New Relic Infrastructure workloads to become ready. The release can include a kubelet DaemonSet, a control-plane DaemonSet, and a KSM Deployment.

kubectl --namespace <namespace> get pods
kubectl --namespace <namespace> rollout status daemonset/<kubelet-daemonset>
kubectl --namespace <namespace> rollout status deployment/<ksm-deployment>

Check one agent log from each workload type. The kubelet pod uses the agent container. The KSM and control-plane pods use the forwarder container.

kubectl --namespace <namespace> logs <kubelet-pod> --container agent --since=10m
kubectl --namespace <namespace> logs <ksm-pod> --container forwarder --since=10m
kubectl --namespace <namespace> logs <control-plane-pod> --container forwarder --since=10m

The successful request flow has these results:

Request	Expected result
Identity connection	HTTP `200`
Command polling	HTTP `200`
Metric samples	HTTP `202` from Sawmills
Inventory deltas	HTTP `202` from New Relic

The tested agent did not send /security/v1/connect. If your version sends this request, confirm that the collector proxies it without an error.

5. Verify data in New Relic

Run these NRQL queries after at least two reporting cycles:

SELECT count(*) FROM SystemSample SINCE 10 minutes ago

SELECT count(*) FROM K8sPodSample SINCE 10 minutes ago

Also verify:

Expected hosts appear in Infrastructure > Hosts.
Expected cluster, node, pod, and container entities appear in the Kubernetes view.
Event types and important fields match the direct-to-New-Relic baseline.
Agent and collector logs do not contain 401, 402, a full queue, or a continuous retry loop.

6. Test a processor change

First verify the route with no data reduction. Then add one processor change at a time.

Apply a sample rule to one high-volume, non-critical event type.
Apply a field rule to one non-identity numeric field.
Deploy the pipeline.
Confirm that the expected hosts and Kubernetes entities remain.
Confirm that only the selected samples or fields changed.
Record the data-volume reduction.

Do not remove entity keys, entity IDs, GUIDs, event types, or timestamps. See Filter processor and Drop Metric Datapoints processor.

Region rules

Keep the Sawmills endpoint in all three agent URL settings. The collector selects the New Relic US or EU service hosts from the license key.

A US license uses the US identity, command, inventory, and Infrastructure data hosts.
An EU license uses the EU service hosts.
The source agent key and destination key must belong to the same account and region.
A custom advanced endpoint overrides automatic selection for that service.

Troubleshooting

Symptom	Cause and action
Identity or commands bypass Sawmills	Set all three URL settings to the Infrastructure agent endpoint.
HTTP `400`	Confirm that the agent sends a non-empty `X-License-Key` header and valid JSON.
HTTP `401` or `403`	Confirm that the ingest license key is active.
HTTP `402`	Check the New Relic account and billing state.
HTTP `413`	The compressed request is larger than the 10 MiB receiver limit.
HTTP `502`	Check collector access to the selected New Relic regional service.
Export key mismatch	Use the exact same ingest license key in the agent and New Relic destination.
Hosts appear but Kubernetes entities do not	Check the KSM and kubelet agent instances, not only one workload type.
Continuous retry or full queue	Stop the test, restore the previous Helm release, and inspect the first upstream error.

Roll back

Use helm rollback to restore the release that sent data directly to New Relic:

helm rollback <release> <revision> --namespace <namespace>

Then confirm that the three Sawmills URL overrides are not present in the active agent configuration.

Overview

Sawmills Agent

Collectors

Pipelines

Processors

Live Logs

Data Insights

Analytics Dashboard

How To Guides

Integrations

CLI

MCP

Administration

Route the New Relic Infrastructure agent through Sawmills

Prerequisites

1. Enable the Infrastructure source

2. Copy the correct collector endpoint

3. Configure nri-bundle

Direct agent environment variables

4. Verify the rollout

5. Verify data in New Relic

6. Test a processor change

Region rules

Troubleshooting

Roll back

​Prerequisites

​1. Enable the Infrastructure source

​2. Copy the correct collector endpoint

​3. Configure nri-bundle

​Direct agent environment variables

​4. Verify the rollout

​5. Verify data in New Relic

​6. Test a processor change

​Region rules

​Troubleshooting

​Roll back

​Related documentation

Prerequisites

1. Enable the Infrastructure source

2. Copy the correct collector endpoint

3. Configure nri-bundle

Direct agent environment variables

4. Verify the rollout

5. Verify data in New Relic

6. Test a processor change

Region rules

Troubleshooting

Roll back

Related documentation