Does New Relic's Java agent guarantee heap dump capture when memory usage exceeds the configured threshold in a Kubernetes pod with restricted capabilities?

Direct answer

No. The New Relic Java agent's threshold-based heap dump is best-effort. Crossing the configured memory threshold can trigger an attempt, but it does not guarantee that a dump is captured, completed, or uploaded—especially inside a Kubernetes pod with restricted Linux capabilities.

Confirmed behavior vs. version-dependent details

Confirmed: The feature depends on HotSpot diagnostic mechanisms, such as attach-based jcmd/jmap flows or in-JVM diagnostic APIs. In restricted containers, dropped capabilities (for example SYS_PTRACE), non-root UIDs, seccomp profiles, read-only dump paths, disk quotas, or JVM flags that disable attach can cause the attempt to fail.

Not guaranteed: Whether the agent logs a clear failure, whether it retries, and whether it uploads alternative diagnostic data are version- and configuration-dependent. Do not assume silence means success or failure; confirm against your exact agent version and log output.

What remains available if no dump is produced

Even when a heap dump is not generated, the agent can continue to report ordinary JVM memory metrics—heap and non-heap usage, GC activity, and thread counts. These indicate memory pressure but do not provide heap-object evidence.

Retry and fallback

Retry and fallback behavior is not guaranteed. Any cooldown, re-trigger, or harvest behavior should be verified for your specific agent version and configuration. If automatic capture is business-critical, plan for a manual or sidecar-based dump path.

Verification steps for this pod

1. Reproduce in a non-production pod with an identical securityContext, capabilities, seccompProfile, UID/GID, and mounts. Set the agent log level to the most verbose supported value.
2. Search agent logs for the heap-dump attempt and any attach, jcmd/jmap, HotSpot diagnostic, file-write, permission, or disk-space errors.
3. From the same container, attempt a supported JVM heap dump to a writable path and record whether it succeeds; compare with the agent outcome.
4. Record the effective agent version, heap-dump/threshold configuration names and values, JVM flags, dump path, and available disk.
5. In New Relic, confirm which JVM memory metrics or events are actually present; do not infer a failed dump from UI absence alone.

Safe, scoped commands

# Test HotSpot diagnostic dump from the same container
jcmd $(pgrep -f java) GC.heap_dump /tmp/test-heap.hprof

# Search agent logs for related errors
grep -iE 'heap.?dump|jcmd|jmap|attach|ptrace|permission|denied' <agent-log-file>

One missing detail would change the recommendation: the exact agent version and the heap-dump-related configuration names and values in use. With those, the advice can move from general verification to a specific configuration or capability adjustment.