DataDog Agent

The Agent provides a single, integrated daemon for collecting all major telemetry signals. It gathers system metrics (CPU, memory, disk I/O), application performance monitoring (APM) traces via its tracing library, logs from files, network ports, or journald, and integration metrics from over 650 supported technologies. This unified collection eliminates the need for multiple, disparate agents, simplifying deployment and configuration management.

A core capability is its extensive library of built-in checks. These are pre-configured plugins that automatically collect metrics and service checks from popular technologies. Examples include:

• Databases: PostgreSQL, Redis, MongoDB
• Web Servers: Nginx, Apache
• Cloud Platforms: AWS, Google Cloud, Azure
• Container Orchestrators: Kubernetes, Docker Each check parses standard endpoints or APIs, transforming vendor-specific metrics into a normalized format for the Datadog platform.

In containerized environments like Kubernetes, the Agent uses Autodiscovery to automatically identify services running in pods and apply the correct monitoring configuration. It monitors the container runtime or orchestrator API for new, updated, or terminated containers. When a new container starts, Autodiscovery matches its identifiers (e.g., image name, container labels, Kubernetes annotations) against check templates and dynamically enables the appropriate monitoring, ensuring no ephemeral workload goes unobserved.

The Agent performs critical preprocessing on the host before data transmission. It aggregates metrics at configurable intervals (default: 15 seconds), reducing the total number of data points. For traces and logs, it batches payloads and compresses them. It then forwards this processed data to Datadog's intake endpoints via a resilient, HTTPS-based protocol with automatic retry logic and local buffering to withstand network interruptions, ensuring at-least-once delivery of telemetry.

Beyond standard metrics, the Agent can collect deep runtime diagnostics. The Live Processes feature discovers and monitors all processes running on a host, collecting their command, resource consumption, and lineage. The Continuous Profiler (an integrated component) samples CPU usage, memory allocation, and wall time at the method level for supported languages (Java, Python, Go, etc.), generating flame graphs that pinpoint code-level performance bottlenecks with minimal overhead (<2% typical).

The Agent includes modules for security and network observability. The Security Agent performs runtime security detection, scanning for file integrity changes, suspicious process activity, and potential compliance violations based on rules. The Network Performance Monitoring (NPM) module uses eBPF (on Linux) to trace TCP/UDP communications between services at the kernel level, providing topology maps, connection latency, and throughput metrics without requiring application code changes or port mirroring.

A method of profiling requests as they flow through a distributed system, tracking the full path, latency, and relationships between operations. It is composed of spans, which are individual timed operations. The Datadog Agent can collect trace data from instrumented applications. Critical concepts include:

• Trace Context: Metadata (e.g., trace ID, span ID) propagated across service boundaries.
• Sampling Strategies: Rules to reduce data volume, such as head-based (decision at start) or tail-based (decision after request completion) sampling.
• Enables performance debugging across microservices and serverless functions.

Deployment models for auxiliary software like observability agents. The Datadog Agent can be deployed using both patterns:

• Sidecar Pattern: The agent runs in a separate container alongside the main application container in a Kubernetes pod. This provides isolation and allows the agent to be updated independently.
• DaemonSet: A Kubernetes controller that ensures a copy of the Datadog Agent pod runs on every node (or a subset) in the cluster. This is efficient for collecting host-level metrics (CPU, memory, disk) from all nodes.

The end-to-end system for moving observability data from sources to backends. The Datadog Agent is a source collector within this pipeline. Related components include:

• Data Enrichment: Adding context (tags, environment) to raw metrics and traces.
• Backpressure Handling: Managing flow when the backend is slower than the data source.
• Dead Letter Queue (DLQ): A holding area for events that fail repeated processing attempts.
• Alternative pipeline tools include Vector.dev (high-performance router), Fluentd (unified logging), and the OTel Collector.

The process of gathering quantitative measurements about system behavior. The Datadog Agent collects host metrics and application metrics via integrations and DogStatsD. Related protocols and systems:

• StatsD: A simple UDP-based protocol for sending application metrics (counters, timers, gauges). Datadog's DogStatsD is an extension.
• Prometheus: An open-source monitoring system using a pull model over HTTP. The Datadog Agent can be configured as a Prometheus exporter or scrape Prometheus endpoints.
• Metric Exporter: The component within an SDK that sends aggregated metrics to a backend.

Advanced observability techniques that provide deep system insights with low overhead.

• Continuous Profiling: Automatically collecting application performance profiles (CPU, memory, I/O) over time. Tools like Pyroscope offer this; Datadog provides Continuous Profiler as a feature.
• eBPF Tracing: A Linux kernel technology that allows safe program execution in the kernel for deep observability. It can trace system calls, network traffic, and kernel functions. The Datadog Agent uses eBPF for network performance monitoring, security, and kernel-level profiling without requiring application changes.