Datadog Agent Updates & Release Notes

Agent

Prelude

Released on: 2026-11-09

• Please refer to the 7.85.2 tag on integrations-core for the list of changes on the Core Checks

Bug Fixes

• Configuration streaming between the core Agent and the other Agent processes (trace-agent, process-agent, and others) is now disabled by default. It was on by default in 7.85.0 and 7.85.1. On Kubernetes, that could make those processes ignore DD_* environment variables set only on their own container, such as APM settings on the trace-agent container.
• Fix macOS installer GUI-session detection so the Datadog GUI helper and desktop monitor start for the console user after installation or upgrade when a GUI session exists, including installations run outside a desktop terminal.
• Recover Windows process-manager Agent account lookups after a host rename or image clone when the installed domain is stale but the Agent service is configured to use the same local account. This restores startup of Agent Data Plane and other processes using the Agent account, including their DogStatsD listener.

Upgrade Notes

• The openmetrics.d/adp_compat.yaml.example configuration example is no longer shipped. When ADP is enabled, its DogStatsD, forwarder, and aggregator telemetry is now included in the Core Agent's go_expvar values, so a separate OpenMetrics check against ADP is not needed and would count ADP's values twice alongside go_expvar.

New Features

• Expose DogStatsD, forwarder, and aggregator telemetry from the Agent Data Plane through the Core Agent's go_expvar paths when ADP is enabled. Existing go_expvar users can continue using their current configuration while the compatibility layer combines Core Agent and ADP values on each /debug/vars read, including Core Agent expvars created after startup. The mapped ADP telemetry remains internal rather than being published as separate expvars. Expvars without an equivalent ADP metric remain Core Agent-only. Aggregator coverage includes DogStatsD contexts and samples, processed and flushed events/service checks, per-flush counts, and available flush timings. ADP's NumberOfFlush analogue counts non-empty aggregation flushes. ADP's broader transactions__dropped counter is not mapped to forwarder/Transactions/DroppedOnInput because its meaning is not equivalent to the legacy expvar. Legacy splitter expvars were removed in Agent PR #38834 and are not reintroduced.

Datadog Cluster Agent

Prelude

Released on: 2026-11-09 Pinned to datadog-agent v7.85.2: CHANGELOG.

Agent

Warning

Kubernetes installations: This Agent version may drop configuration settings in the trace-agent, process-agent, security-agent, and system-probe containers. As a result, these containers may crash, stop reporting data, or ignore configured settings

Recommended action: Upgrade to Agent 7.85.2.

Prelude

Released on: 2026-11-04

• Please refer to the 7.85.1 tag on integrations-core for the list of changes on the Core Checks

Bug Fixes

• CSPM: On hosts in FIPS mode, oscap-io aborted before its first rule with "out of core in secure memory" wherever it could not lock memory, as in system-probe, whose seccomp profile denies mlock. It now evaluates the XCCDF rules there.
• CSPM: The Agent removes the temporary files of each oscap-io process once it exits. An oscap-io process that crashed or was killed left an oscap.* directory in /tmp, which on FIPS hosts filled /tmp.
• Fix a crash on startup of the 32-bit ARM IoT Agent when logs collection is enabled (unaligned 64-bit atomic operation). See #59066.

Datadog Cluster Agent

Prelude

Released on: 2026-11-04 Pinned to datadog-agent v7.85.1: CHANGELOG.

Agent

Prelude

Released on: 2026-10-30

• Please refer to the 7.85.0 tag on integrations-core for the list of changes on the Core Checks

Upgrade Notes

• For the Oracle integration, the minimum supported version of an externally installed Oracle client is now Oracle 19c. This applies to instances configured with oracle_client: true (or its deprecated aliases instant_client: true and use_instant_client: true), as well as instances that set tns_admin or tns_alias, which also require an external Oracle client. Upgrade the Oracle client on hosts running the Agent to at least version 19c before upgrading the Agent.
• On Windows, dd-procmgr-service is now installed and configured to run as LocalSystem instead of the Agent user account. The installer no longer disables the service when DDAGENTUSER_PASSWORD is omitted on upgrade.
• The 75 deprecated CIS Kubernetes 1.5.1 rules scoped to Kubernetes nodes are no longer shipped or evaluated, and stop producing findings. They covered control plane and worker node file permissions and ownership, and the command line flags of kube-apiserver, kube-controller-manager, kube-scheduler, etcd, kube-proxy and kubelet (controls 1.1.x, 1.2.x, 1.3.x, 1.4.x, 2.x, 3.2.1, 4.1.x and 4.2.x). They were marked deprecated in March 2024 and reported skipped on EKS, GKE and AKS, where the control plane files they read are not present on the node.

Kubernetes node posture is now evaluated from the node configuration the Agent exports as a kubernetes_master_node, kubernetes_worker_node, aws_eks_worker_node, gcp_gke_worker_node or azure_aks_worker_node resource, against the CIS Kubernetes 1.9.0, CIS Amazon EKS, CIS GKE and CIS AKS benchmarks. Dashboards, monitors and suppressions keyed on a cis-kubernetes-1.5.1-* rule ID need to be repointed at the equivalent rule in those benchmarks.

• AWS Lambda MicroVM lifecycle and heartbeat metrics now use the aws.lambda.microvm.enhanced.* namespace instead of aws.lambda.enhanced.microvm.*. Update any dashboards, monitors, or metric queries that use the previous names.

New Features

• Added k8seventsreceiver, kafkareceiver, and httpcheckreceiver receivers, and deltatorateprocessor processor to the Datadog OpenTelemetry Collector (DDOT) manifest, enabling collection of Kubernetes events, telemetry transported over Kafka topics, HTTP health check status, and delta-to-rate metric conversion in standalone DDOT deployments.
• Add a Private Action Runner action that creates a compressed DogStatsD context dump in the Agent's runtime directory and returns its path for subsequent remote diagnostics.
• Add a gpu_mig_profile tag to GPU metrics. On a MIG instance it carries the NVIDIA MIG profile name of the device's GPU instance, lowercased, with + written as _ (1g.35gb, 1g.24gb_me, 1g.24gb-me, 4g.96gb_gfx), for every MIG instance regardless of how it was allocated (DRA, device plugin, or idle). Like the other device tags it is set on every GPU: devices that are not MIG instances, including MIG-enabled physical cards, carry none. The profile is read from the device's own NVML name and needs no additional privileges. On drivers whose device names do not carry it, the agent falls back to the GPU instance handle, which requires a privileged agent; if that is unavailable the value is unknown and the reason is logged.
• The Agent now reports the state of each process it supervises (starting, running, crashed, failed, and so on) as the runtime.procmgr_process_state metric, tagged by process and state.

Previously only a boolean runtime.procmgr_process_running was sent, so a process that was deliberately stopped could not be told apart from one that was crash looping.

• Added four new configuration settings that override the global log_level for a single Agent process: security_agent.log_level (DD_SECURITY_AGENT_LOG_LEVEL), process_config.log_level (DD_PROCESS_CONFIG_LOG_LEVEL, DD_PROCESS_AGENT_LOG_LEVEL), apm_config.log_level (DD_APM_LOG_LEVEL) and system_probe.log_level (DD_SYSTEM_PROBE_LOG_LEVEL). They default to an empty string, meaning no override. These per-Agent keys allow a distinct log level to be kept for each Agent process when configuration streaming makes the core Agent the source of truth for configuration. Because the core Agent streams them, each Agent's log level also becomes reconfigurable at runtime.
• Added a new container_image_annotations_as_tags configuration option that maps container image OCI annotations to tags. The resulting tags are attached to container image entities (appearing on the Container Images page) and are also propagated to the containers using the image, so they apply to container.* metrics. Container image annotations (for example, the containerd.io/snapshot/nydus-* annotations) are exposed by the Containerd and CRI-O workloadmeta collectors, enabling fleet-wide tracking of alternative image formats such as Nydus. This option is not supported with the Docker runtime, which does not expose OCI image annotations.
• Capabilities monitoring now reports which capabilities a process used through checks that always target the initial user namespace, in the capabilities.attempted_host_userns and capabilities.used_host_userns event fields and the matching caps_attempted_host_userns and caps_used_host_userns process fields. Those capabilities stop being granted once the workload runs in its own user namespace, so they identify what would break when enabling user namespaces for a Kubernetes pod. This requires event_monitoring_config.capabilities_monitoring.enabled.
• CWS now captures the AWS credentials served by the EKS Pod Identity Agent, in addition to those served by the instance metadata service. The access key ID of a workload using EKS Pod Identity is attributed to the process that requested it, and the new imds.credential_source field reports which endpoint served an imds event, either IMDS or EKS_POD_IDENTITY. The endpoint addresses can be changed with the new runtime_security_config.eks_pod_identity_ipv4 and runtime_security_config.eks_pod_identity_ipv6 settings, and setting one to an empty string disables the capture for that address.
• Add Agent Health issue detection for sustained payload drops reported by Go, Python, and Java DogStatsD clients using Unix domain sockets. Detection is enabled by default and can be disabled with dogstatsd_client_drop_detection.enabled: false. The drop-ratio threshold defaults to 1% and can be configured with dogstatsd_client_drop_detection.dropped_ratio_threshold. Each issue provides client-specific remediation and resolves after the Agent observes sustained recovery.
• Enable basic Network Path Dynamic Tests by default in end-user-device mode. The Agent selects up to 20 eligible paths per device after an initial five-minute window and in each subsequent hour. Set network_path.connections_monitoring.eudm_basic_tests_enabled to false to disable this behavior. The number of paths considered for selection can be adjusted with network_path.connections_monitoring.eudm_basic_candidate_limit.
• Added a "Health Platform" section to agent status, showing the number of active issues detected by the agent (broken down by severity) and the status of reporting to Datadog: whether it is working, the last successful send time, and the number of bytes sent. Run agent diagnose for details on individual detected issues.
• Add support for configuring collection intervals on individual Oracle custom queries.
• Add the getPodLogs Kubernetes private action.
• Private Action Runner: add experimental support for executing Datadog-authored script actions under com.datadoghq.authoredscripts. The runner resolves versioned action packages from the Datadog catalog, downloads them, and executes their declared entrypoints.
• Adds new scaleStatefulSet actions to scale statefulsets horizontally and vertically.
• Added a new Windows powershell check that runs admin-allowlisted, read-only PowerShell cmdlets and maps their output objects to metrics and tags.
• The software inventory now reports the running operating system on Windows and macOS, and installed kernel-mode drivers on Windows. These are collected alongside installed applications and are identified by the os and driver software types.

The operating system is reported as a single entry whose version carries the full patch level: 10.0.26100.4652 on Windows, including the update build revision, and 26.4.1 (25E253) on macOS, including the build that supplemental updates advance.

Only OEM and third-party drivers are reported; the drivers that ship with Windows are excluded. Both software-only drivers, such as endpoint-protection filter drivers that are not bound to any hardware device, and driver packages that register no kernel service of their own are included.

• Single Step Instrumentation can now be configured for particular workloads using a DatadogInstrumentation custom resource, making it easier to onboard new services to APM.
• Adds support for preserving enrichment metadata on triggered Synthetics Network Path test results.
• Add the Kubernetes updateCronJobSchedule private action for updating a CronJob's schedule, time zone, and suspension state.

Enhancement Notes

• The Agent's embedded Python has been upgraded from 3.13.15 to 3.13.17.
• Add support for the DD_INSTALL_ONLY flag to the Windows executable installer. Set $env:DD_INSTALL_ONLY = "1" or $env:DD_INSTALL_ONLY = "true" to install the Datadog Agent without starting its services.
• The OTel Datadog exporter now emits otel.ddot_collector.metrics.running when otel-agent is running standalone (`DD_OTEL_STANDAL...

Agent

Prelude

Released on: 2026-10-23

• Please refer to the 7.84.6 tag on integrations-core for the list of changes on the Core Checks

Security Notes

• The embedded Python interpreter now rejects TLS certificate chains that contain one of the compromised eMudhra intermediate CA keys, whichever trust store the chain anchors in. This backports the CPython fix for CVE-2026-115557. On Windows, Python checks no longer trust these chains through the Windows certificate store.

Datadog Cluster Agent

Prelude

Released on: 2026-10-23 Pinned to datadog-agent v7.84.6: CHANGELOG.

Agent

Prelude

Release on: 2026-10-22

• Please refer to the 6.53.2 tag on integrations-core for the list of changes on the Core Checks

Security Notes

• Update the embedded CA certificate bundle to the Mozilla bundle dated 2026-10-20. This removes the emSign ECC Root CA - G3, emSign ECC Root CA - C3 and emSign Root CA - C1 root certificates, which Mozilla removed from its root store. The CA bundles vendored by the certifi, pip, boto and botocore Python packages are replaced with this bundle as well.

Bug Fixes

• Stop chunking outputs in manual checks for container, process, and process_discovery checks to allow JSON unmarshaler to parse output.

Datadog Cluster Agent

Prelude

Released on: 2026-10-22 Pinned to datadog-agent v6.53.2: CHANGELOG.

Agent

Prelude

Released on: 2026-10-21

• Please refer to the 7.84.5 tag on integrations-core for the list of changes on the Core Checks

Enhancement Notes

• Agents are now built with Go 1.26.10.

Security Notes

• Update Agent Data Plane to 1.6.4 to reject server certificate chains containing compromised eMudhra public keys for direct and proxied HTTPS connections, including FIPS builds.
• Update rustls-webpki to 0.103.16, which rejects certificate chains that include a small set of distrusted intermediate CA public keys.
• Update the embedded CA certificate bundle to the Mozilla bundle dated 2026-10-20. This removes the emSign ECC Root CA - G3, emSign ECC Root CA - C3 and emSign Root CA - C1 root certificates, which Mozilla removed from its root store.
• Update the embedded pip to 26.2.2. Its vendored certifi CA bundle no longer includes the emSign ECC Root CA - G3 root certificate.

Datadog Cluster Agent

Prelude

Released on: 2026-10-21 Pinned to datadog-agent v7.84.5: CHANGELOG.

Enhancement Notes

• The Cluster Agent is now built with Go 1.26.10.

Agent

Prelude

Released on: 2026-10-19

• Please refer to the 7.84.4 tag on integrations-core for the list of changes on the Core Checks

New Features

• Add logs_config.unreliable_mount.enabled for log files on mounts with stale page-cache or file-handle behavior during rotation, such as CIFS/SMB and Azure Files. The profile applies to all file log sources on the Agent and requires an Agent restart when changed. On Linux, fingerprint reads use O_DIRECT, including sources with their own checksum settings. Other platforms keep buffered fingerprint reads. Normal log tailing is unchanged.

  The profile defaults the global fingerprint strategy to line_checksum with one line and a 4096-byte window. Explicit checksum settings, including disabled, are preserved. logs_config.unreliable_mount.rotation_drain_timeout replaces close_timeout for rotated files and defaults to 60 seconds. Scan frequency is unchanged. Consider raising logs_config.file_scan_period to reduce uncached reads, which fetch the whole fingerprint window each scan.

  Failed fingerprints prevent new tailers from starting. Active tailers keep collecting, but cannot check fingerprint rotation until a later read succeeds. Failures appear in the Agent log and status; status clears on recovery. Linux does not silently retry failed direct reads using buffered I/O.

Enhancement Notes

• CWS: the default values of the SBOM usage enrichment intervals have been increased. runtime_security_config.sbom.enrichment_interval is now 30m (previously 1m) and runtime_security_config.sbom.forward_interval is now 1m (previously 20s), reducing how often SBOMs enriched with runtime usage information are updated and forwarded.

Bug Fixes

• Logs: Prevent registry corruption after an abrupt system shutdown by making atomic registry updates durable before replacing the previous file.

• With logs_config.unreliable_mount.enabled, file log sources that detect rotation by fingerprint now wait for the rotated tailer to release its descriptor before reopening the same path. On CIFS/SMB shares, opening a path while a previous descriptor on it is still open can return a stale handle, which duplicated or lost log lines across a rotation. Sources with fingerprinting disabled, and all sources without the profile, keep tailing the rotated and the new file in parallel as before.

  The handoff ends once the rotated file has gone 30 seconds without new reads, rather than always waiting out logs_config.unreliable_mount.rotation_drain_timeout, which remains the upper bound. The new file is collected from its beginning once the handoff ends, so a file rotated away sooner than that is not read.

• Updated the gopsutil library to v4.26.9 to fix a crash of the Agent when running on Apple M6 hosts.

Datadog Cluster Agent

Prelude

Released on: 2026-10-19 Pinned to datadog-agent v7.84.4: CHANGELOG.

Agent

Prelude

Released on: 2026-10-14

• Please refer to the 7.84.3 tag on integrations-core for the list of changes on the Core Checks

Upgrade Notes

• The Agent now ships Private Action Runner script configuration as a template instead of replacing the live file on subsequent upgrades. If you customized the Agent-installed private-action-runner/script-config.yaml on a Linux host or private-action-runner/powershell-script-config.yaml on a Windows host, backup that file to a safe location outside the Agent configuration directory before your first upgrade to this release. Copy it back after the upgrade, and again after any rollback, downgrade, or Fleet Automation experiment cancellation.

Enhancement Notes

• Add the submit_histogram_bucket_multi function to the aggregator module that Python checks use. It takes the same arguments as submit_histogram_bucket, but the Agent tracks each bucket by its bounds as well as its tags, so the buckets of a histogram can share the same tags. This lets OpenMetrics checks send histogram buckets as distributions without the upper_bound and lower_bound tags.

Security Notes

• Restrict Private Action Runner Kubernetes custom resource actions from accessing core and native Kubernetes APIs by default. Existing workflows using non-native custom resource groups remain compatible. Operators can configure the new private_action_runner.kubernetes_allowed_custom_resources setting to restrict access to an exact list of resources.

Bug Fixes

• Fix a bug in the automatic TCP socket offset guessing used by network monitoring on Linux: on kernels without BTF, the guesser could lock onto a false-positive offset for the round-trip time, causing the RTT reported for TCP connections to be read from an unrelated kernel field while the RTT variance scan still finds the correct field. The guesser now rejects such false matches and re-scans until it finds the correct fields.
• Fixed the gpu.nvlink.ber.effective and gpu.nvlink.ber.symbol metrics reporting NVML's packed bit error rate encoding instead of the actual rate. The Agent now decodes the value (mantissa × 10^-exponent), so a healthy link reports a value close to zero instead of 4095. Monitors and dashboards that use these metrics need their thresholds updated.
• Prevent Windows installer telemetry from reading settings from an Agent configuration directory with an unexpected owner.

Datadog Cluster Agent

Prelude

Released on: 2026-10-14 Pinned to datadog-agent v7.84.3: CHANGELOG.

Agent

Prelude

Released on: 2026-10-07

• Please refer to the 7.84.2 tag on integrations-core for the list of changes on the Core Checks

New Features

• Add Fleet-managed upgrades and rollback for Windows FIPS Agents.

Enhancement Notes

• Allow enabling Private Action Runner split mode during a Windows Agent installation with the DD_PRIVATE_ACTION_RUNNER_SPLIT_ENABLED MSI property.

Security Notes

• Bumped pip to 26.2.1 in the embedded Python distribution.
• Patch the embedded MIT krb5 library so NegoEx GSS token parsing rejects truncated headers and missing extension vectors instead of reading past the buffer.

Bug Fixes

• Fix Kueue pods sometimes missing the kueue_workload , kueue_workload_uid and kueue_resource_flavor tags after an Agent restart.
• Windows Fleet installer setup now rejects standard/FIPS Agent mismatches before stopping the installed Agent, with a message to use the matching installer.

Datadog Cluster Agent

Prelude

Released on: 2026-10-07 Pinned to datadog-agent v7.84.2: CHANGELOG.

Bug Fixes

• The Cluster Agent now collects namespace metadata when apm_config.instrumentation.on_demand is enabled, even if apm_config.instrumentation.enabled is false. Before this fix, Remote Configuration instrumentation policies that match on namespace labels never matched, and injected pods in namespaces that enforce the restricted Pod Security Standard were rejected because the init containers did not get a restricted security context.

Agent

Prelude

Released on: 2026-09-30

• Please refer to the 7.84.0 tag on integrations-core for the list of changes on the Core Checks

Upgrade Notes

• On Linux, the Datadog process manager (dd-procmgrd) is now a first-class service manager alongside systemd, upstart and sysvinit, and it is the default when the dd-procmgrd binary ships with the Agent. The OpenTelemetry Collector distribution is supervised through processes.d and the datadog-agent-ddot systemd unit is no longer installed.

  Each service manager now installs its own self-consistent set of units, so a host runs either the dd-procmgrd supervision path or the per-payload systemd units, never a mix of the two.

• Linux Agent packages no longer include the static archive /opt/datadog-agent/embedded/lib/libpcap.a. This affects users whose custom integrations or build scripts link directly against that archive. Before upgrading, check for references to this path and instead install the platform's libpcap development package or provide a separate libpcap build. The libpcap headers under /opt/datadog-agent/embedded/include remain available.

• The com.datadoghq.remoteaction.agent Private Action Runner bundle (Preview) has been renamed to com.datadoghq.remoteaction.datadogagent.

• The logs Agent now sends log payloads at a fixed higher concurrency by default instead of scaling the number of concurrent senders dynamically with intake latency (the previous "RTT fairness" behavior). This improves throughput for high-latency and high-volume workloads without manual tuning.

  The Agent now uses a static send concurrency of logs_config.pipelines x 10 (for example, 40 concurrent senders on a host with the default 4 pipelines).

  Connection impact — please review before upgrading: because the Agent now runs more senders concurrently by default, it may open more simultaneous connections to the logs intake (up to the static concurrency above). If you need to limit connections — for example behind a proxy or on a connection-constrained network — set logs_config.batch_max_concurrent_send to a lower value (1 keeps a single sender per pipeline).

• APM : The "v1.0" trace payload conversion, previously opt-in via the convert-traces feature flag, is now enabled by default. Traces now are sent in a string-indexed format to reduce payload size and improve performance. They should not appear differently in the Trace Explorer or Datadog UI. To revert to the previous behavior, add the feature flag disable-convert-traces to apm_config.features. Note that in the future we will remove this feature flag and make this the default behavior. If you run into any issues with the new format, please let us know by opening a support ticket.

New Features

• Data security PostgreSQL scans can now connect over TLS. The instance option ssl accepts disable, allow, prefer and require. The verify-ca and verify-full modes are not supported yet, as server certificates are not validated.
• Data security PostgreSQL scans now support the verify-ca and verify-full SSL modes, and send a client certificate and key on TLS connections when ssl_cert and ssl_key are set.
• On Linux and macOS, the Agent now reports an Agent Health issue when the log file tailer loses log data because a file was rotated before the tailer finished reading it. The issue is reported once per host and covers every affected log source, reporting the total bytes lost and rotations involved over the last 24 hours together with a breakdown per source and service. Loss recorded before an Agent restart is not carried across the restart.
• On macOS, the thermal check now reports hardware temperatures and the system thermal pressure level. It submits system.thermal.temperature.cpu, system.thermal.temperature.gpu, system.thermal.temperature.ssd and system.thermal.temperature.battery in degrees Celsius, along with system.thermal.pressure_level (0 nominal, 1 moderate, 2 heavy, 3 trapping, 4 sleeping) tagged with the level name. Both Apple Silicon and Intel Macs are supported. Sensors that the host does not expose are omitted rather than reported as zero, so the set of available metrics varies by hardware model.
• OTLP ingestion: Adds a new otlp_config.metrics.infra_attributes.as_tags option. When enabled, custom tagger-derived tags (for example, tags configured via kubernetesResourcesLabelsAsTags/kubernetesResourcesAnnotationsAsTags) are promoted so they survive the metrics translator's allowlist and are emitted as metric tags for OTLP metrics ingested directly by the Agent. Without it, custom tags that are not known Datadog or OpenTelemetry conventions are dropped. Default behavior is unchanged.
• DDOT: The infraattributes processor now supports a new metrics_attributes_as_tags option for the metrics pipeline. When enabled, custom tagger-derived tags (for example, tags configured via kubernetesResourcesLabelsAsTags/kubernetesResourcesAnnotationsAsTags) are promoted so they survive the metrics translator's allowlist and are emitted as metric tags. Default behavior is unchanged.
• Rshell privileged helper process is introduced and allows specific, allow-listed commands to run with elevated privileges. This is enabled with private_action_runner: enabled: true restricted_shell: privileged: enabled: true it requires seccomp and landlock and is linux-only.
• Added the device_tags_source option to the SNMP check, controlling where the device tags on metrics come from. resource (default) sends only the device resource tag and lets the backend attach the device tags from the metadata payload. agent has the Agent attach the device tags to every metric and omits the resource tag, so no backend enrichment happens. both sends the device tags and the resource tag. Has no effect when collect_device_metadata is disabled.

Enhancement Notes

• The Datadog installer's setup script now accepts a DD_LOG_LEVEL environment variable to set the log_level option in datadog.yaml at install time. On Windows, the Agent MSI installer also exposes a DD_LOG_LEVEL property and passes it through to the Datadog installer.
• Network Path Synthetic tests now report an NDM namespace on emitted paths. By default the Agent uses its configured network_devices.namespace (matching the network_path integration); individual tests can override it via a namespace field in their configuration. Previously synthetic paths were always emitted with an empty namespace.
• Adds data_plane.preflight_mode_duration, which sets how long the Agent Data Plane (ADP) pre-flight leaves ADP running. It defaults to 90s and is clamped to that as a minimum, so it can only extend the window: a shorter one stops ADP while its startup is still in progress and reports a healthy host as a failure. It is intended for benchmarking harnesses that need ADP resident for the whole of a fixed-length run; on a real host the setting to reach for remains data_plane.preflight_mode.
• APM : The trace-agent EVP proxy now forwards the DD-EVP-ORIGIN and DD-EVP-ORIGIN-VERSION request headers to Event Platform intake. Previously these headers were stripped by the proxy allowlist, so server SDK metadata (SDK name and version) was lost at the Agent even when the SDK sent it. Values are forwarded unchanged; the Agent does not synthesize defaults for requests that omit them.
• APM : Use the OpenTelemetry url.template attribute in HTTP client resource names when available, while retaining method-only resource names as the fallback.
• APM: Add apm_config.traces_send_to_main_endpoint (DD_APM_TRACES_SEND_TO_MAIN_ENDPOINT, default true). This setting is for internal use, and we expect to remove it in a future version. When set to false, the trace-agent trace and stats writers stop sending to the main endpoint (api_key + apm_config.apm_dd_url) and forward traces and APM stats only to apm_config.additional_endpoints. The main endpoint's API key is still used by the other trace-agent proxies, and the configuration is rejected when no additional endpoint would remain. This is the traces/stats counterpart of apm_config.profiling_send_to_main_endpoint.
• APM : Add support for installing APM injection on AMD64 systems that also run 32-bit binaries. 32-bit executables run without injection, while supported 64-bit executables continue to be instrumented.
• Agents are now built with Go 1.26.6.
• Agents are now built with Go 1.26.7.
• The DDOT configuration converter now reuses a user-defined pprof, zpages, health_check or ddflare extension that was declared under extensions but not wired into service.extensions, instead of adding a default /dd-autoconfigured copy. This matches the behavior already in place for the datadog and dogtel extensions, so a user's custom extension configuration is honored even when they forget to add it to the service's extension list.
• The Datadog Distribution of the OpenTelemetry Collector (DDOT) now sends series metrics to Datadog using the v3 metrics intake, reducing metrics egress bandwidth. This aligns DDOT with the core Agent: series follow the use_v3_api.series.enabled setting, whose default (datadog_only) uses the v3 intake for Datadog destinations while other destinations continue to use the v2 intake. To keep using the v2 intake, set use_v3_api.series.enabled to false (or the DD_USE_V3_API_SERIES_ENABLED environment variable).
• DogStatsD diagnostic commands (dogstatsd-stats, dogstatsd-capture, dogstatsd-replay, dogstatsd top, and dogstatsd dump-contexts) now print a clear error message and exit when invoked against the Core Agent while the Agent Data Plane is configured to handl...

Agent

Prelude

Released on: 2026-09-16

• Please refer to the 7.83.2 tag on integrations-core for the list of changes on the Core Checks

Enhancement Notes

• gpu: Constant metrics (gpu.device.total , gpu.memory.limit , gpu.core.limit , and gpu.memory.bar1.total ) are reported on the cadence set by the new gpu.static_metrics_reporting_interval (15 seconds by default) to ensure accuracy when using weighted sums.
• Single Step Instrumentation's tracer config mechanisms (the ddTraceConfigs , remote-config policies, and the admission.datadoghq.com/apm-inject.tracer-configs pod annotation) now also accept OTEL_ prefixed environment variable names, in addition to the existing DD_ prefix. This allows configuring a tracer's native OpenTelemetry mode (e.g. OTEL_TRACES_EXPORTER , OTEL_EXPORTER_OTLP_ENDPOINT ) through SSI.

Bug Fixes

• Fixed the Agent Data Plane pre-flight sending its metrics and API key to datadoghq.com instead of the configured site. The generated pre-flight configuration was built from the fully resolved Agent configuration, so dd_url 's default value appeared in it as though it had been set explicitly, and an explicit dd_url takes precedence over site . The pre-flight configuration is now built from the settings the operator actually supplied, matching what a normally-supervised Agent Data Plane reads from datadog.yaml .
• Fix DD_NETWORK_PATH_COLLECTOR_FILTERS so JSON-encoded Network Path collector filters are parsed and applied correctly.

Datadog Cluster Agent

Prelude

Released on: 2026-09-16 Pinned to datadog-agent v7.83.2: CHANGELOG.

Agent

Prelude

Released on: 2026-09-09

• Please refer to the 7.83.1 tag on integrations-core for the list of changes on the Core Checks

Bug Fixes

• Fix bug which made fast network path test billed to customer
• Release the containerd view snapshot and lease taken for a container image SBOM scan even when the scan is cancelled or times out. The release ran on the scan's own context, so a scan that hit its deadline left the snapshot behind, and on a lazy snapshotter that snapshot holds the layer it materialised.

Other Notes

• The fleet installer daemon now reports the DDOT (OpenTelemetry Collector) process state as part of the agent state sent to Datadog, so DDOT version and configuration updates can be monitored. The state is read from the process manager when it supervises DDOT, and from systemd or the Windows service manager otherwise. It is also visible in the output of
  datadog-installer status.

Datadog Cluster Agent

Prelude

Released on: 2026-09-09 Pinned to datadog-agent v7.83.1:
CHANGELOG.

Bug Fixes

• Fix Cluster Agent graceful shutdown to release the Kubernetes leader-election lock before exiting, allowing another replica to take over without waiting for the lease to expire.

Agent

Prelude

Released on: 2026-09-03

• Please refer to the 7.83.0 tag on integrations-core for the list of changes on the Core Checks

New Features

• Add a Data Security provider that schedules one-off database scan checks triggered through Remote Configuration. It is enabled when both data_security.enabled and shared_library_check.enabled are set, and currently targets PostgreSQL databases already monitored by the Agent (via the postgres check).

• Add k8s cluster receiver, k8s leader elector extension, and count connector to the DDOT (Datadog Distribution of OpenTelemetry Collector) default manifest, enabling collection of Kubernetes cluster-level metrics, leader election coordination for Kubernetes receivers, and count-based metric generation via the OpenTelemetry Collector pipeline.

• Add Helm rollback action

• Adds an Agent Data Plane (ADP) preflight mode, controlled by the new data_plane.preflight_mode setting (enabled by default).

  When data_plane.enabled has not been set at all, the Agent starts ADP once at startup for 90 seconds in an isolated configuration, sends a single throwaway metric through it, then stops it and reports any startup errors to Datadog as agent telemetry. This surfaces environment-specific ADP problems before ADP is enabled for real.

  The preflight process handles no customer data: it runs in standalone mode, listens only on a temporary DogStatsD endpoint under the Agent's run directory, does not register with the Agent's remote agent registry, and never takes over the Agent's own DogStatsD port. The temporary configuration it is given contains the Agent's resolved configuration, so it is written user-only and removed once the run finishes. To keep values that were only ever held in memory from being written out this way, the pre-flight does not run at all when secrets are in use: when secret_backend_command, secret_backend_type or multi_secret_backends is set, or when any setting has already been resolved from a secret. Setting data_plane.enabled explicitly to either true or false, or setting data_plane.preflight_mode to false, also disables the pre-flight, as does running an Agent package that does not ship ADP.

• APM : Add support for span-derived primary tags on span metrics produced by the Datadog Distribution of OpenTelemetry Collector (DDOT). Set span_derived_primary_tags on the datadog connector's traces section to a list of attribute keys, and the value of each key found on a span (or, failing that, on its resource) is attached to the APM stats the connector emits, letting you break down span metrics by those tags:

  connectors:
    datadog/connector:
      traces:
        span_derived_primary_tags: [team, region]
  

  Keys absent from both the span and its resource attributes are omitted. Each key must also be configured as a primary tag in your Datadog organization; keys that are not registered as primary tags are dropped by the intake and do not appear on the resulting span metrics.

• CWS set actions accept a new capture field, a regular expression with a single capture group that is applied to the value of field to extract part of it. This makes it possible to lift an identifier embedded in an event field, such as a command id inside a file path or an IAM role inside an IMDS url, and store it as a scoped variable rather than storing the whole field value. capture can only be used together with field, and only on fields holding a single string. A value that does not match the expression leaves the variable untouched.

• When data_security.enabled is set, the Agent now forwards sensitive-data-scanner findings to Datadog as structured sds-result payloads on the event platform.

• Scaffold PostgreSQL support to the data security check.

• DDOT (Datadog Distribution of OpenTelemetry Collector): the embedded datadog exporter now honors the orchestrator_explorer setting when the OpenTelemetry Agent runs in standalone mode (DD_OTEL_STANDALONE=true). When enabled, Kubernetes resource manifests collected by a k8sobjects receiver in the exporter's logs pipeline are forwarded to the Orchestrator Explorer (Kubernetes Resources) intake. In connected mode this setting is ignored, as the Datadog Cluster Agent already collects and ships orchestrator data.

• Add support for additional log collection options for Kubernetes workloads through DatadogInstrumentation resources.

• Adds support for configuring Network Path Dynamic Test filters through Remote Config.

• Adds support for scheduling Network Path tests through Remote Config.

• Added ConfigMap collection to the Kubernetes Orchestrator. ConfigMap manifests are sent with their data and binaryData fields stripped. The collector is disabled by default (IsStable: false) and must be activated explicitly by listing configmaps in the collectors field of the orchestrator check instance configuration.

• The DDOT (OpenTelemetry) config converter now automatically injects the cumulativetodelta processor into metrics pipelines that export to the datadog exporter, converting all cumulative metric types (sum, histogram and exponential histogram) to delta. The processor is added only to metrics pipelines, and is skipped for any pipeline where a cumulativetodelta processor is already defined. This behavior is controlled by the new cumulativetodelta entry in otelcollector.converter.features, which is enabled by default; remove it from that list to disable the auto-injection.

• OTLP ingestion: Adds a new otlp_config.logs.infra_attributes.tags_as_ddtags option. When enabled, custom tagger-derived tags (for example, tags configured via kubernetesResourcesLabelsAsTags/kubernetesResourcesAnnotationsAsTags) are written as real Datadog log tags instead of log attributes for OTLP logs ingested directly by the Agent. Default behavior is unchanged. (commit 522ee5f)

• DDOT: The infraattributes processor now supports a new logs_tags_as_ddtags option. When enabled, custom tagger-derived tags (for example, tags configured via kubernetesResourcesLabelsAsTags/kubernetesResourcesAnnotationsAsTags) are written as real Datadog log tags instead of log attributes. Default behavior is unchanged. (commit 522ee5f)

• Added a com.datadoghq.remoteaction.agent Private Action Runner bundle exposing read-only datadog-agent operations (status, diagnose, and configuration) as remote actions executed against the local Agent's authenticated IPC API. (Preview)

• Added a generateFlare action to the com.datadoghq.remoteaction.agent Private Action Runner bundle that builds a flare archive on the Agent host. (Preview)

• The Private Action Runner now supports a split deployment model in which a dedicated on-demand executor runs actions in a separate process, reachable over a local gRPC socket secured with mutual TLS.

• Added the data_security.enabled configuration flag (disabled by default) which enables the sds-result event platform forwarder used to send sensitive-data-scanner results to Datadog.

• Add the Data Security feature to scan monitored PostgreSQL databases for sensitive data, driven remotely through Remote Configuration (DATA_SECURITY_DB_SCAN_TASKS). Enabled with data_security.enabled and shared_library_check.enabled.

• Agent Cloud Auth (delegated authentication / Workload Identity Federation) on AWS now resolves credentials from EKS IRSA, ECS task roles, EKS Pod Identity and EC2 IMDS in the trace-agent, standalone DogStatsD, private action runner, IoT Agent and Heroku Agent. Previously only flavors built with the ec2 build tag (main Agent, Cluster Agent, process-agent, security-agent, system-probe, installer) supported those credential sources; the others silently disabled the feature. Most notably the trace-agent is now covered, so APM no longer requires a statically configured api_key when Cloud Auth is in use. OpenTelemetry Collector (DDOT / otel-agent) is not covered: it does not load the delegated authentication component, and still requires a statically configured api_key.

• Setting delegated_auth.aws.region without delegated_auth.provider no longer skips cloud provider auto-detection. The configured region is now applied to the auto-detected provider, as intended, instead of being treated as an explicit provider configuration.

Enhancement Notes

• Notable Events on Windows now reports critical temperature events: system shutdown or hibernation triggered by a critical thermal condition.
• The Linux Agent packages now ship a built-in datasecurity Rust-based check as a shared library under /etc/datadog-agent/checks.d. This is an initial scaffold and is not enabled by default.
• Rust artifacts are now built with codegen-units = 1 to minimize the size of the produced binaries and shared libraries.
• The kubelet check now collects kubelet.containers_per_pod (.count and .sum), a histogram of the number of containers running per pod on a node. This provides visibility into the distribution of container counts across pods, which can help identify pods with unusually high sidecar/container density.
• Adds kubernetes-actions functionality to the private action runner in the DCA.
• Adds ability to patch daemonsets and statefulsets through the kubernetes-actions pipeline.
• Add exporter.datadogexporter.AddUnits feature gate that maps OTLP (UCUM) metric units to their Datadog equivalents.
• APM : Supported new db.system.name attribute replacing db.system according to changes in OpenTelemetry Semantic Conventions (v1.30.0+).
• APM: agent status now shows the live trace-semantics registry in the APM Agent section, reporting whether it comes from Remote Configuration or the embedded ...