Datadog Agent Updates & Release Notes

Agent

Prelude

Released on: 2026-09-16

• Please refer to the 7.83.2 tag on integrations-core for the list of changes on the Core Checks

Enhancement Notes

• gpu: Constant metrics (gpu.device.total , gpu.memory.limit , gpu.core.limit , and gpu.memory.bar1.total ) are reported on the cadence set by the new gpu.static_metrics_reporting_interval (15 seconds by default) to ensure accuracy when using weighted sums.
• Single Step Instrumentation's tracer config mechanisms (the ddTraceConfigs , remote-config policies, and the admission.datadoghq.com/apm-inject.tracer-configs pod annotation) now also accept OTEL_ prefixed environment variable names, in addition to the existing DD_ prefix. This allows configuring a tracer's native OpenTelemetry mode (e.g. OTEL_TRACES_EXPORTER , OTEL_EXPORTER_OTLP_ENDPOINT ) through SSI.

Bug Fixes

• Fixed the Agent Data Plane pre-flight sending its metrics and API key to datadoghq.com instead of the configured site. The generated pre-flight configuration was built from the fully resolved Agent configuration, so dd_url 's default value appeared in it as though it had been set explicitly, and an explicit dd_url takes precedence over site . The pre-flight configuration is now built from the settings the operator actually supplied, matching what a normally-supervised Agent Data Plane reads from datadog.yaml .
• Fix DD_NETWORK_PATH_COLLECTOR_FILTERS so JSON-encoded Network Path collector filters are parsed and applied correctly.

Datadog Cluster Agent

Prelude

Released on: 2026-09-16 Pinned to datadog-agent v7.83.2: CHANGELOG.

Agent

Prelude

Released on: 2026-09-09

• Please refer to the 7.83.1 tag on integrations-core for the list of changes on the Core Checks

Bug Fixes

• Fix bug which made fast network path test billed to customer
• Release the containerd view snapshot and lease taken for a container image SBOM scan even when the scan is cancelled or times out. The release ran on the scan's own context, so a scan that hit its deadline left the snapshot behind, and on a lazy snapshotter that snapshot holds the layer it materialised.

Other Notes

• The fleet installer daemon now reports the DDOT (OpenTelemetry Collector) process state as part of the agent state sent to Datadog, so DDOT version and configuration updates can be monitored. The state is read from the process manager when it supervises DDOT, and from systemd or the Windows service manager otherwise. It is also visible in the output of
  datadog-installer status.

Datadog Cluster Agent

Prelude

Released on: 2026-09-09 Pinned to datadog-agent v7.83.1:
CHANGELOG.

Bug Fixes

• Fix Cluster Agent graceful shutdown to release the Kubernetes leader-election lock before exiting, allowing another replica to take over without waiting for the lease to expire.

Agent

Prelude

Released on: 2026-09-03

• Please refer to the 7.83.0 tag on integrations-core for the list of changes on the Core Checks

New Features

• Add a Data Security provider that schedules one-off database scan checks triggered through Remote Configuration. It is enabled when both data_security.enabled and shared_library_check.enabled are set, and currently targets PostgreSQL databases already monitored by the Agent (via the postgres check).
• Add k8s cluster receiver , k8s leader elector extension , and count connector to the DDOT (Datadog Distribution of OpenTelemetry Collector) default manifest, enabling collection of Kubernetes cluster-level metrics, leader election coordination for Kubernetes receivers, and count-based metric generation via the OpenTelemetry Collector pipeline.
• Add Helm rollback action
• Adds an Agent Data Plane (ADP) preflight mode, controlled by the new data_plane.preflight_mode setting (enabled by default).

When data_plane.enabled has not been set at all, the Agent starts ADP once at startup for 90 seconds in an isolated configuration, sends a single throwaway metric through it, then stops it and reports any startup errors to Datadog as agent telemetry. This surfaces environment-specific ADP problems before ADP is enabled for real.

The preflight process handles no customer data: it runs in standalone mode, listens only on a temporary DogStatsD endpoint under the Agent's run directory, does not register with the Agent's remote agent registry, and never takes over the Agent's own DogStatsD port. The temporary configuration it is given contains the Agent's resolved configuration, so it is written user-only and removed once the run finishes. To keep values that were only ever held in memory from being written out this way, the pre-flight does not run at all when secrets are in use: when secret_backend_command , secret_backend_type , or multi_secret_backends is set, or when any setting has already been resolved from a secret. Setting data_plane.enabled explicitly to either true or false , or setting data_plane.preflight_mode to false , also disables the pre-flight, as does running an Agent package that does not ship ADP.

• APM : Add support for span-derived primary tags on span metrics produced by the Datadog Distribution of OpenTelemetry Collector (DDOT). Set span_derived_primary_tags on the datadog connector's traces section to a list of attribute keys, and the value of each key found on a span (or, failing that, on its resource) is attached to the APM stats the connector emits, letting you break down span metrics by those tags:

connectors:
  datadog/connector:
    traces:
      span_derived_primary_tags: [team, region]

Keys absent from both the span and its resource attributes are omitted. Each key must also be configured as a primary tag in your Datadog organization; keys that are not registered as primary tags are dropped by the intake and do not appear on the resulting span metrics.

• CWS set actions accept a new capture field, a regular expression with a single capture group that is applied to the value of field to extract part of it. This makes it possible to lift an identifier embedded in an event field, such as a command id inside a file path or an IAM role inside an IMDS url, and store it as a scoped variable rather than storing the whole field value. capture can only be used together with field , and only on fields holding a single string. A value that does not match the expression leaves the variable untouched.
• When data_security.enabled is set, the Agent now forwards sensitive-data-scanner findings to Datadog as structured sds-result payloads on the event platform.
• Scaffold PostgreSQL support to the data security check.
• DDOT (Datadog Distribution of OpenTelemetry Collector): the embedded datadog exporter now honors the orchestrator_explorer setting when the OpenTelemetry Agent runs in standalone mode (DD_OTEL_STANDALONE=true). When enabled, Kubernetes resource manifests collected by a k8sobjects receiver in the exporter's logs pipeline are forwarded to the Orchestrator Explorer (Kubernetes Resources) intake. In connected mode this setting is ignored, as the Datadog Cluster Agent already collects and ships orchestrator data.
• Add support for additional log collection options for Kubernetes workloads through DatadogInstrumentation resources.
• Adds support for configuring Network Path Dynamic Test filters through Remote Config.
• Adds support for scheduling Network Path tests through Remote Config.
• Added ConfigMap collection to the Kubernetes Orchestrator. ConfigMap manifests are sent with their data and binaryData fields stripped. The collector is disabled by default (IsStable: false) and must be activated explicitly by listing configmaps in the collectors field of the orchestrator check instance configuration.
• The DDOT (OpenTelemetry) config converter now automatically injects the cumulativetodelta processor into metrics pipelines that export to the datadog exporter, converting all cumulative metric types (sum, histogram and exponential histogram) to delta. The processor is added only to metrics pipelines, and is skipped for any pipeline where a cumulativetodelta processor is already defined. This behavior is controlled by the new cumulativetodelta entry in otelcollector.converter.features , which is enabled by default; remove it from that list to disable the auto-injection.
• OTLP ingestion: Adds a new otlp_config.logs.infra_attributes.tags_as_ddtags option. When enabled, custom tagger-derived tags (for example, tags configured via kubernetesResourcesLabelsAsTags / kubernetesResourcesAnnotationsAsTags ) are written as real Datadog log tags instead of log attributes for OTLP logs ingested directly by the Agent. Default behavior is unchanged. (commit 522ee5f )
• DDOT: The infraattributes processor now supports a new logs_tags_as_ddtags option. When enabled, custom tagger-derived tags (for example, tags configured via kubernetesResourcesLabelsAsTags / kubernetesResourcesAnnotationsAsTags ) are written as real Datadog log tags instead of log attributes. Default behavior is unchanged. (commit 522ee5f )
• Added a com.datadoghq.remoteaction.agent Private Action Runner bundle exposing read-only datadog-agent operations (status, diagnose, and configuration) as remote actions executed against the local Agent's authenticated IPC API. (Preview)
• Added a generateFlare action to the com.datadoghq.remoteaction.agent Private Action Runner bundle that builds a flare archive on the Agent host. (Preview)
• The Private Action Runner now supports a split deployment model in which a dedicated on-demand executor runs actions in a separate process, reachable over a local gRPC socket secured with mutual TLS.
• Added the data_security.enabled configuration flag (disabled by default) which enables the sds-result event platform forwarder used to send sensitive-data-scanner results to Datadog.
• Add the Data Security feature to scan monitored PostgreSQL databases for sensitive data, driven remotely through Remote Configuration (DATA_SECURITY_DB_SCAN_TASKS). Enabled with data_security.enabled and shared_library_check.enabled .
• Agent Cloud Auth (delegated authentication / Workload Identity Federation) on AWS now resolves credentials from EKS IRSA, ECS task roles, EKS Pod Identity and EC2 IMDS in the trace-agent, standalone DogStatsD, private action runner, IoT Agent and Heroku Agent. Previously only flavors built with the ec2 build tag (main Agent, Cluster Agent, process-agent, security-agent, system-probe, installer) supported those credential sources; the others silently disabled the feature. Most notably the trace-agent is now covered, so APM no longer requires a statically configured api_key when Cloud Auth is in use. OpenTelemetry Collector (DDOT / otel-agent ) is not covered: it does not load the delegated authentication component, and still requires a statically configured api_key .
• Setting delegated_auth.aws.region without delegated_auth.provider no longer skips cloud provider auto-detection. The configured region is now applied to the auto-detected provider, as intended, instead of being treated as an explicit provider configuration.

Agent

Prelude

Released on: 2026-08-26

• Please refer to the 7.82.3 tag on integrations-core for the list of changes on the Core Checks

Enhancement Notes

• Agents are now built with Go 1.26.7.

Bug Fixes

• The Dynamic Instrumentation proxy in the trace-agent no longer drops debugger data when logs_enabled is left unset. Data is only dropped when logs_enabled (or the deprecated log_enabled) is explicitly set to false.
• On Windows, fixed an issue where upgrading the Agent without providing DDAGENTUSER_PASSWORD could lock out a domain Agent user account. The installer now leaves dd-procmgr-service, and the components it supervises, disabled until the Agent user password is provided again.

Datadog Cluster Agent

Prelude

Released on: 2026-08-26 Pinned to datadog-agent v7.82.3: CHANGELOG.

Agent

Prelude

Released on: 2026-08-19

• Please refer to the 7.82.2 tag on integrations-core for the list of changes on the Core Checks

New Features

• When infrastructure_mode: end_user_device is set, the logon_duration feature is now enabled automatically, so operators no longer need to set logon_duration.enabled: true separately. This setting can still be overridden explicitly in the configuration file if needed.

Enhancement Notes

• The Agent's embedded Python has been upgraded from 3.13.14 to 3.13.15
• Agents are now built with Go 1.26.6.

Bug Fixes

• APM: Raise the messagepack decoder allocation limit for the span meta_struct field to 10MiB, so large meta_struct entries (as written by LLM Observability) are no longer rejected by the package-wide 500,000 element limit. Other span fields keep the lower limit.
• Disable GPU parallel collection by default to avoid triggering NVML concurrency bugs.
• gpu: fix concurrent calls to NVML GetFieldValues API, that could cause missing NVLink metrics.

Other Notes

• gpu: GPU inventory payload and GPU tags are only emitted when GPU monitoring is enabled

Datadog Cluster Agent

Prelude

Released on: 2026-08-19 Pinned to datadog-agent v7.82.2: CHANGELOG.

Agent

Prelude

Released on: 2026-08-11

• Please refer to the 7.82.1 tag on integrations-core for the list of changes on the Core Checks

Bug Fixes

• Windows: Fixed an issue where an explicit DDAGENTUSER_KEEP_RIGHTS or DDAGENTUSER_NAME value passed as an install argument to a Fleet Automation-triggered Windows Agent install/upgrade could be silently overridden by a stale fallback value (respectively from the registry and from the running service account).
• Fix an issue where GPU monitoring could trigger a kernel panic on multi-GPU nodes with Hopper/Blackwell GPUs.

Datadog Cluster Agent

Prelude

Released on: 2026-08-11 Pinned to datadog-agent v7.82.1: CHANGELOG.

Agent

Known Issues

• GPU Monitoring can trigger a kernel panic on multi-GPU nodes with Hopper/Blackwell GPUs. The workaround is to disable parallel collection (gpu.parallel_collectors: false), downgrade to Agent v7.81.3 or upgrade to v7.82.1 when it becomes available.

Prelude

Released on: 2026-08-05

• Please refer to the 7.82.0 tag on integrations-core for the list of changes on the Core Checks

Upgrade Notes

• Automatic multi-line log detection (logs_config.auto_multi_line_detection) is now enabled by default. Multi-line log messages such as stack traces and JSON blobs are aggregated into a single log entry out of the box, instead of being split into separate entries. To restore the previous behavior, set logs_config.auto_multi_line_detection to false (or the environment variable DD_LOGS_CONFIG_AUTO_MULTI_LINE_DETECTION=false).
• Change default EVP track for AI usage to eudm-intake and disable AI usage agent desktop monitoring by default (the monitor stays in idle mode). AI usage agent's ai_usage_native_host.yaml configuration file is now regenerated from the packaged template on every Agent install and upgrade to ensure the default changes take effect. This is a deliberate short-term measure: it forces already-installed machines onto the updated defaults. Once the defaults are settled (expected within a few Agent releases), the installer will go back to preserving an existing ai_usage_native_host.yaml and only creating it when missing. Note that any customization made to the config file is discarded on every Agent install and upgrade, and must be re-applied afterwards.
• APM: Bump the default version of the datadog-apm-library-js package installed by the Datadog installer from major version 5 to major version 6, following the release of dd-trace-js v6.
• APM: Updates the default JS (Node.js) library used for Kubernetes auto-instrumentation (Cluster Agent admission controller) from major version 5 to major version 6.
• The legacy viper based configuration backend has been removed. The DD_CONF_NODETREEMODEL environment variable and the conf_nodetreemodel configuration setting no longer have any effect and can be removed from your configuration. The Agent now always uses the improved configuration implementation.
• serverless-init no longer forces DD_TRACE_PROPAGATION_STYLE=datadog during tracer auto-instrumentation. The tracer's own default (which includes W3C tracecontext and baggage in addition to datadog) now applies, and a customer-provided DD_TRACE_PROPAGATION_STYLE is respected. Applications that relied on serverless-init restricting propagation to datadog only should set DD_TRACE_PROPAGATION_STYLE=datadog explicitly.

New Features

• Private Action Runner: add the com.datadoghq.remoteaction.rshell.runRemediationCommand action. It behaves like runCommand but runs the restricted shell in remediation mode, which additionally permits file-target output redirections (> , >> , 2> , &> , &>>) and write-oriented builtins such as truncate, all confined to the configured allowed paths. The action is not enabled by default and must be explicitly added to the runner's actions allowlist.

• agent flare now includes diagnostic artifacts from the Agent Data Plane (ADP) process when data_plane.enabled is set to true. If ADP is unreachable at flare time, an UNREACHABLE.txt file containing the connection error is written to ADP's subdirectory and the rest of the flare completes normally.

• When infrastructure_mode is set to cloud_cost_only, the Agent adds an infra_mode:cloud_cost_only tag to metrics from selected integrations. Use integration.cloud_cost_only.tagged to list which checks receive the tag; when the list is empty (the default), all checks are tagged.

• Add a new dogstatsd_no_aggregation_pipeline_workers_count configuration option to control the number of parallel workers processing messages in the no-aggregation pipeline. Defaults to 1 to preserve existing behavior.

• Adds Datadog CSI driver telemetry to COAT, including volume publish and unpublish attempts as well as library resolution, download count and duration, cleanup, cache size, cached library count, and library volume link metrics.

• The Datadog OTLP connector now scales APM stats (hits, errors, duration) by the probabilistic head-based sampling weight carried in the W3C tracestate (th threshold and p power-of-two encodings). When upstream head-based sampling has dropped a fraction of traces, the computed trace metrics are scaled up to reflect the true traffic volume instead of only the sampled subset.

• Envoy Gateway AppSec protection can now run in sidecar mode over a Unix domain socket. Datadog injects the serviceextensions ext_proc container into Envoy Gateway data-plane pods, and Envoy Gateway communicates with it through an Envoy Gateway Backend.

  This behavior is selected by cluster_agent.appsec.injector.mode, which now defaults to sidecar. Envoy Gateway must have the Backend extension API enabled with extensionApis.enableBackend: true; if it is disabled, the cluster agent warns and does not change Envoy Gateway configuration.

  This is a behavior change for AppSec-enabled Envoy Gateway deployments: they now default to sidecar injection instead of external Service mode. To keep the previous behavior, set cluster_agent.appsec.injector.mode to external.

• Added an experimental telemetry error log forwarder. Disabled by default, the Agent forwards records logged at ERROR level or higher to the COAT intake so Datadog Engineers can aggregate Agent errors across customer organizations. The forwarder shares the agent telemetry transport, inheriting endpoint and compression settings from the agent telemetry configuration.

• On Windows, datadog-installer now honors the DD_AGENT_MAJOR_VERSION and DD_AGENT_MINOR_VERSION environment variables, matching the Linux and macOS install scripts.

• GPU: add the gpu.device.needs_recovery metric, which reports whether a GPU requires a recovery action (such as a reset or node reboot) as exposed by NVML's GPU recovery action field. The value is 0 when no action is needed and 1 otherwise, and the metric is tagged with recovery_action (none, reset, reboot, drain, or drain_and_reset).

• The agent status command now includes a "Logs Agent Backpressure" section reporting per-component utilization of the logs pipeline and an overall HEALTHY / WARNING / SATURATED state, making it easier to see which pipeline stage is the bottleneck when logs are delayed.

• On macOS, the Agent can now be restarted directly from the web-based GUI (Agent Manager).

• New Agent Secret Backend: "windows.regkey"

• APM Single Step Instrumentation now supports setting tracer configuration options via the admission.datadoghq.com/apm-inject.tracer-configs pod annotation, the annotation-based equivalent of the apm_config.instrumentation.targets[].ddTraceConfigs option. The value is a JSON array of objects (for example [{"name":"DD_PROFILING_ENABLED","value":"true"}]) and each entry's name must start with the DD_ prefix.

• NetFlow: automatically detect and split Cisco FirePower/ASA bidirectional (NSEL) flow records into two unidirectional flow events. NSEL records carry initiator→responder and responder→initiator byte/packet counts in NFv9 fields 231/232/298/299; the agent now captures these fields via built-in mappings and emits a separate flow for each direction with correctly swapped src/dst addresses, ports, and interfaces. No user configuration is required.

Enhancement Notes

• Malformed ad.datadoghq.com/service.* and ad.datadoghq.com/endpoints.* annotations on Kubernetes services are now reported as Autodiscovery misconfiguration health events when the health platform is enabled. The issue is resolved automatically once the annotation is fixed.
• Adds Agent Data Plane packaging and launchd service support to macOS Agent packages.
• Adds Agent Data Plane packaging to Windows Agent MSI installs. ADP is supervised by dd-procmgr via processes.d/datadog-agent-data-plane.yaml, written by the fleet installer during postinst (same pattern as DDOT on Windows).
• Emit datadog.cluster_agent.kubernetes_actions.running when kuberenetes actions product is enabled and running.
• Podman receiver metrics collected via the Datadog Distribution of OpenTelemetry (DDOT) Collector are now correctly classified with origin opentelemetry_collector_podmanreceiver instead of falling back to opentelemetry_collector_unknown.
• Added the data_plane.stop_timeout configuration setting, which controls the graceful shutdown budget for the Agent Data Plane (ADP). When unset, it derives its value from aggregator_stop_timeout + forwarder_stop_timeout, so customizing either of those component timeouts now extends ADP's shutdown window in lockstep with the core Agent.
• On startup the Datadog Agent now validates the system-probe configuration against its schema and reports any violations through the Agent Health pipeline. Only the values the customer set in the configuration are validated. This can be disabled with health_platform.invalidsysprobeconfig_check.enabled.
• On Windows, the AI Usage Chrome Native Messaging host is now delivered as a fleet-managed Agent extension that is only installed when End User Device Monitoring is enabled (infrastructure_mode: end_user_device). It is no longer unconditionally installed by the MSI, and is skipped on Agent upgrades when End User Device Monitoring is disabled.
• APM: Added cardinality limits to client-side stats computation in the stats concentrator. These limits are no-op in the agent and are intended for use by the Go tracer.
• Agents are now built with Go 1.26.5.

Agent

Prelude

Released on: 2026-07-30

• Please refer to the 7.81.3 tag on integrations-core for the list of changes on the Core Checks

Bug Fixes

• Windows: Fixed an issue where the DDAGENTUSER_KEEP_RIGHTS opt-out was not preserved when the Agent was upgraded through Fleet Automation. Fleet-triggered upgrades uninstall and reinstall the Agent MSI as two separate steps, which cleared the stored opt-out before the reinstall could read it back, causing the SeDeny*LogonRight assignments on the Agent service account to be reapplied even when the customer had previously opted out with DDAGENTUSER_KEEP_RIGHTS=1. In-place MSI upgrades were not affected.
• Fixed an issue where Remote Configuration would sometimes attempt to process client requests that had already timed out.

Datadog Cluster Agent

Prelude

Released on: 2026-07-30 Pinned to datadog-agent v7.81.3: CHANGELOG.

Agent

Prelude

Released on: 2026-07-22

• Please refer to the 7.81.2 tag on integrations-core for the list of changes on the Core Checks

Upgrade Notes

• Metrics now use the Datadog v3 intake by default for Datadog destinations.
  Metric destinations configured with non-Datadog-looking URLs, such as custom additional_endpoints and reverse proxies, continue to use the v2 intake by default. To enable v3 for every destination, set use_v3_api.series.enabled: "true". To keep using v2 intake, set use_v3_api.series.enabled: "false" (global) or use_v3_api.series.endpoints: { "": "false" } (per-endpoint).

Bug Fixes

• On macOS, opening the Datadog Agent GUI via the fallback launch method no longer steals focus from the application the user is currently working in.

Datadog Cluster Agent

Prelude

Released on: 2026-07-22 Pinned to datadog-agent v7.81.2: CHANGELOG.

Agent

Prelude

Released on: 2026-07-08

• Please refer to the 7.81.0 tag on integrations-core for the list of changes on the Core Checks

Metrics are now forwarded to the new Datadog v3 API by default (/api/intake/metrics/v3/series). The v3 API payload format is more compact, reducing outbound bandwidth from Agents to Datadog.

If you configure additional_endpoints to forward to a non-Datadog endpoint, you will likely need to disable v3 for this endpoint. Otherwise you will see 404s. This can be done via:

use_v3_api:
  series:
    endpoints: "<additional_endpoint>": false

Example:

additional_endpoints:
  "https://non-datadog-endpoint": apikey2

will need:

use_v3_api:
  series:
    endpoints:
      "https://non-datadog-endpoint": false

Metrics sent to Observability Pipelines Worker continue to use the v2 API by default.

To keep using v2 endpoint, set use_v3_api.series.enabled: "false" (global) or use_v3_api.series.endpoints: { "": "false" } (per-endpoint; shown above).

Upgrade Notes

• The DDOT feature gate exporter.datadogexporter.metricremappingdisabled has been removed and replaced with exporter.datadogexporter.DisableAllMetricRemapping.
• Removed the agent status py subcommand (which wasn't officially supported)
• On Linux, the agent process manager systemd units were renamed from datadog-agent-procmgrd.service / datadog-agent-procmgrd-exp.service to datadog-agent-procmgr.service / datadog-agent-procmgr-exp.service. The dd-procmgrd binary and its paths are unchanged.

On upgrade, the installer stops and removes the legacy procmgrd-suffixed unit files so only one process manager daemon binds the socket. Update any custom automation that referenced the old unit names.

• Upgrade OpenTelemetry Collector dependencies from v0.152.0 to v0.153.0 (core v1.58.0 to v1.59.0).

See the full upstream changelogs: collector-contrib v0.153.0, collector core v0.153.0.

• Upgrade OpenTelemetry Collector dependencies from v0.153.0 to v0.154.0 (core v1.59.0 to v1.60.0).

See the full upstream changelogs: collector-contrib v0.154.0, collector core v0.154.0.

New Features

• In-place vertical scaling is enabled as the default strategy for workload autoscaling.
• New metrics for GPU memory have been added to the GPU Monitoring product:
  • gpu.memory.utilization: Ratio of used memory compared to total memory.
• Add passthrough entry for genresources EVP intake track.
• This change adds two new metric points for the GPU Monitoring product:
  • gpu.pci.link.speed.current: Current usable bandwidth for the PCI link in bytes per second
  • gpu.pci.link.speed.max: Max usable bandwidth for the PCI link in bytes per second
• Add a new ReportIssue method to the Python bridge to report issues to Agent Health Platform
• APM: The trace-agent can now receive span tag equivalence and peer tag mapping updates over Remote Configuration and apply them at runtime, without an agent restart. The feature is opt-in via the new remote_configuration.apm_semantics.enabled setting (default false). Stats aggregation picks up the updated peer-tag keys on the next span processed. If the backend removes or untargets a previously-applied payload, the trace-agent reverts to the mappings it ships with. Existing deployments see no behavior change with default settings.
• APM: remote_configuration.agent_config.enabled is now a settable configuration entry that controls the trace-agent's Remote Configuration subscription for agent-config updates (such as runtime log-level overrides) independently from remote_configuration.apm_sampling.enabled. When the user has explicitly set apm_sampling.enabled but not agent_config.enabled, the trace-agent mirrors the former into the latter so existing configurations continue to behave exactly as before.
• On Linux, when the DDOT extension is installed with the Datadog Agent, DDOT is now managed by dd-procmgrd through processes.d/datadog-agent-ddot.yaml instead of relying on the legacy datadog-agent-ddot systemd unit. Uninstalling the extension removes that config file. To roll back to the legacy behavior manually, remove processes.d/datadog-agent-ddot.yaml and restart datadog-agent.
• Add Go stack trace aggregation to the auto multi-line log pipeline. When auto multi-line aggregation is enabled (logs_config.auto_multi_line_detection), multi-line Go crash dumps (panic:, fatal error:, runtime: errors, signal crashes, and unexpected faults) are automatically detected and combined into a single log entry using a streaming state-machine parser.
• gpu: all gpu.nvlink.* metrics now have a nvlink_port tag and are emitted per-port. We provide GPU-level alternatives for certain metrics such as gpu.nvlink.throughput.data.rx/tx.total
• Enable instrumentation_crd_controller.enabled and a new autodiscovery provider will schedule checks derived from DatadogInstrumentation custom resources deployed in the Kubernetes cluster.
• Parses and collects kubernetes.pod.cpu.requests, kubernetes.pod.memory.requests, kubernetes.pod.cpu.limits, and kubernetes.pod.memory.limits.
• Process Autodiscovery is now enabled by default on Linux through the process autoconfig feature. It can be disabled with DD_AUTOCONFIG_EXCLUDE_FEATURES=process.
• Register process_manager.enabled in the Agent configuration schema (pkg/config/schema/core_schema.yaml), set its default in pkg/config/setup, and document it in config_template.yaml. On Windows, this option controls whether the core Agent starts dd-procmgr-service. On Linux, dd-procmgrd is started by systemd; this setting is ignored there.

Enhancement Notes

• Use compensated floating point summation to accurately calculate the sum and average aggregates of histograms for inputs where magnitudes significantly vary.
• Scale .sum, .avg, and .count aggregates by the exact 1/SampleRate to avoid undercount of these aggregates for sample rates whose reciprocal is not an integer (e.g. @0.21).
• The macOS battery check now adds a power_state:battery_critical tag to the system.battery.power_state metric when the operating system reports a degraded battery.
• Update the SNMP traps database with new MIB additions, including PANZURA-TRAP-MIB.
• Updated the ntp check to support the default location of systemd-timesyncd (/etc/systemd/timesyncd.conf). The check now parses NTP= and FallbackNTP= keys in addition to the existing chrony/ntp.conf server / pool / peer directives.
• On startup the Datadog Agent will now validate its configuration against the schema and report any violations through the Agent Health pipeline.
• APM stats now mask additional metric tag values that exceed the value length or per-bucket cardinality limits.
• APM : The enable_otlp_container_tags_v2 behavior is now enabled by default. Container tags on OTLP traces are now extracted using the infraattributes processor instead of calling the tagger directly, reducing redundant work and outgoing traffic. To opt out, set disable_otlp_container_tags_v2 in apm_config.features.
• Agents are now built with Go 1.26.4.
• CWS: Add support for monitoring the socket system call, enabling detection rules based on socket creation events (domain, type, protocol).
• The comp/dataobs/queryactions component now supports an optional schedule field on Data Observability monitor queries. The field accepts a standard 5-field cron expression (e.g. "20 * * * *" for 20 minutes past every hour) and enables wall-clock-aligned scheduling in place of the fixed interval_seconds cadence. When both schedule and interval_seconds are set on the same query, schedule takes precedence and interval_seconds is ignored. At least one of the two fields must be set; the agent rejects Remote Configuration payloads containing queries where neither field is provided or where the cron expression is syntactically invalid.
• Expanded the functionality of the experimental fentry-based network connection tracer. This tracer remains experimental and disabled by default.
• gpu: add new PCI link width metrics gpu.pci.link.width.{current,max} and add degraded PCI link metrics gpu.pci.link.{width,speed}.degraded.
• gpu: add gpu.nvlink.errors.fec.{none,light,heavy} metrics to easily group error thresholds
• The in-place vertical autoscaler throttles disruptive resizes to at most 15% of a workload's replicas per reconcile, configurable via autoscaling.workload.in_place_vertical_scaling.disruption_tolerance_percent.
• use the /healthz route to check and validate kubelet connection, instead of the deprecated /spec route.
• The agent automatically detects Kueue-related labels in pods and adds them as kueue_local_queue and kueue_cluster_queue tags.
• Network Config Management: Adds support for Cisco ASA firewalls by adding a new profile for these. Previously, Cisco ASA was not supported and would be unmonitored by the NCM integration.
• Extended the ntp check's systemd-timesyncd discovery to also read drop-in files under /etc/systemd/timesyncd.conf.d/, /run/systemd/timesyncd.conf.d/, /usr/local/lib/systemd/timesyncd.conf.d/, /usr/lib/systemd/timesyncd.conf.d/. This covers hosts where NTP= is set by cloud-init or another tool that writes a drop-in instead ...

Read more

Assets 2

Agent

Prelude

Released on: 2026-06-24

• Please refer to the 7.80.3 tag on integrations-core for the list of changes on the Core Checks

Enhancement Notes

• Agents are now built with Go 1.25.11.

Bug Fixes

• Workload autoscaling: fixed a bug where, when running the Cluster Agent in high-availability mode (multiple replicas), the burstable mode of a DatadogPodAutoscaler could leave the CPU limit in place on a random subset of pods. The CPU-limit removal is now re-derived from the autoscaler spec in the admission controller, so every replica applies it consistently regardless of which one handles the admission request.
• Fix Private Action Runner self-enrollment failing silently on hosts with no direct internet access when a proxy is configured in datadog.yaml. Enrollment requests now respect the agent proxy settings (proxy.https, proxy.http, and no_proxy).
• Disable v3beta metrics intake shadow payloads when zlib compression is used.

Datadog Cluster Agent

Prelude

Released on: 2026-06-24 Pinned to datadog-agent v7.80.3: CHANGELOG.

Agent

Prelude

Released on: 2026-06-17

• Please refer to the 7.80.2 tag on integrations-core for the list of changes on the Core Checks

Enhancement Notes

• Compliance: CIS Docker rules (scope: docker) are no longer evaluated on Kubernetes nodes where the kubelet's CRI runtime is not Docker (e.g. containerd, CRI-O), avoiding false positives on GKE Container-Optimized OS which ships dockerd alongside containerd. The runtime is read from the kubelet's --container-runtime-endpoint flag or the containerRuntimeEndpoint field of its --config YAML; if it cannot be determined the rules continue to evaluate.

Security Notes

• Fixed a confused-deputy vulnerability in the Cluster Agent's AppSec ingress-nginx admission mutator where the pod's --configmap=/ argument was trusted verbatim, allowing a user with pod-create permission in one namespace to make the Cluster Agent service account create or update ConfigMaps and add labels and annotations in arbitrary namespaces. The mutator now requires the portion to match the pod's own namespace (or use the $(POD_NAMESPACE) downward-API substitution) and skips mutation otherwise, emitting a warning event on the pod. The vulnerability affected Cluster Agent releases starting from 7.78.0.

Bug Fixes

• Fix an issue where container log collection could stop for an individual container without recovering and without any error in the Agent logs. When a container's log stream was idle longer than logs_config.docker_client_read_timeout, the read timeout could cause the underlying Docker connection to close in a way that the tailer treated as a permanent shutdown, silently stopping log collection for that container until it was recreated or the Agent was restarted. The tailer now reconnects in this case, and only stops when the Agent is intentionally shutting down. Low-volume containers (for example, services that log only periodically) were the most affected.
• OTel Agent: Disable v3 series API shadow sampling, which is incompatible with the zlib compression the OTel Agent forces for the metrics intake.

Datadog Cluster Agent

Prelude

Released on: 2026-06-17 Pinned to datadog-agent v7.80.2: CHANGELOG.

Bug Fixes

• Fixed an issue where the admission controller connectivity probe webhook did not include the AKS selector requirements when admission_controller.add_aks_selectors was enabled, which could cause repeated webhook reconciliation conflicts on AKS.