Datadog Agent
$
npx @buildinternet/releases get datadog-agentMon
Wed
Fri
SepOctNovDecJanFebMarAprMayJunJulAugSep
LessMore
Releases14Avg4/moVersionsv7.80.2 to v7.83.2
Last Checked
1h ago
npx @buildinternet/releases get datadog-agent.. _Release Notes_7.83.2:
.. _Release Notes_7.83.2_Prelude:
Released on: 2026-09-16
7.83.2 tag on integrations-core <https://github.com/DataDog/integrations-core/blob/master/AGENT_CHANGELOG.md#datadog-agent-version-7832>_ for the list of changes on the Core Checks.. _Release Notes_7.83.2_Enhancement Notes:
gpu: Constant metrics (gpu.device.total, gpu.memory.limit,
gpu.core.limit, and gpu.memory.bar1.total) are reported on the cadence
set by the new gpu.static_metrics_reporting_interval (15 seconds by default) to
ensure accuracy when using weighted sums.
Single Step Instrumentation's tracer config mechanisms (the ddTraceConfigs
Targets field, remote-config policies, and the
admission.datadoghq.com/apm-inject.tracer-configs pod annotation) now also
accept OTEL_ prefixed environment variable names, in addition to the
existing DD_ prefix. This allows configuring a tracer's native OpenTelemetry
mode (e.g. OTEL_TRACES_EXPORTER, OTEL_EXPORTER_OTLP_ENDPOINT) through
SSI.
.. _Release Notes_7.83.2_Bug Fixes:
Fixed the Agent Data Plane pre-flight sending its metrics and API key to
datadoghq.com instead of the configured site. The generated
pre-flight configuration was built from the fully resolved Agent
configuration, so dd_url's default value appeared in it as though it
had been set explicitly, and an explicit dd_url takes precedence over
site. The pre-flight configuration is now built from the settings the
operator actually supplied, matching what a normally-supervised Agent Data
Plane reads from datadog.yaml.
Fix DD_NETWORK_PATH_COLLECTOR_FILTERS so JSON-encoded Network Path
collector filters are parsed and applied correctly.
.. _Release Notes_7.83.1:
.. _Release Notes_7.83.1_Prelude:
Released on: 2026-09-09
7.83.1 tag on integrations-core <https://github.com/DataDog/integrations-core/blob/master/AGENT_CHANGELOG.md#datadog-agent-version-7831>_ for the list of changes on the Core Checks.. _Release Notes_7.83.1_Bug Fixes:
Fix bug which made fast network path test billed to customer
Release the containerd view snapshot and lease taken for a container image SBOM scan even when the scan is cancelled or times out. The release ran on the scan's own context, so a scan that hit its deadline left the snapshot behind, and on a lazy snapshotter that snapshot holds the layer it materialised.
.. _Release Notes_7.83.1_Other Notes:
datadog-installer status... _Release Notes_7.83.0:
.. _Release Notes_7.83.0_Prelude:
Released on: 2026-09-03
7.83.0 tag on integrations-core <https://github.com/DataDog/integrations-core/blob/master/AGENT_CHANGELOG.md#datadog-agent-version-7830>_ for the list of changes on the Core Checks.. _Release Notes_7.83.0_New Features:
Add a Data Security provider that schedules one-off database scan checks
triggered through Remote Configuration. It is enabled when both
data_security.enabled and shared_library_check.enabled are set, and
currently targets PostgreSQL databases already monitored by the Agent (via the
postgres check).
Add k8s cluster receiver, k8s leader elector extension, and count connector to the DDOT
(Datadog Distribution of OpenTelemetry Collector) default manifest, enabling collection
of Kubernetes cluster-level metrics, leader election coordination for Kubernetes receivers,
and count-based metric generation via the OpenTelemetry Collector pipeline.
Add Helm rollback action
Adds an Agent Data Plane (ADP) preflight mode, controlled by the new
data_plane.preflight_mode setting (enabled by default).
When data_plane.enabled has not been set at all, the Agent starts ADP once at
startup for 90 seconds in an isolated configuration, sends a single
throwaway metric through it, then stops it and reports any startup errors to Datadog
as agent telemetry. This surfaces environment-specific ADP problems before ADP is
enabled for real.
The preflight process handles no customer data: it runs in standalone mode, listens only on
a temporary DogStatsD endpoint under the Agent's run directory, does not register with
the Agent's remote agent registry, and never takes over the Agent's own DogStatsD port.
The temporary configuration it is given contains the Agent's resolved configuration, so it
is written user-only and removed once the run finishes. To keep values that were only ever
held in memory from being written out this way, the pre-flight does not run at all when
secrets are in use: when secret_backend_command, secret_backend_type or
multi_secret_backends is set, or when any setting has already been resolved from a
secret. Setting data_plane.enabled explicitly to either true or false, or
setting data_plane.preflight_mode to false, also disables the pre-flight, as does
running an Agent package that does not ship ADP.
APM : Add support for span-derived primary tags on span metrics produced by
the Datadog Distribution of OpenTelemetry Collector (DDOT). Set
span_derived_primary_tags on the datadog connector's traces
section to a list of attribute keys, and the value of each key found on a
span (or, failing that, on its resource) is attached to the APM stats the
connector emits, letting you break down span metrics by those tags:
.. code-block:: yaml
connectors:
datadog/connector:
traces:
span_derived_primary_tags: [team, region]Keys absent from both the span and its resource attributes are omitted. Each key must also be configured as a primary tag in your Datadog organization; keys that are not registered as primary tags are dropped by the intake and do not appear on the resulting span metrics.
CWS set actions accept a new capture field, a regular expression with a
single capture group that is applied to the value of field to extract part of
it. This makes it possible to lift an identifier embedded in an event field, such
as a command id inside a file path or an IAM role inside an IMDS url, and store it
as a scoped variable rather than storing the whole field value. capture can
only be used together with field, and only on fields holding a single string.
A value that does not match the expression leaves the variable untouched.
When data_security.enabled is set, the Agent now forwards
sensitive-data-scanner findings to Datadog as structured sds-result
payloads on the event platform.
Scaffold PostgreSQL support to the data security check.
DDOT (Datadog Distribution of OpenTelemetry Collector): the embedded
datadog exporter now honors the orchestrator_explorer setting when
the OpenTelemetry Agent runs in standalone mode (DD_OTEL_STANDALONE=true).
When enabled, Kubernetes resource manifests collected by a k8sobjects
receiver in the exporter's logs pipeline are forwarded to the Orchestrator
Explorer (Kubernetes Resources) intake. In connected mode this setting is
ignored, as the Datadog Cluster Agent already collects and ships
orchestrator data.
Add support for additional log collection options for Kubernetes workloads through DatadogInstrumentation resources.
Adds support for configuring Network Path Dynamic Test filters through Remote Config.
Adds support for scheduling Network Path tests through Remote Config.
Added ConfigMap collection to the Kubernetes Orchestrator. ConfigMap manifests are
sent with their data and binaryData fields stripped. The collector is
disabled by default (IsStable: false) and must be activated explicitly by
listing configmaps in the collectors field of the orchestrator check
instance configuration.
The DDOT (OpenTelemetry) config converter now automatically injects the
cumulativetodelta processor into metrics pipelines that export to the
datadog exporter, converting all cumulative metric types (sum, histogram
and exponential histogram) to delta. The processor is added only to metrics
pipelines, and is skipped for any pipeline where a cumulativetodelta
processor is already defined. This behavior is controlled by the new
cumulativetodelta entry in otelcollector.converter.features, which is
enabled by default; remove it from that list to disable the auto-injection.
OTLP ingestion: Adds a new otlp_config.logs.infra_attributes.tags_as_ddtags option. When enabled,
custom tagger-derived tags (for example, tags configured via
kubernetesResourcesLabelsAsTags/kubernetesResourcesAnnotationsAsTags) are written as real
Datadog log tags instead of log attributes for OTLP logs ingested directly by the Agent. Default
behavior is unchanged. (commit 522ee5fe634)
DDOT: The infraattributes processor now supports a new logs_tags_as_ddtags option. When
enabled, custom tagger-derived tags (for example, tags configured via
kubernetesResourcesLabelsAsTags/kubernetesResourcesAnnotationsAsTags) are written as real
Datadog log tags instead of log attributes. Default behavior is unchanged. (commit 522ee5fe634)
Added a com.datadoghq.remoteaction.agent Private Action Runner bundle
exposing read-only datadog-agent operations (status, diagnose, and
configuration) as remote actions executed against the local Agent's
authenticated IPC API. (Preview)
Added a generateFlare action to the
com.datadoghq.remoteaction.agent Private Action Runner bundle that builds
a flare archive on the Agent host. (Preview)
The Private Action Runner now supports a split deployment model in which a dedicated on-demand executor runs actions in a separate process, reachable over a local gRPC socket secured with mutual TLS.
Added the data_security.enabled configuration flag (disabled by
default) which enables the sds-result event platform forwarder used to
send sensitive-data-scanner results to Datadog.
Add the Data Security feature to scan monitored PostgreSQL databases for
sensitive data, driven remotely through Remote Configuration
(DATA_SECURITY_DB_SCAN_TASKS). Enabled with data_security.enabled and
shared_library_check.enabled.
Agent Cloud Auth (delegated authentication / Workload Identity Federation) on AWS now
resolves credentials from EKS IRSA, ECS task roles, EKS Pod Identity and EC2 IMDS in the
trace-agent, standalone DogStatsD, private action runner, IoT Agent and Heroku Agent.
Previously only flavors built with the ec2 build tag (main Agent, Cluster
Agent, process-agent, security-agent, system-probe, installer) supported those credential
sources; the others silently disabled the feature. Most notably the trace-agent is now
covered, so APM no longer requires a statically configured api_key when Cloud Auth is in
use. OpenTelemetry Collector (DDOT / otel-agent) is not covered: it does not load the
delegated authentication component, and still requires a statically configured api_key.
Setting delegated_auth.aws.region without delegated_auth.provider no longer skips
cloud provider auto-detection. The configured region is now applied to the auto-detected
provider, as intended, instead of being treated as an explicit provider configuration.
.. _Release Notes_7.83.0_Enhancement Notes:
Notable Events on Windows now reports critical temperature events: system shutdown or hibernation triggered by a critical thermal condition.
The Linux Agent packages now ship a built-in datasecurity Rust-based
check as a shared library under /etc/datadog-agent/checks.d. This is an
initial scaffold and is not enabled by default.
Rust artifacts are now built with codegen-units = 1 to minimize the
size of the produced binaries and shared libraries.
The kubelet check now collects kubelet.containers_per_pod (.count and .sum),
a histogram of the number of containers running per pod on a node. This provides
visibility into the distribution of container counts across pods, which can help
identify pods with unusually high sidecar/container density.
Adds kubernetes-actions functionality to the private action runner in the DCA.
Adds ability to patch daemonsets and statefulsets through the kubernetes-actions pipeline.
Add exporter.datadogexporter.AddUnits feature gate that maps OTLP (UCUM) metric units to their Datadog equivalents.
APM : Supported new db.system.name attribute replacing db.system
according to changes in OpenTelemetry Semantic Conventions (v1.30.0+).
APM: agent status now shows the live trace-semantics registry in the APM
Agent section, reporting whether it comes from Remote Configuration or the
embedded default along with its content hash and version.
APM: Reduced memory allocations when decoding incoming v0.4 and v0.5 trace
payloads with the convert-traces feature enabled. Span
attributes are now batch-allocated while converting to the internal trace
format, lowering allocation counts and garbage-collection pressure in the
trace-agent receiver. This has no effect when convert-traces is disabled.
The Rust shared-library checks are now built with Bazel, which enables running their unit tests and clippy lint checks in CI as part of the build.
Agents are now built with Go 1.26.7.
Check instances scheduled via configuration discovery now carry the
dd_config_discovery:true tag. This can be used to identify,
and if needed exclude, metrics submitted by an autodiscovered check that
duplicates a check configured manually elsewhere for the same service.
Data Security scan results now report the total number of sensitive-data
matches found in each column (count_matches), in addition to the number
of distinct rows that contain a match. This gives more accurate visibility
when a single row contains several matches.
The Data Security check now resolves its PostgreSQL source from fully
templated autodiscovery configurations, so scan targets are matched
reliably when the PostgreSQL integration is configured with template
variables such as %%host%%.
The data security check now reports the number of scanned rows and the list of scanned columns (name and data type) for each scanned table in its scan results.
Augment the datasecurity component with the sensitive data scanner
library.
Add a new dogstatsd_require_listener configuration option (disabled by
default). When enabled, DogStatsD exits with a non-zero status if it cannot
create any listener (UDP port, Unix socket, or named pipe), which would
otherwise leave DogStatsD running with no way to receive metrics. Enable it
so a process supervisor can detect and restart a non-functional DogStatsD.
The dogstatsd_stream_socket configuration option, which lets DogStatsD
listen for metrics on a Unix domain socket using stream mode (SOCK_STREAM),
is now considered stable.
gpu: add volatile ECC error metrics as a counterpart to the existing aggregate (lifetime) ones,
including errors.ecc.corrected.volatile and
errors.ecc.sram.uncorrected_by_subtype.volatile.
The Agent flare now includes ulimit.log (the running Agent process'
resource limits, on non-Windows platforms) and, on AIX, svmon.log (a
per-segment virtual memory breakdown from svmon -P). These help
diagnose resource-exhaustion issues without requiring a separate manual
collection step from the host.
gpu: Add NVLink fabric cluster UUID and clique ID to GPU tags (gpu_fabric_cluster_uuid and gpu_fabric_clique_id).
GPU: emit gpu.errors.xid, a count of NVIDIA XID errors in each collection interval.
gpu.errors.xid.total remains the lifetime total since the Agent started collecting events.
In Kubernetes environments, the apm_config.apm_non_local_traffic and
jmx_use_container_support defaults are now applied directly by the Agent
binary instead of relying on the datadog-kubernetes.yaml file shipped in
the container image. This preserves these Kubernetes defaults even when
external tooling (such as the Datadog Operator or Helm chart) replaces
datadog.yaml. Values explicitly set via a config file or environment
variable continue to take precedence.
The orchestrator check now collects DatadogInstrumentation
(datadoghq.com/v1alpha1) custom resources as part of the out-of-the-box
set indexed by the Kubernetes Explorer, alongside the other
datadoghq.com custom resources. Collection requires
orchestrator_explorer.custom_resources.ootb.enabled (enabled by
default) and is skipped when the custom resource definition is absent from
the cluster.
OTLP: Mapped the service.namespace resource attribute to a
service.namespace tag by default. OpenTelemetry semantic conventions
only guarantee service.name / service.instance.id uniqueness within
a service.namespace, so it is now preserved to keep service identity.
On Windows and Linux, the fleet installer now also registers the Private Action Runner's
on-demand executor with dd-procmgr.
Private Action Runner in Datadog Agent now emits healthcheck metrics like its standalone counterpart.
Private Action Runner: add the
private_action_runner.restricted_shell.allowed_system_services setting
to further restrict system-service action grants resolved by Datadog
execution policies. Leaving the setting unset preserves the backend grants;
configuring an empty map blocks all system-service operations.
The Agent can now refresh secrets-managed API keys when a Remote Agent reports an Invalid API Key event.
End User Device Monitoring no longer applies a preconfigured set of SaaS
domain filters to network_path.collector.filters. Network Path
filters are now empty by default in end_user_device mode, and
user-configured filters are preserved unchanged.
Bumped the Security Agent policies to v0.83.0 <https://github.com/DataDog/security-agent-policies/compare/v0.82.0...v0.83.0>_
Shared-library checks now honor an explicit min_collection_interval: 0 as
one-shot scheduling (the check runs a single time), matching the behavior of
Python checks.
Logs emitted by shared library checks are now routed through the Datadog Agent logger, so their output is formatted and level-filtered consistently with other checks instead of being written directly to standard output.
SNMP device scans now walk devices using GetBulk by default, requesting only OIDs the device actually returns and adapting the max-repetitions on failures. This avoids the infinite loops and device crashes that could occur with the previous GetNext-based walk. SNMPv1 devices, which do not support GetBulk, continue to use the GetNext walk.
SNMP device scans now report results incrementally while the scan is running instead of only after it completes, so large devices surface OIDs sooner.
Upgrade OpenTelemetry Collector dependencies from v0.156.0 to v0.158.0 (core v1.62.0 to v1.64.0).
See the full upstream changelogs:
collector-contrib v0.157.0 <https://github.com/open-telemetry/opentelemetry-collector-contrib/releases/tag/v0.157.0>,
collector core v0.157.0 <https://github.com/open-telemetry/opentelemetry-collector/releases/tag/v0.157.0>.
collector-contrib v0.158.0 <https://github.com/open-telemetry/opentelemetry-collector-contrib/releases/tag/v0.158.0>,
collector core v0.158.0 <https://github.com/open-telemetry/opentelemetry-collector/releases/tag/v0.158.0>.
Agent Cloud Auth (delegated authentication) now reports why it did not start. When
org_uuid is configured but no supported cloud provider is detected, the Agent logs
a warning naming every credential source it checked instead of a debug-level message,
and agent status shows the reason rather than only "not enabled".
The agent status Delegated Authentication section now reports the AWS credential
source in use for each managed API key (static environment variables, IRSA web
identity, ECS/EKS container credentials, or EC2 IMDS), along with the last and next
scheduled key refresh and the last error.
Agent Cloud Auth (delegated authentication) failures now name the AWS credential
mechanism that was attempted and what to check for it, instead of reporting a generic
missing AWS credentials. Credential resolution that returns blank credentials, for
example when the EC2 metadata service answers with an error document, is now treated
as a failure rather than reported as a successful resolution.
The windows_certificate check now supports filters.include and filters.exclude configuration to scope certificate collection by any emitted tag key (thumbprint, SAN, CN, friendly name, template, etc.) using Go regex patterns.
.. _Release Notes_7.83.0_Deprecation Notes:
gpu_monitoring.enable_ebpf_probes to true in
system-probe.yaml to keep using them... _Release Notes_7.83.0_Security Notes:
In FIPS mode, the default SNMPv3 authentication and privacy protocols
used when authKey/privKey are set without an explicit
authProtocol/privProtocol are now SHA-256/AES instead
of MD5/DES, since MD5 and DES are not FIPS 140-3
compatible. Outside FIPS mode, the defaults remain unchanged.
The otel-agent flare command now writes its diagnostic archive into a
private, unpredictably-named directory (restricted to the current user)
instead of a predictable, world-readable path in the shared system temporary
directory. Previously, on a multi-user host, another local user could read
the flare contents (collected configuration, environment variables, and
debug data), or redirect the archive by pre-creating a symlink at the
predictable path.
.. _Release Notes_7.83.0_Bug Fixes:
APM: The trace-agent refreshes the API key and retries on a 403 only when
secret_refresh_on_api_key_failure_interval is set (> 0), now consistent with
metrics and logs
APM : Container tags resolution debug information is now stored using the tracer payload's deduplicated string table instead of inline strings, reducing the size of payloads that include this debug information.
APM: Fix trace-agent crashes on malformed trace payloads that contain nil entries: nil spans, span links, or span events, and nil span-event attribute values. Nil entries are now dropped at decoding and conversion boundaries before payloads reach trace processing.
APM: Fix a trace-agent crash when a /v1.0/traces trace chunk carries a
trace ID that is not 16 bytes long. Chunk trace IDs are now normalized to
16 bytes during normalization instead of panicking on an out-of-bounds
slice in the score and probabilistic samplers.
APM: ProbabilisticSampler now properly uses the lower order bits of the trace ID on v1 traces.
APM: Fix a trace-agent crash from unbounded recursion when decoding deeply nested attribute values; nesting depth is now bounded.
APM: Fix a trace-agent crash when a span event attribute declares an array type but carries a missing array or array element.
APM V1 trace endpoint now safely skips unknown fields, harvesting any inline strings they carry into the string table so that streaming-string references in later known fields continue to resolve correctly.
Keep daemon specific default log filepaths now that the core agent's
log_file configuration is populated.
Windows: Fix a crash in the Agent when a statsd client configured to use a
named pipe is closed without ever having successfully written to that pipe.
The named pipe connection is established on first write, so closing such a
client dereferenced a nil connection and terminated the process. Fixed by
updating datadog-go to v5.9.1.
[DBM] Bump go-sqllexer to v0.2.4 to fix a SQL normalization bug:
ESCAPE '\' and truncate the
obfuscated query.Bump the embedded GoSNMP library to fix SNMPv3 engine-ID discovery and improve robustness of SNMP OID and varbind parsing.
APM: Make the automatic library injection mode use the CSI driver only when the injector and library images come from configured Datadog registries. Images from other registries now fall back to init containers so Kubernetes can use the workload's image pull credentials.
APM: Fixed Dynamic Instrumentation snapshot and log-probe uploads failing
with a connection reset when the Logs product is disabled
(logs_enabled: false). The debugger proxy now drains the request body
before responding, so these uploads are dropped cleanly instead of
resetting the tracer's connection.
On ECS Managed Instances in daemon mode, the ECS workloadmeta collector no longer
fails to start when the ECS Metadata v1 introspection endpoint is unreachable. The
collector now falls back to the metadata v4 /tasks endpoint, which provides all
the task data this deployment needs. Previously a v1 failure produced no ECSTask
entities for the whole host, so container.* metrics were missing the
task_arn, task_family, task_version, ecs_cluster_name and
ecs_container_name tags. ECS EC2 daemon mode still requires metadata v1, which
provides its task list.
ECS cluster metadata (cluster name, cluster ID, region and AWS account ID) now falls back to the Agent's own task metadata when the ECS Metadata v1 introspection endpoint is unavailable. This fixes the orchestrator ECS check being skipped, the container lifecycle check reporting an empty cluster ID, and the flare missing its ECS section on ECS Managed Instances. The fallback applies to every non-Fargate launch type, so ECS EC2 deployments whose v1 introspection endpoint is unreachable now resolve cluster metadata instead of failing.
The Cluster Agent no longer schedules endpoints checks against EndpointSlice
endpoints that are not ready or are terminating. This restores the behavior
of the v1.Endpoints code path, which only ever targeted ready addresses,
and stops checks from erroring out against pods that are shutting down or
failing their readiness probes.
Fixed an issue where the Docker container collector could not inspect a
container whose image declares a port range in its exposed ports (for
example EXPOSE 1061-1070). Such containers were skipped entirely with an
invalid port '1061-1070': invalid syntax error. Older Docker daemons
return these ranges verbatim, which the container inspect decoder rejected.
The Agent now expands port-range entries into individual ports so the
container is collected normally.
Fix agent status (and the JSON/HTML status renderers) showing a stale HA Agent
state (active/standby). The status page previously read a snapshot cached by the periodic
inventory metadata collector, which could lag up to inventories_max_interval (10 minutes by
default) behind the agent's actual HA state. The status page now reflects the live state on
every call, matching the behavior already used by the flare payload.
Stop the Agent from repeatedly attempting to connect to a Kubelet on hosts
that are not running on Kubernetes. This removes the recurring
Impossible to reach Kubelet through HTTPS, fallback to HTTP warning
logged by host-based and non-Kubernetes containerized installations. There is no change in
behavior on Kubernetes nodes.
Logs Agent: fixed a file source that could stop collecting permanently
(Bytes Read: 0) after its log file was rotated or truncated below the offset
already read. When a tailer starts, the Agent now checks that the offset stored for
the file is still within it, and restarts from the beginning of the file when it is
not.
Fixed the kubernetes_state.deployment.rollout_duration metric occasionally reporting erroneous large values after a cluster agent restart
Fix chassis type detection on Windows for convertible and detachable
2-in-1 devices (SMBIOS codes 31 and 32), which were previously reported
as Other.
Agent GUI now follows symbolic links when processing conf.d items.
Fix the NVIDIA Jetson check so missing or frequency-only GPU fields in
tegrastats output do not prevent other Jetson metrics from being
collected.
OTel Agent: The datadog extension no longer probes cloud metadata source providers when a hostname
is already set in the configuration, avoiding spurious GCP metadata server requests on non-GCP hosts.
See open-telemetry/opentelemetry-collector-contrib#49241 <https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/49241>_.
Fixed a crash loop in standalone otel-agent (DD_OTEL_STANDALONE=true) when deployed
alongside a core Datadog Agent that injects DD_REMOTE_CONFIGURATION_ENABLED=true or
DD_AGENT_IPC_CONFIG_REFRESH_INTERVAL into its environment, such as when using the
Datadog Operator. Standalone mode now reliably disables Remote Configuration and config
sync regardless of these environment variables, since it has no core agent IPC endpoint
to use them with.
The private action runner now stops heartbeating a task once the backend reports it no longer exists, instead of retrying indefinitely.
Prevent double counting container memory limits when no limit is set
on the container level and the limit is only set on the pod level.
Use the metric kubernetes.memory.limits to only expose memory limits
set explicitly at the container level.
Fixed missing network IP metadata for the Agent when running containerized
without host networking (the common case for most Kubernetes deployments).
Previously, network metadata collection was skipped entirely in this case.
The Agent now falls back to reporting the node's IP address, using the
existing kubernetes_kubelet_host configuration value.
A panic in a Rust-based shared-library check no longer aborts the whole Agent. The panic is now caught at the check boundary and surfaced as a check error, keeping the rest of the Agent running.
Fixed the host SBOM scan (sbom.host.enabled) reporting no packages when
the Agent runs as dd-agent. The scan walks the paths the enabled
analyzers declare, one of which is /root/buildinfo/content_manifests,
and /root is only traversable by root. Such a path is now skipped and
the scan reports the packages it found.
.. _Release Notes_7.83.0_Other Notes:
Agent Data Plane has been bumped to version 1.4.0. See the Agent Data Plane 1.4.0 release notes <https://github.com/DataDog/saluki/releases/tag/1.4.0>_.
The datasecurity shared-library check now embeds the datadog.sds
protobuf definitions used to report scan results. This is internal wiring;
no scan results are emitted yet.
The ddot-collector image now starts in standalone mode by default.
Using it in bundled mode now requires to explicitly set DD_OTEL_STANDALONE to false.
In ECS daemon mode, the ECS workloadmeta collector now returns a startup error when the ECS Metadata v1 instance data cannot be retrieved and no v1-independent task parser is available, instead of starting without a task parser. Startup is retried, so the collector recovers once the endpoint becomes reachable.
The Agent no longer reports a Check Execution Failure health platform issue when a check run fails.
Shared-library (Rust) checks can now submit event platform events as raw bytes, in addition to strings, allowing binary payloads such as protobuf.
.. _Release Notes_7.82.3:
.. _Release Notes_7.82.3_Prelude:
Released on: 2026-08-26
7.82.3 tag on integrations-core <https://github.com/DataDog/integrations-core/blob/master/AGENT_CHANGELOG.md#datadog-agent-version-7823>_ for the list of changes on the Core Checks.. _Release Notes_7.82.3_Enhancement Notes:
1.26.7... _Release Notes_7.82.3_Bug Fixes:
The Dynamic Instrumentation proxy in the trace-agent no longer drops
debugger data when logs_enabled is left unset. Data is only dropped
when logs_enabled (or the deprecated log_enabled) is explicitly
set to false.
On Windows, fixed an issue where upgrading the Agent without providing
DDAGENTUSER_PASSWORD could lock out a domain Agent user account. The installer now
leaves dd-procmgr-service, and the components it supervises, disabled until the
Agent user password is provided again.
.. _Release Notes_7.82.2:
.. _Release Notes_7.82.2_Prelude:
Released on: 2026-08-19
7.82.2 tag on integrations-core <https://github.com/DataDog/integrations-core/blob/master/AGENT_CHANGELOG.md#datadog-agent-version-7822>_ for the list of changes on the Core Checks.. _Release Notes_7.82.2_New Features:
infrastructure_mode: end_user_device is set, the logon_duration
feature is now enabled automatically, so operators no longer need to set
logon_duration.enabled: true separately. This setting can still be
overridden explicitly in the configuration file if needed... _Release Notes_7.82.2_Enhancement Notes:
The Agent's embedded Python has been upgraded from 3.13.14 to 3.13.15
Agents are now built with Go 1.26.6.
.. _Release Notes_7.82.2_Bug Fixes:
APM: Raise the messagepack decoder allocation limit for the span meta_struct
field to 10MiB, so large meta_struct entries (as written by LLM Observability)
are no longer rejected by the package-wide 500,000 element limit. Other span
fields keep the lower limit.
Disable GPU parallel collection by default to avoid triggering NVML concurrency bugs.
gpu: fix concurrent calls to NVML GetFieldValues API, that could cause missing NVLink metrics.
.. _Release Notes_7.82.2_Other Notes:
.. _Release Notes_7.82.1:
.. _Release Notes_7.82.1_Prelude:
Released on: 2026-08-11
7.82.1 tag on integrations-core <https://github.com/DataDog/integrations-core/blob/master/AGENT_CHANGELOG.md#datadog-agent-version-7821>_ for the list of changes on the Core Checks.. _Release Notes_7.82.1_Bug Fixes:
Windows: Fixed an issue where an explicit DDAGENTUSER_KEEP_RIGHTS or
DDAGENTUSER_NAME value passed as an install argument to a Fleet
Automation-triggered Windows Agent install/upgrade could be silently
overridden by a stale fallback value (respectively from the registry
and from the running service account).
Fix an issue where GPU monitoring could trigger a kernel panic on multi-GPU nodes with Hopper/Blackwell GPUs.
.. _Release Notes_7.82.0:
.. _Release Notes_7.82.0_Prelude:
Released on: 2026-08-05
7.82.0 tag on integrations-core <https://github.com/DataDog/integrations-core/blob/master/AGENT_CHANGELOG.md#datadog-agent-version-7820>_ for the list of changes on the Core Checks.. _Release Notes_7.82.0_Upgrade Notes:
Change default EVP track for AI usage to eudm-intake and disable
AI usage agent desktop monitoring by default (the monitor stays in
idle mode).
AI usage agent's ai_usage_native_host.yaml configuration file is
now regenerated from the packaged template on every Agent install and
upgrade to ensure the default changes take effect. This is a deliberate
short-term measure: it forces already-installed machines onto the
updated defaults. Once the defaults are settled (expected within a few
Agent releases), the installer will go back to preserving an existing
ai_usage_native_host.yaml and only creating it when missing.
Note that any customization made to the config file is discarded on
every Agent install and upgrade, and must be re-applied afterwards.
APM: Bump the default version of the datadog-apm-library-js package installed by the
Datadog installer from major version 5 to major version 6, following the release of
dd-trace-js v6.
APM: Updates the default JS (Node.js) library used for Kubernetes auto-instrumentation (Cluster Agent admission controller) from major version 5 to major version 6.
The legacy viper based configuration backend has been removed. The
DD_CONF_NODETREEMODEL environment variable and the
conf_nodetreemodel configuration setting no longer have any effect and
can be removed from your configuration. The Agent now always uses the
improved configuration implementation.
serverless-init no longer forces DD_TRACE_PROPAGATION_STYLE=datadog during
tracer auto-instrumentation. The tracer's own default (which includes W3C
tracecontext and baggage in addition to datadog) now applies, and a
customer-provided DD_TRACE_PROPAGATION_STYLE is respected. Applications that
relied on serverless-init restricting propagation to datadog only should set
DD_TRACE_PROPAGATION_STYLE=datadog explicitly.
.. _Release Notes_7.82.0_New Features:
Private Action Runner: add the com.datadoghq.remoteaction.rshell.runRemediationCommand
action. It behaves like runCommand but runs the restricted shell in
remediation mode, which additionally permits file-target output
redirections (>, >>, 2>, &>, &>>) and write-oriented
builtins such as truncate, all confined to the configured allowed
paths. The action is not enabled by default and must be explicitly added to
the runner's actions allowlist.
agent flare now includes diagnostic artifacts from the Agent Data Plane
(ADP) process when data_plane.enabled is set to true. If ADP is
unreachable at flare time, an UNREACHABLE.txt file containing the
connection error is written to ADP's subdirectory and the rest of the flare
completes normally.
When infrastructure_mode is set to cloud_cost_only, the Agent adds an
infra_mode:cloud_cost_only tag to metrics from selected integrations. Use
integration.cloud_cost_only.tagged to list which checks receive the tag; when
the list is empty (the default), all checks are tagged.
Add a new ``dogstatsd_no_aggre