7.82.0

Agent

Known Issues

• GPU Monitoring can trigger a kernel panic on multi-GPU nodes with Hopper/Blackwell GPUs. The workaround is to disable parallel collection (gpu.parallel_collectors: false), downgrade to Agent v7.81.3 or upgrade to v7.82.1 when it becomes available.

Prelude

Released on: 2026-08-05

• Please refer to the 7.82.0 tag on integrations-core for the list of changes on the Core Checks

Upgrade Notes

• Automatic multi-line log detection (logs_config.auto_multi_line_detection) is now enabled by default. Multi-line log messages such as stack traces and JSON blobs are aggregated into a single log entry out of the box, instead of being split into separate entries. To restore the previous behavior, set logs_config.auto_multi_line_detection to false (or the environment variable DD_LOGS_CONFIG_AUTO_MULTI_LINE_DETECTION=false).
• Change default EVP track for AI usage to eudm-intake and disable AI usage agent desktop monitoring by default (the monitor stays in idle mode). AI usage agent's ai_usage_native_host.yaml configuration file is now regenerated from the packaged template on every Agent install and upgrade to ensure the default changes take effect. This is a deliberate short-term measure: it forces already-installed machines onto the updated defaults. Once the defaults are settled (expected within a few Agent releases), the installer will go back to preserving an existing ai_usage_native_host.yaml and only creating it when missing. Note that any customization made to the config file is discarded on every Agent install and upgrade, and must be re-applied afterwards.
• APM: Bump the default version of the datadog-apm-library-js package installed by the Datadog installer from major version 5 to major version 6, following the release of dd-trace-js v6.
• APM: Updates the default JS (Node.js) library used for Kubernetes auto-instrumentation (Cluster Agent admission controller) from major version 5 to major version 6.
• The legacy viper based configuration backend has been removed. The DD_CONF_NODETREEMODEL environment variable and the conf_nodetreemodel configuration setting no longer have any effect and can be removed from your configuration. The Agent now always uses the improved configuration implementation.
• serverless-init no longer forces DD_TRACE_PROPAGATION_STYLE=datadog during tracer auto-instrumentation. The tracer's own default (which includes W3C tracecontext and baggage in addition to datadog) now applies, and a customer-provided DD_TRACE_PROPAGATION_STYLE is respected. Applications that relied on serverless-init restricting propagation to datadog only should set DD_TRACE_PROPAGATION_STYLE=datadog explicitly.

New Features

• Private Action Runner: add the com.datadoghq.remoteaction.rshell.runRemediationCommand action. It behaves like runCommand but runs the restricted shell in remediation mode, which additionally permits file-target output redirections (>, >>, 2>, &>, &>>) and write-oriented builtins such as truncate, all confined to the configured allowed paths. The action is not enabled by default and must be explicitly added to the runner's actions allowlist.

• agent flare now includes diagnostic artifacts from the Agent Data Plane (ADP) process when data_plane.enabled is set to true. If ADP is unreachable at flare time, an UNREACHABLE.txt file containing the connection error is written to ADP's subdirectory and the rest of the flare completes normally.

• When infrastructure_mode is set to cloud_cost_only, the Agent adds an infra_mode:cloud_cost_only tag to metrics from selected integrations. Use integration.cloud_cost_only.tagged to list which checks receive the tag; when the list is empty (the default), all checks are tagged.

• Add a new dogstatsd_no_aggregation_pipeline_workers_count configuration option to control the number of parallel workers processing messages in the no-aggregation pipeline. Defaults to 1 to preserve existing behavior.

• Adds Datadog CSI driver telemetry to COAT, including volume publish and unpublish attempts as well as library resolution, download count and duration, cleanup, cache size, cached library count, and library volume link metrics.

• The Datadog OTLP connector now scales APM stats (hits, errors, duration) by the probabilistic head-based sampling weight carried in the W3C tracestate (th threshold and p power-of-two encodings). When upstream head-based sampling has dropped a fraction of traces, the computed trace metrics are scaled up to reflect the true traffic volume instead of only the sampled subset.

• Envoy Gateway AppSec protection can now run in sidecar mode over a Unix domain socket. Datadog injects the serviceextensions ext_proc container into Envoy Gateway data-plane pods, and Envoy Gateway communicates with it through an Envoy Gateway Backend.

  This behavior is selected by cluster_agent.appsec.injector.mode, which now defaults to sidecar. Envoy Gateway must have the Backend extension API enabled with extensionApis.enableBackend: true; if it is disabled, the cluster agent warns and does not change Envoy Gateway configuration.

  This is a behavior change for AppSec-enabled Envoy Gateway deployments: they now default to sidecar injection instead of external Service mode. To keep the previous behavior, set cluster_agent.appsec.injector.mode to external.

• Added an experimental telemetry error log forwarder. Disabled by default, the Agent forwards records logged at ERROR level or higher to the COAT intake so Datadog Engineers can aggregate Agent errors across customer organizations. The forwarder shares the agent telemetry transport, inheriting endpoint and compression settings from the agent telemetry configuration.

• On Windows, datadog-installer now honors the DD_AGENT_MAJOR_VERSION and DD_AGENT_MINOR_VERSION environment variables, matching the Linux and macOS install scripts.

• GPU: add the gpu.device.needs_recovery metric, which reports whether a GPU requires a recovery action (such as a reset or node reboot) as exposed by NVML's GPU recovery action field. The value is 0 when no action is needed and 1 otherwise, and the metric is tagged with recovery_action (none, reset, reboot, drain or drain_and_reset).

• The agent status command now includes a "Logs Agent Backpressure" section reporting per-component utilization of the logs pipeline and an overall HEALTHY/WARNING/SATURATED state, making it easier to see which pipeline stage is the bottleneck when logs are delayed.

• On macOS, the Agent can now be restarted directly from the web-based GUI (Agent Manager).

• New Agent Secret Backend: "windows.regkey"

• APM Single Step Instrumentation now supports setting tracer configuration options via the admission.datadoghq.com/apm-inject.tracer-configs pod annotation, the annotation-based equivalent of the apm_config.instrumentation.targets[].ddTraceConfigs option. The value is a JSON array of objects (for example [{"name":"DD_PROFILING_ENABLED","value":"true"}]) and each entry's name must start with the DD_ prefix.

• NetFlow: automatically detect and split Cisco FirePower/ASA bidirectional (NSEL) flow records into two unidirectional flow events. NSEL records carry initiator→responder and responder→initiator byte/packet counts in NFv9 fields 231/232/298/299; the agent now captures these fields via built-in mappings and emits a separate flow for each direction with correctly swapped src/dst addresses, ports, and interfaces. No user configuration is required.

Enhancement Notes

• Malformed ad.datadoghq.com/service.* and ad.datadoghq.com/endpoints.* annotations on Kubernetes services are now reported as Autodiscovery misconfiguration health events when the health platform is enabled. The issue is resolved automatically once the annotation is fixed.
• Adds Agent Data Plane packaging and launchd service support to macOS Agent packages.
• Adds Agent Data Plane packaging to Windows Agent MSI installs. ADP is supervised by dd-procmgr via processes.d/datadog-agent-data-plane.yaml, written by the fleet installer during postinst (same pattern as DDOT on Windows).
• Emit datadog.cluster_agent.kubernetes_actions.running when kuberenetes actions product is enabled and running.
• Podman receiver metrics collected via the Datadog Distribution of OpenTelemetry (DDOT) Collector are now correctly classified with origin opentelemetry_collector_podmanreceiver instead of falling back to opentelemetry_collector_unknown.
• Added the data_plane.stop_timeout configuration setting, which controls the graceful shutdown budget for the Agent Data Plane (ADP). When unset, it derives its value from aggregator_stop_timeout + forwarder_stop_timeout, so customizing either of those component timeouts now extends ADP's shutdown window in lockstep with the core Agent.
• On startup the Datadog Agent now validates the system-probe configuration against its schema and reports any violations through the Agent Health pipeline. Only the values the customer set in the configuration are validated. This can be disabled with health_platform.invalidsysprobeconfig_check.enabled.
• On Windows, the AI Usage Chrome Native Messaging host is now delivered as a fleet-managed Agent extension that is only installed when End User Device Monitoring is enabled (infrastructure_mode: end_user_device). It is no longer unconditionally installed by the MSI, and is skipped on Agent upgrades when End User Device Monitoring is disabled.
• APM: Added cardinality limits to client-side stats computation in the stats concentrator. These limits are no-op in the agent and are intended for use by the Go tracer.
• Agents are now built with Go 1.26.5.
  ...

7.81.3

Agent

Prelude

Released on: 2026-07-30

• Please refer to the 7.81.3 tag on integrations-core for the list of changes on the Core Checks

Bug Fixes

• Windows: Fixed an issue where the DDAGENTUSER_KEEP_RIGHTS opt-out was not preserved when the Agent was upgraded through Fleet Automation. Fleet-triggered upgrades uninstall and reinstall the Agent MSI as two separate steps, which cleared the stored opt-out before the reinstall could read it back, causing the SeDeny*LogonRight assignments on the Agent service account to be reapplied even when the customer had previously opted out with DDAGENTUSER_KEEP_RIGHTS=1. In-place MSI upgrades were not affected.
• Fixed an issue where Remote Configuration would sometimes attempt to process client requests that had already timed out.

Datadog Cluster Agent

Prelude

Released on: 2026-07-30 Pinned to datadog-agent v7.81.3: CHANGELOG.

7.81.2

Agent

Prelude

Released on: 2026-07-22

• Please refer to the 7.81.2 tag on integrations-core for the list of changes on the Core Checks

Upgrade Notes

• Metrics now use the Datadog v3 intake by default for Datadog destinations.

  Metric destinations configured with non-Datadog-looking URLs, such as custom additional_endpoints and reverse proxies, continue to use the v2 intake by default. To enable v3 for every destination, set use_v3_api.series.enabled: "true". To keep using v2 intake, set use_v3_api.series.enabled: "false" (global) or use_v3_api.series.endpoints: { "<url>": "false" } (per-endpoint).

Bug Fixes

• On macOS, opening the Datadog Agent GUI via the fallback launch method no longer steals focus from the application the user is currently working in.

Datadog Cluster Agent

Prelude

Released on: 2026-07-22 Pinned to datadog-agent v7.81.2: CHANGELOG.

7.81.1

Agent

Prelude

Released on: 2026-07-15

• Please refer to the 7.81.1 tag on integrations-core for the list of changes on the Core Checks

New Features

• Add a new reflector-based Kubernetes event collection path, enabled via event_collection_mode: watch.

Enhancement Notes

• Agents are now built with Go 1.26.5.

Datadog Cluster Agent

Prelude

Released on: 2026-07-15 Pinned to datadog-agent v7.81.1: CHANGELOG.

7.81.0

Agent

Prelude

Released on: 2026-07-08

• Please refer to the 7.81.0 tag on integrations-core for the list of changes on the Core Checks

Metrics are now forwarded to the new Datadog v3 API by default (/api/intake/metrics/v3/series). The v3 API payload format is more compact, reducing outbound bandwidth from Agents to Datadog.

If you configure additional_endpoints to forward to a non-Datadog endpoint, you will likely need to disable v3 for this endpoint. Otherwise you will see 404s. This can be done via:

use_v3_api:
  series:
    endpoints:
      "<additional_endpoint>": false

Example:

additional_endpoints:
  "https://non-datadog-endpoint":
    - apikey2

will need:

use_v3_api:
  series:
    endpoints:
      "https://non-datadog-endpoint": false

Metrics sent to Observability Pipelines Worker continue to use the v2 API by default.

To keep using v2 endpoint, set use_v3_api.series.enabled: "false" (global) or use_v3_api.series.endpoints: { "<url>": "false" } (per-endpoint; shown above).

Upgrade Notes

• The DDOT feature gate exporter.datadogexporter.metricremappingdisabled has been removed and replaced with exporter.datadogexporter.DisableAllMetricRemapping.

• Removed the agent status py subcommand (which wasn't officially supported)

• On Linux, the agent process manager systemd units were renamed from datadog-agent-procmgrd.service / datadog-agent-procmgrd-exp.service to datadog-agent-procmgr.service / datadog-agent-procmgr-exp.service. The dd-procmgrd binary and its paths are unchanged.

  On upgrade, the installer stops and removes the legacy procmgrd-suffixed unit files so only one process manager daemon binds the socket. Update any custom automation that referenced the old unit names.

• Upgrade OpenTelemetry Collector dependencies from v0.152.0 to v0.153.0 (core v1.58.0 to v1.59.0).

  See the full upstream changelogs: collector-contrib v0.153.0, collector core v0.153.0.

• Upgrade OpenTelemetry Collector dependencies from v0.153.0 to v0.154.0 (core v1.59.0 to v1.60.0).

  See the full upstream changelogs: collector-contrib v0.154.0, collector core v0.154.0.

New Features

• In-place vertical scaling is enabled as the default strategy for workload autoscaling.

• New metrics for GPU memory have been added to the GPU Monitoring product:

  • gpu.memory.utilization: Ratio of used memory compared to total memory.

• Add passthrough entry for genresources EVP intake track.

• This change adds two new metric points for the GPU Monitoring product:

  • gpu.pci.link.speed.current: Current usable bandwidth for the PCI link in bytes per second
  • gpu.pci.link.speed.max: Max usable bandwidth for the PCI link in bytes per second

• Add a new ReportIssue method to the Python bridge to report issues to Agent Health Platform

• APM: The trace-agent can now receive span tag equivalence and peer tag mapping updates over Remote Configuration and apply them at runtime, without an agent restart. The feature is opt-in via the new remote_configuration.apm_semantics.enabled setting (default false). Stats aggregation picks up the updated peer-tag keys on the next span processed. If the backend removes or untargets a previously-applied payload, the trace-agent reverts to the mappings it ships with. Existing deployments see no behavior change with default settings.

• APM: remote_configuration.agent_config.enabled is now a settable configuration entry that controls the trace-agent's Remote Configuration subscription for agent-config updates (such as runtime log-level overrides) independently from remote_configuration.apm_sampling.enabled. When the user has explicitly set apm_sampling.enabled but not agent_config.enabled, the trace-agent mirrors the former into the latter so existing configurations continue to behave exactly as before.

• On Linux, when the DDOT extension is installed with the Datadog Agent, DDOT is now managed by dd-procmgrd through processes.d/datadog-agent-ddot.yaml instead of relying on the legacy datadog-agent-ddot systemd unit. Uninstalling the extension removes that config file. To roll back to the legacy behavior manually, remove processes.d/datadog-agent-ddot.yaml and restart datadog-agent.

• Add Go stack trace aggregation to the auto multi-line log pipeline. When auto multi-line aggregation is enabled (logs_config.auto_multi_line_detection), multi-line Go crash dumps (panic:, fatal error:, runtime: errors, signal crashes, and unexpected faults) are automatically detected and combined into a single log entry using a streaming state-machine parser.

• gpu: all gpu.nvlink.* metrics now have a nvlink_port tag and are emitted per-port. We provide GPU-level alternatives for certain metrics such as gpu.nvlink.throughput.data.rx/tx.total

• Enable instrumentation_crd_controller.enabled and a new autodiscovery provider will schedule checks derived from DatadogInstrumentation custom resources deployed in the Kubernetes cluster.

• Parses and collects kubernetes.pod.cpu.requests, kubernetes.pod.memory.requests, kubernetes.pod.cpu.limits, and kubernetes.pod.memory.limits.

• Process Autodiscovery is now enabled by default on Linux through the process autoconfig feature. It can be disabled with DD_AUTOCONFIG_EXCLUDE_FEATURES=process.

• Register process_manager.enabled in the Agent configuration schema (pkg/config/schema/core_schema.yaml), set its default in pkg/config/setup, and document it in config_template.yaml. On Windows, this option controls whether the core Agent starts dd-procmgr-service. On Linux, dd-procmgrd is started by systemd; this setting is ignored there.

Enhancement Notes

• Use compensated floating point summation to accurately calculate the sum and average aggregates of histograms for inputs where magnitudes significantly vary.

• Scale .sum, .avg, and .count aggregates by the exact 1/SampleRate to avoid undercount of these aggregates for sample rates whose reciprocal is not an integer (e.g. @0.21).

• The macOS battery check now adds a power_state:battery_critical tag to the system.battery.power_state metric when the operating system reports a degraded battery.

• Update the SNMP traps database with new MIB additions, including PANZURA-TRAP-MIB.

• Updated the ntp check to support the default location of systemd-timesyncd (/etc/systemd/timesyncd.conf). The check now parses NTP= and FallbackNTP= keys in addition to the existing chrony/ntp.conf server/pool/peer directives.

• On startup the Datadog Agent will now validate its configuration against the schema and report any violations through the Agent Health pipeline.

• APM stats now mask additional metric tag values that exceed the value length or per-bucket cardinality limits.

• APM : The enable_otlp_container_tags_v2 behavior is now enabled by default. Container tags on OTLP traces are now extracted using the infraattributes processor instead of calling the tagger directly, reducing redundant work and outgoing traffic. To opt out, set disable_otlp_container_tags_v2 in apm_config.features.

• Agents are now built with Go 1.26.4.

• CWS: Add support for monitoring the socket system call, enabling detection rules based on socket creation events (domain, type, protocol).

• The comp/dataobs/queryactions component now supports an optional schedule field on Data Observability monitor queries. The field accepts a standard 5-field cron expression (e.g. "20 * * * *" for 20 minutes past every hour) and enables wall-clock-aligned scheduling in place of the fixed interval_seconds cadence. When both schedule and interval_seconds are set on the same query, schedule takes precedence and interval_seconds is ignored. At least one of the two fields must be set; the agent rejects Remote Configuration payloads containing queries where neither field is provided or where the cron expression is syntactically invalid.

• Expanded the functionality of the experimental fentry-based network connection tracer. This tracer remains experimental and disabled by default.

• gpu: add new PCI link width metrics gpu.pci.link.width.{current,max} and add degraded PCI link metrics gpu.pci.link.{width,speed}.degraded.

• gpu: add gpu.nvlink.errors.fec.{none,light,heavy} metrics to easily group error thresholds

• The in-place vertical autoscaler throttles disruptive resizes to at most 15% of a workload's replicas per reconcile, configurable via autoscaling.workload.in_place_vertical_scaling.disruption_tolerance_percent.

• use the /healthz route to check and validate kubelet connection, instead of the deprecated /spec route.

• The agent automatically detects Kueue-related labels in pods and adds them as kueue_local_queue and kueue_cluster_queue tags.

• Network Config Management: Adds support for Cisco ASA firewalls by adding a new profile for these. Previously, Cisco ASA was not supported and would be unmonitored by the NCM integration.

• Extended the ntp check's systemd-timesyncd discovery to also read drop-in files under /etc/systemd/timesyncd.conf.d/, /run/systemd/timesyncd.conf.d/, /usr/local/lib/systemd/timesyncd.conf.d/, and /usr/lib/systemd/timesyncd.conf.d/. This covers hosts where NTP= is set by cloud-init or another tool that writes a drop-in instead ...

7.80.4

Agent

Prelude

Released on: 2026-07-01

• Please refer to the 7.80.4 tag on integrations-core for the list of changes on the Core Checks

Bug Fixes

• Add more traces during SSI installation on Linux host

Datadog Cluster Agent

Prelude

Released on: 2026-07-01 Pinned to datadog-agent v7.80.4: CHANGELOG.

7.80.3

Agent

Prelude

Released on: 2026-06-24

• Please refer to the 7.80.3 tag on integrations-core for the list of changes on the Core Checks

Enhancement Notes

• Agents are now built with Go 1.25.11.

Bug Fixes

• Workload autoscaling: fixed a bug where, when running the Cluster Agent in high-availability mode (multiple replicas), the burstable mode of a DatadogPodAutoscaler could leave the CPU limit in place on a random subset of pods. The CPU-limit removal is now re-derived from the autoscaler spec in the admission controller, so every replica applies it consistently regardless of which one handles the admission request.
• Fix Private Action Runner self-enrollment failing silently on hosts with no direct internet access when a proxy is configured in datadog.yaml. Enrollment requests now respect the agent proxy settings (proxy.https, proxy.http, and no_proxy).
• Disable v3beta metrics intake shadow payloads when zlib compression is used.

Datadog Cluster Agent

Prelude

Released on: 2026-06-24 Pinned to datadog-agent v7.80.3: CHANGELOG.

7.80.2

Agent

Prelude

Released on: 2026-06-17

• Please refer to the 7.80.2 tag on integrations-core for the list of changes on the Core Checks

Enhancement Notes

• Compliance: CIS Docker rules (scope: docker) are no longer evaluated on Kubernetes nodes where the kubelet's CRI runtime is not Docker (e.g. containerd, CRI-O), avoiding false positives on GKE Container-Optimized OS which ships dockerd alongside containerd. The runtime is read from the kubelet's --container-runtime-endpoint flag or the containerRuntimeEndpoint field of its --config YAML; if it cannot be determined the rules continue to evaluate.

Security Notes

• Fixed a confused-deputy vulnerability in the Cluster Agent's AppSec ingress-nginx admission mutator where the pod's --configmap=<namespace>/<name> argument was trusted verbatim, allowing a user with pod-create permission in one namespace to make the Cluster Agent service account create or update ConfigMaps and add labels and annotations in arbitrary namespaces. The mutator now requires the <namespace> portion to match the pod's own namespace (or use the $(POD_NAMESPACE) downward-API substitution) and skips mutation otherwise, emitting a warning event on the pod. The vulnerability affected Cluster Agent releases starting from 7.78.0.

Bug Fixes

• Fix an issue where container log collection could stop for an individual container without recovering and without any error in the Agent logs. When a container's log stream was idle longer than logs_config.docker_client_read_timeout, the read timeout could cause the underlying Docker connection to close in a way that the tailer treated as a permanent shutdown, silently stopping log collection for that container until it was recreated or the Agent was restarted. The tailer now reconnects in this case, and only stops when the Agent is intentionally shutting down. Low-volume containers (for example, services that log only periodically) were the most affected.
• OTel Agent: Disable v3 series API shadow sampling, which is incompatible with the zlib compression the OTel Agent forces for the metrics intake.

Datadog Cluster Agent

Prelude

Released on: 2026-06-17 Pinned to datadog-agent v7.80.2: CHANGELOG.

Bug Fixes

• Fixed an issue where the admission controller connectivity probe webhook did not include the AKS selector requirements when admission_controller.add_aks_selectors was enabled, which could cause repeated webhook reconciliation conflicts on AKS.

7.80.1

Agent

Prelude

Released on: 2026-06-12

• Please refer to the 7.80.1 tag on integrations-core for the list of changes on the Core Checks

Enhancement Notes

• The Agent's embedded Python has been upgraded from 3.13.13 to 3.13.14

Datadog Cluster Agent

Prelude

Released on: 2026-06-12 Pinned to datadog-agent v7.80.1: CHANGELOG.

7.80.0

Agent

Prelude

Released on: 2026-06-11

• Please refer to the 7.80.0 tag on integrations-core for the list of changes on the Core Checks

Upgrade Notes

• Health Platform: the ReportIssue method now takes a single IssueReport argument instead of (checkID, checkName string, report *IssueReport). The IssueReport struct carries three new fields — IssueID (unique instance id), IssueType (template id), and Source (reporting integration name) — replacing the separate checkID and checkName arguments.

  The health platform persistence file format has been bumped to version 2. Existing persistence files (<run_path>/health-platform/issues.json) written by a previous agent version will be detected, logged as incompatible, and discarded on startup; the agent starts with a fresh issue state. No data migration is performed.

  For integrations calling ReportIssue: construct an IssueReport with IssueID set to a unique instance key (e.g. "check-execution-failure:<check-id>"), IssueType set to the template identifier that was previously passed as the IssueId field of the proto IssueReport, and Source set to the integration name. To resolve an issue, call ResolveIssue(issueID) instead of passing nil to ReportIssue.

• Health Platform: the health_platform.issues_detected telemetry counter is now tagged with issue_type instead of health_check_id. Update any dashboards, monitors, or telemetry configuration that filtered or grouped by the health_check_id tag to use issue_type instead.

• APM: On Linux, the trace agent process now only starts once data is sent to any of its configured listeners.

  Previously, the trace agent started immediately on agent startup, it now starts lazily when needed, which reduces resource usage. To disable and restore the previous behavior, set apm_config.socket_activation.enabled: false in datadog.yaml, or set the environment variable DD_APM_SOCKET_ACTIVATION_ENABLED=false.

New Features

• The Windows MSI installer now includes the AI Usage Chrome Native Messaging Host, which is intended to work with a companion Chrome extension to power EUDM AI usage features. The host is currently dormant because the Chrome extension is not yet enabled, so no AI usage host process runs on the system.

• Adds a new discovery.service_map.enabled system-probe configuration option that boots the universal service monitoring (USM) eBPF monitor in a restricted mode, capturing only the data needed to render a service dependency map (HTTP and HTTPS via TLS uprobes). Hosts running in this mode are not billed as USM customers, are not surfaced in USM dashboards, and do not produce universal.http.* metrics. Intended for non-APM customers as a free preview of application observability.

• Add k8sobjectsreceiver to the DDOT (Datadog Distribution of OpenTelemetry Collector) default manifest, enabling collection of Kubernetes object events and resource states via the OpenTelemetry Collector pipeline.

• Adds a new action get-resource in kubeactions.

• The fleet installer's agent-package OCI index now contains a FIPS-flavored sibling manifest for each platform, distinguished by the OCI Platform.Variant field. When DD_FIPS_MODE=true is set, the installer downloads the FIPS manifest; otherwise it downloads the base manifest. The package URL is unchanged in both cases.

• Add a new nccl core check that collects per-rank NCCL collective communication metrics from GPU training and inference workloads.

  The check listens on a Unix domain socket (default /var/run/datadog/nccl.socket) for JSON events emitted by the NCCL profiler plugin (libnccl-profiler-dd.so) running inside GPU pods. Each event is tagged with rank, collective, n_ranks, kube_pod_name, kube_namespace, and kube_container_name.

  Metrics emitted:

  • nccl.collective.exec_time_us — time a rank spends inside a collective operation. A rank with a significantly lower value than its peers is the straggler; ranks with higher values are waiting at the barrier.
  • nccl.collective.algo_bandwidth_gbps — algorithm bandwidth of the collective.
  • nccl.collective.bus_bandwidth_gbps — bus bandwidth normalised for the collective type.
  • nccl.collective.msg_size_bytes — tensor size being communicated.
  • nccl.rank.seconds_since_last_event — seconds since this rank last reported an event; non-zero values indicate a potential hang.

  Enable the check cluster-wide by setting gpu.nccl.enabled: true in the Agent configuration (or DD_GPU_NCCL_ENABLED=true). The socket path can be overridden via gpu.nccl.socket_path; the host directory mounted into training pods can be overridden via gpu.nccl.host_socket_path.

• Add support for the datadog.metric.as_type datapoint attribute on OTLP delta sum metrics. When this attribute is set to "rate", the metric is sent to Datadog as a Rate (value divided by interval) instead of a Count. Accepted values are "rate", "count", and "gauge"; unknown values are logged and ignored. This allows users migrating from DogStatsD to OpenTelemetry to preserve rate-type metric behavior.

• Add multi_secret_backends in datadog.yaml so you can declare extra named secret backends (each with type and config). When no secret_backend_type is set, select the backend per handle using ENC[backendID;secretKey] (backendID matches a name under multi_secret_backends). Precedence is secret_backend_command (if set) over secret_backend_type over multi_secret_backends: a custom command wins over native type; when native secret_backend_type is set (and no custom command), every ENC[...] inner string is resolved only through that type and multi_secret_backends is not used for routing.

• Add admission_controller.auto_instrumentation.container_registry_allow_list configuration option (env var DD_ADMISSION_CONTROLLER_AUTO_INSTRUMENTATION_CONTAINER_REGISTRY_ALLOW_LIST) to restrict which container registries can be used as sources for APM library injection via Single Step Instrumentation. When set to a non-empty comma-separated list, the admission controller will skip injection for any pod whose injector image registry is not in the list, and will set the internal.apm.datadoghq.com/injection-error annotation with the reason. An empty list (the default) allows injection from any registry.

• Windows: windows_certificate check adds certificate_store_regex, a list of Go regular expressions matched against HKLM certificate store names. Patterns are matched case-insensitively. certificate_store and certificate_store_regex can be used together; at least one must be set.

Enhancement Notes

• Process kubernetes actions asynchronously to avoid blocking the main thread.

• Add an example OpenMetrics check configuration for Agent Data Plane deployments to restore datadog.agent.dogstatsd.* and datadog.agent.forwarder.transactions.* metrics.

• Pre-register datadog-apm-library-iis, datadog-apm-library-iis-rum, and datadog-apm-library-httpd in the fleet installer. The packages are gated behind remote updates so they can be rolled out via remote configuration without a new installer release.

• Chunk remote workloadmeta messages in the Agent to avoid exceeding the gRPC max message size.

• APM : The Trace Agent agent status output now shows the UDS (Unix Domain Socket) receiver path when UDS is enabled, in addition to the existing TCP receiver address. Each per-client entry in the receiver stats section also displays the connection type (tcp, uds, or pipe), making it easier to distinguish traffic arriving via different transports.

• Autodiscovery template resolution failures are now logged at ERROR level instead of DEBUG, making them visible without enabling debug logging. Additionally, when the health platform is enabled, these failures are reported as AD misconfiguration health events with actionable remediation steps, providing proactive visibility when an autodiscovered check config is silently skipped due to unsupported template variables.

• When infrastructure_mode is basic, the Agent's default allowlist now includes the Directory, WMI Check, Windows Certificate, Windows Performance Counters, and Windows Registry integrations so they can run without extra integration.additional configuration on Windows-oriented deployments.

• Agents are now built with Go 1.25.10.

• On Windows, network connections collected by Cloud Network Monitoring are now tagged with interface_name and interface_type.

• The Agent now streams Kubernetes metadata from the Cluster Agent by default, instead of polling for it periodically. This propagates tags derived from Kubernetes metadata (like kube_service) with less delay. This behavior is controlled by the kubernetes_metadata_streaming setting.

• agent diagnose now renders the check name as a prefix for all checks under the check-datadog suite. The JSON output gains a check_name field for the same purpose.

• The --include and --exclude flags of agent diagnose now match against the suite name, the owning check name, and the diagnosis category. For example, agent diagnose --include postgres now filters individual diagnoses across all suites instead of only matching suite names.

• DogStatsD timing metrics (t type) now include an explicit unit value (millisecond) in the metric payload sent to Datadog, allowing the Datadog UI to display the correct unit automatically.

• Dynamic Instrumentation now supports compound conditions using &&, ||, and !.

• When infrastructure_mode is set to none, ECS task metadata collection is now disabled by default (see ecs_task_collection_enabled). Set DD_ECS_TASK_COLLECTION_ENABLED to true to ove...