How datadog/datadog-agent works
Datadog Agent is a host and cluster observability and security product: it collects signals, processes them through specialized agent components, and forwards telemetry to Datadog. A typical workflow begins with host, workload, or application activity; collectors and probes produce metrics, logs, traces, process data, or security events; processing and forwarding components deliver those signals to intake. The tree also shows Kubernetes/cluster coordination, OpenTelemetry support, profiling, and serverless lifecycle features. Several paths are inferred from component names and repository structure; only the log-pipeline and security-rule relationships have direct support in sampled source.
Main entry points: pipelines_dbm.go Telemetry forwarder · pipeline.go Log pipeline · run/command.go Agent runtime · integrations/command.go Integrations
Components 19
Collection
- Integrations
cmd/agent/subcommands/integrations/command.go - System probe
cmd/system-probe/modules/modules.go - Process agent
cmd/process-agent/command/main.go - Trace agent
cmd/trace-agent/subcommands/run/command.go - Host profiler
cmd/host-profiler/subcommands/run/command.go
Processing
- Log pipeline
comp/logs-library/pipeline/pipeline.go - Log monitoring
comp/logs-library/metrics/pipeline_monitor.go - Metrics aggregation
comp/aggregator/demultiplexer/impl/demultiplexer.go - Security rules
pkg/security/rules/engine.go
Agent Services
- Agent runtime
cmd/agent/subcommands/run/command.go - Cluster agent
cmd/cluster-agent/subcommands/start/command.go - OpenTelemetry agent
cmd/otel-agent/subcommands/run/command.go - Serverless init
cmd/serverless-init/main.go
Delivery
- Telemetry forwarder
comp/forwarder/eventplatform/impl/pipelines_dbm.go - Trace intake proxy
pkg/trace/api/pipeline_stats.go
Other components
- Host and workloads
- Datadog intake
- Kubernetes API
- Applications
Connections 23
- Host and workloads → Agent runtime: provides telemetry
- Applications → Trace agent: sends traces
- Host and workloads → Integrations: provides service data
- Host and workloads → System probe: provides system events
- Host and workloads → Process agent: provides process data
- Host and workloads → Host profiler: provides profiling data
- Agent runtime → Integrations: runs checks
- Integrations → Metrics aggregation: submits metrics
- Agent runtime → Log pipeline: starts pipeline
- Log pipeline → Log monitoring: reports utilization
- Log pipeline → Telemetry forwarder: sends logs
- System probe → Security rules: registers events
- Security rules → Datadog intake: sends events
- Metrics aggregation → Telemetry forwarder: sends telemetry
- Process agent → Telemetry forwarder: sends process data
- Trace agent → Trace intake proxy: serves pipeline stats
- Trace intake proxy → Datadog intake: proxies requests
- Telemetry forwarder → Datadog intake: forwards telemetry
- Kubernetes API → Cluster agent: supplies cluster data
- Cluster agent → Datadog intake: sends cluster telemetry
- OpenTelemetry agent → Telemetry forwarder: forwards telemetry
- Serverless init → Applications: manages lifecycle
- Host profiler → Telemetry forwarder: uploads profiles