# datadog/datadog-agent architecture

> Architecture diagram of the GitHub repository datadog/datadog-agent, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/datadog/datadog-agent
- Repository: https://github.com/datadog/datadog-agent

## Overview

Datadog Agent is a host and cluster observability and security product: it collects signals, processes them through specialized agent components, and forwards telemetry to Datadog. A typical workflow begins with host, workload, or application activity; collectors and probes produce metrics, logs, traces, process data, or security events; processing and forwarding components deliver those signals to intake. The tree also shows Kubernetes/cluster coordination, OpenTelemetry support, profiling, and serverless lifecycle features. Several paths are inferred from component names and repository structure; only the log-pipeline and security-rule relationships have direct support in sampled source.

Main entry points: [`comp/forwarder/eventplatform/impl/pipelines_dbm.go`](https://github.com/datadog/datadog-agent/blob/main/comp/forwarder/eventplatform/impl/pipelines_dbm.go) (Telemetry forwarder), [`comp/logs-library/pipeline/pipeline.go`](https://github.com/datadog/datadog-agent/blob/main/comp/logs-library/pipeline/pipeline.go) (Log pipeline), [`cmd/agent/subcommands/run/command.go`](https://github.com/datadog/datadog-agent/blob/main/cmd/agent/subcommands/run/command.go) (Agent runtime), [`cmd/agent/subcommands/integrations/command.go`](https://github.com/datadog/datadog-agent/blob/main/cmd/agent/subcommands/integrations/command.go) (Integrations)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_collection["Collection"]
  node_integrations["Integrations<br/>[command.go]"]
  node_system_probe["System probe<br/>[modules.go]"]
  node_process_agent["Process agent<br/>[main.go]"]
  node_trace_agent["Trace agent<br/>[command.go]"]
  node_host_profiler["Host profiler<br/>[command.go]"]
end

subgraph group_processing["Processing"]
  node_logs_pipeline["Log pipeline<br/>[pipeline.go]"]
  node_log_monitor["Log monitoring"]
  node_metrics_aggregator["Metrics aggregation<br/>[demultiplexer.go]"]
  node_security_rules["Security rules<br/>[engine.go]"]
end

subgraph group_agents["Agent Services"]
  node_agent_run["Agent runtime<br/>[command.go]"]
  node_cluster_agent["Cluster agent<br/>[command.go]"]
  node_otel_agent["OpenTelemetry agent<br/>[command.go]"]
  node_serverless_init["Serverless init<br/>[main.go]"]
end

subgraph group_delivery["Delivery"]
  node_forwarder["Telemetry forwarder<br/>[pipelines_dbm.go]"]
  node_trace_proxy["Trace intake proxy<br/>[pipeline_stats.go]"]
end

subgraph group_platform["Platform Features"]
end

node_host(("Host and workloads"))
node_datadog{{"Datadog intake"}}
node_kubernetes{{"Kubernetes API"}}
node_applications(("Applications"))

node_host -->|"provides telemetry"| node_agent_run
node_applications -->|"sends traces"| node_trace_agent
node_host -->|"provides service data"| node_integrations
node_host -->|"provides system events"| node_system_probe
node_host -->|"provides process data"| node_process_agent
node_host -->|"provides profiling data"| node_host_profiler
node_agent_run -->|"runs checks"| node_integrations
node_integrations -->|"submits metrics"| node_metrics_aggregator
node_agent_run -->|"starts pipeline"| node_logs_pipeline
node_logs_pipeline -->|"reports utilization"| node_log_monitor
node_logs_pipeline -->|"sends logs"| node_forwarder
node_system_probe -->|"registers events"| node_security_rules
node_security_rules -->|"sends events"| node_datadog
node_metrics_aggregator -->|"sends telemetry"| node_forwarder
node_process_agent -->|"sends process data"| node_forwarder
node_trace_agent -->|"serves pipeline stats"| node_trace_proxy
node_trace_proxy -->|"proxies requests"| node_datadog
node_forwarder -->|"forwards telemetry"| node_datadog
node_kubernetes -->|"supplies cluster data"| node_cluster_agent
node_cluster_agent -->|"sends cluster telemetry"| node_datadog
node_otel_agent -->|"forwards telemetry"| node_forwarder
node_serverless_init -->|"manages lifecycle"| node_applications
node_host_profiler -->|"uploads profiles"| node_forwarder

click node_agent_run "https://github.com/datadog/datadog-agent/blob/main/cmd/agent/subcommands/run/command.go"
click node_integrations "https://github.com/datadog/datadog-agent/blob/main/cmd/agent/subcommands/integrations/command.go"
click node_system_probe "https://github.com/datadog/datadog-agent/blob/main/cmd/system-probe/modules/modules.go"
click node_process_agent "https://github.com/datadog/datadog-agent/blob/main/cmd/process-agent/command/main.go"
click node_trace_agent "https://github.com/datadog/datadog-agent/blob/main/cmd/trace-agent/subcommands/run/command.go"
click node_logs_pipeline "https://github.com/datadog/datadog-agent/blob/main/comp/logs-library/pipeline/pipeline.go"
click node_log_monitor "https://github.com/datadog/datadog-agent/blob/main/comp/logs-library/metrics/pipeline_monitor.go"
click node_metrics_aggregator "https://github.com/datadog/datadog-agent/blob/main/comp/aggregator/demultiplexer/impl/demultiplexer.go"
click node_security_rules "https://github.com/datadog/datadog-agent/blob/main/pkg/security/rules/engine.go"
click node_cluster_agent "https://github.com/datadog/datadog-agent/blob/main/cmd/cluster-agent/subcommands/start/command.go"
click node_otel_agent "https://github.com/datadog/datadog-agent/blob/main/cmd/otel-agent/subcommands/run/command.go"
click node_serverless_init "https://github.com/datadog/datadog-agent/blob/main/cmd/serverless-init/main.go"
click node_host_profiler "https://github.com/datadog/datadog-agent/blob/main/cmd/host-profiler/subcommands/run/command.go"
click node_forwarder "https://github.com/datadog/datadog-agent/blob/main/comp/forwarder/eventplatform/impl/pipelines_dbm.go"
click node_trace_proxy "https://github.com/datadog/datadog-agent/blob/main/pkg/trace/api/pipeline_stats.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_integrations,node_system_probe,node_process_agent,node_trace_agent,node_host_profiler toneBlue
class node_logs_pipeline,node_log_monitor,node_metrics_aggregator,node_security_rules toneAmber
class node_agent_run,node_cluster_agent,node_otel_agent,node_serverless_init,node_kubernetes toneMint
class node_forwarder,node_trace_proxy toneRose
class node_host,node_datadog,node_applications toneIndigo
```

## Components

### Collection

- [Integrations](https://github.com/datadog/datadog-agent/blob/main/cmd/agent/subcommands/integrations/command.go): `cmd/agent/subcommands/integrations/command.go`
- [System probe](https://github.com/datadog/datadog-agent/blob/main/cmd/system-probe/modules/modules.go): `cmd/system-probe/modules/modules.go`
- [Process agent](https://github.com/datadog/datadog-agent/blob/main/cmd/process-agent/command/main.go): `cmd/process-agent/command/main.go`
- [Trace agent](https://github.com/datadog/datadog-agent/blob/main/cmd/trace-agent/subcommands/run/command.go): `cmd/trace-agent/subcommands/run/command.go`
- [Host profiler](https://github.com/datadog/datadog-agent/blob/main/cmd/host-profiler/subcommands/run/command.go): `cmd/host-profiler/subcommands/run/command.go`

### Processing

- [Log pipeline](https://github.com/datadog/datadog-agent/blob/main/comp/logs-library/pipeline/pipeline.go): `comp/logs-library/pipeline/pipeline.go`
- [Log monitoring](https://github.com/datadog/datadog-agent/blob/main/comp/logs-library/metrics/pipeline_monitor.go): `comp/logs-library/metrics/pipeline_monitor.go`
- [Metrics aggregation](https://github.com/datadog/datadog-agent/blob/main/comp/aggregator/demultiplexer/impl/demultiplexer.go): `comp/aggregator/demultiplexer/impl/demultiplexer.go`
- [Security rules](https://github.com/datadog/datadog-agent/blob/main/pkg/security/rules/engine.go): `pkg/security/rules/engine.go`

### Agent Services

- [Agent runtime](https://github.com/datadog/datadog-agent/blob/main/cmd/agent/subcommands/run/command.go): `cmd/agent/subcommands/run/command.go`
- [Cluster agent](https://github.com/datadog/datadog-agent/blob/main/cmd/cluster-agent/subcommands/start/command.go): `cmd/cluster-agent/subcommands/start/command.go`
- [OpenTelemetry agent](https://github.com/datadog/datadog-agent/blob/main/cmd/otel-agent/subcommands/run/command.go): `cmd/otel-agent/subcommands/run/command.go`
- [Serverless init](https://github.com/datadog/datadog-agent/blob/main/cmd/serverless-init/main.go): `cmd/serverless-init/main.go`

### Delivery

- [Telemetry forwarder](https://github.com/datadog/datadog-agent/blob/main/comp/forwarder/eventplatform/impl/pipelines_dbm.go): `comp/forwarder/eventplatform/impl/pipelines_dbm.go`
- [Trace intake proxy](https://github.com/datadog/datadog-agent/blob/main/pkg/trace/api/pipeline_stats.go): `pkg/trace/api/pipeline_stats.go`

### Other components

- **Host and workloads**
- **Datadog intake**
- **Kubernetes API**
- **Applications**

## Connections

- Host and workloads → Agent runtime: provides telemetry
- Applications → Trace agent: sends traces
- Host and workloads → Integrations: provides service data
- Host and workloads → System probe: provides system events
- Host and workloads → Process agent: provides process data
- Host and workloads → Host profiler: provides profiling data
- Agent runtime → Integrations: runs checks
- Integrations → Metrics aggregation: submits metrics
- Agent runtime → Log pipeline: starts pipeline
- Log pipeline → Log monitoring: reports utilization
- Log pipeline → Telemetry forwarder: sends logs
- System probe → Security rules: registers events
- Security rules → Datadog intake: sends events
- Metrics aggregation → Telemetry forwarder: sends telemetry
- Process agent → Telemetry forwarder: sends process data
- Trace agent → Trace intake proxy: serves pipeline stats
- Trace intake proxy → Datadog intake: proxies requests
- Telemetry forwarder → Datadog intake: forwards telemetry
- Kubernetes API → Cluster agent: supplies cluster data
- Cluster agent → Datadog intake: sends cluster telemetry
- OpenTelemetry agent → Telemetry forwarder: forwards telemetry
- Serverless init → Applications: manages lifecycle
- Host profiler → Telemetry forwarder: uploads profiles