Glossary

Project-specific terms you will encounter throughout the codebase. Generic Go and observability terms are not repeated here.

Binaries and processes

• Agent / core Agent — the main agent binary built from cmd/agent/. Hosts the check runtime, DogStatsD server (when colocated), and the Agent IPC API.
• Cluster Agent — cmd/cluster-agent/. Kubernetes-aware companion that handles cluster-level metrics, the External Metrics Provider, the admission controller, and cluster check dispatching.
• Cluster Checks Runner (CLC) — a stripped-down core Agent (cmd/agent/subcommands/run/internal/clcrunnerapi/) that runs checks dispatched by the Cluster Agent.
• DogStatsD — cmd/dogstatsd/. StatsD-compatible server for custom application metrics.
• Trace Agent — cmd/trace-agent/ + pkg/trace/. Receives, samples, and forwards APM traces.
• System Probe — cmd/system-probe/. Privileged process that runs eBPF programs and exposes their data over a UNIX socket.
• Security Agent — cmd/security-agent/. Drives Cloud Workload Security (CWS) and Cloud Security Posture Management (CSPM).
• Process Agent — cmd/process-agent/. Collects process and container metadata.
• Installer — cmd/installer/. Manages remote-controlled Agent deployment lifecycle.
• OTel Agent — cmd/otel-agent/. An OpenTelemetry Collector flavor with the Datadog exporter built in.
• Serverless init — cmd/serverless-init/. The Agent flavor used in AWS Lambda extensions, Google Cloud Run, and similar serverless runtimes.
• IoT Agent — a slim core Agent build with most subsystems disabled, see tasks/agent.py and the iot build tag.

Internal subsystems

• Aggregator — pkg/aggregator/. Receives MetricSamples from DogStatsD and checks, aggregates them through a TimeSampler or CheckSampler, and emits Series and Sketches to the serializer.
• Demultiplexer — pkg/aggregator/demultiplexer*.go. Routes metric samples between aggregator instances. Multiple flavors (agent, serverless, mock).
• Sender — pkg/aggregator/sender/. The check-facing API for emitting metrics, events, and service checks.
• Serializer — pkg/serializer/. Encodes payloads for the intake (JSON, MessagePack, protobuf).
• Forwarder — comp/forwarder/defaultforwarder/. HTTP client with retry, backoff, and disk-buffered queues. Sends serialized payloads to the intake.
• Collector — pkg/collector/. Schedules and runs checks (Python via rtloader, Go core checks, JMX bridge).
• Autodiscovery (AD) — comp/core/autodiscovery/. Watches for containers, pods, and other targets, and dynamically configures checks based on labels, annotations, and templates.
• Workloadmeta — comp/core/workloadmeta/. Local source-of-truth store of containers, pods, ECS tasks, and process metadata. Other components subscribe to its event stream.
• Tagger — comp/core/tagger/. Resolves tags for a given entity (container, pod, host) by combining sources from workloadmeta, kubelet, ECS, etc.
• Remote Config (RC) — pkg/remoteconfig/ + comp/remote-config/. Pulls dynamic configuration overrides from the Datadog backend at runtime.
• Flare — comp/core/flare/. Bundles logs, configs, and runtime state into an archive for support escalations.
• Expvar / status / health probe — comp/core/status/, comp/core/healthprobe/. Internal observability surfaces.
• rtloader — rtloader/. C++ runtime that embeds CPython 2 (legacy) or CPython 3 inside the Agent process so Python checks can run.

Concepts

• Component / bundle — a unit in the Fx-based component framework under comp/. A bundle is a group of related components (e.g., comp/core bundles config, log, secrets, tagger, etc.). See Components framework.
• Build tag — a Go build tag like kubeapiserver, containerd, python, linux_bpf. The set of tags is computed by tasks/build_tags.py per binary and per platform.
• Check — a unit of metric collection. Implemented as a Python class (pkg/collector/python/) or a Go core check (pkg/collector/corechecks/). Checks are scheduled by the collector.
• Core check — a check written in Go and compiled into the Agent (pkg/collector/corechecks/). Contrast with Python check (loaded at runtime).
• JMX check — a check that uses the jmxfetch Java subprocess to query JMX MBeans. See pkg/jmxfetch/.
• AD template / annotation — a configuration template attached to a container/pod via Kubernetes annotations or Docker labels. Consumed by autodiscovery.
• MetricSample — a single observation emitted by DogStatsD or a check, before aggregation. See pkg/metrics/metric_sample.go.
• Series — a flushed metric: type, name, tags, host, points (timestamp + value). See pkg/metrics/series.go.
• Sketch — a DDSketch-compressed distribution sample, used for histograms and timings. See pkg/metrics/sketch_series.go.
• Service check — a binary (OK / WARNING / CRITICAL / UNKNOWN) health signal.
• Event — a structured event payload, e.g. Container started. Distinct from CWS events.
• Flare — a support archive built by the flare command and component.

APM-specific

• Tracer — the language-specific SDK that produces spans. Lives outside this repo (e.g., dd-trace-go, dd-trace-py).
• Span / trace — standard APM concepts. Trace = collection of spans for one request.
• Priority sampler / errors sampler / rare sampler / probabilistic sampler — independent sampling strategies in pkg/trace/sampler/. A trace is kept if any of them keeps it.
• Concentrator — pkg/trace/stats/. Computes RED stats (request count, error count, duration distributions) over all received spans, regardless of sampling.
• Client stats — RED stats computed inside the tracer SDK and shipped directly, bypassing the concentrator.
• APM event / Trace Search event — a single span flagged for retention by the (deprecated) event/ extractor.

System Probe / network / security

• eBPF — Linux kernel-level programs. Sources under pkg/ebpf/c/ and per-feature */ebpf/. Built via Bazel macros in bazel/rules/ebpf/.
• USM — Universal Service Monitoring. Decodes application protocols (HTTP, HTTP/2, gRPC, Kafka, …) inside the kernel via eBPF. See pkg/network/usm/.
• NPM — Network Performance Monitoring. Tracks TCP/UDP flows, DNS, conntrack. See pkg/network/tracer/.
• CWS — Cloud Workload Security. Runtime threat detection using eBPF + Linux Security Modules. Implemented in pkg/security/.
• CSPM — Cloud Security Posture Management. Compliance benchmarks. See pkg/compliance/.
• SECL — Security Expression Language. The DSL used to write CWS rules. Parser and evaluator in pkg/security/secl/.
• Runtime compilation — compiling eBPF programs at Agent startup against the running kernel's BTF. See pkg/ebpf/bytecode/runtime/ and the runtime_compilation_bundle Bazel macro.
• Co-RE — Compile Once, Run Everywhere. The alternative to runtime compilation for portable eBPF.
• dyninst — Dynamic instrumentation system in pkg/dyninst/. Newer area used for live debugger functionality.

Infrastructure / build

• dda — the developer CLI (pip install dda or brew install --cask dda) that wraps Invoke tasks. Always prefer dda inv … over raw inv … or go ….
• Invoke task — a Python function in tasks/*.py exposed via the Invoke framework. Run with dda inv <module>.<task>.
• Bazel — the new build system. eBPF compilation, cgo_godefs, and an increasing number of Go packages build via Bazel.
• Omnibus — the legacy Ruby-based build system that produces deb/rpm/MSI packages. Located in omnibus/. Being phased out in favor of packages/ + Bazel.
• Fakeintake — test/fakeintake/. A mock Datadog intake for E2E tests.
• Pulumi / e2e-framework — the Pulumi-based provisioner that spins up cloud infrastructure for E2E tests. Located in test/e2e-framework/.
• kmt — Kernel Matrix Testing (tasks/kmt.py, tasks/kernel_matrix_testing/). Runs eBPF tests across many kernel versions in VMs.

Datadog-internal acronyms

• DD_ — environment variable prefix for all Agent configuration overrides (e.g., DD_API_KEY, DD_LOGS_ENABLED).
• MRF — Multi-Region Failover. A high-availability setup with parallel intakes; visible in flags like additional_endpoints and mrf.
• HA agent — High-Availability Agent. See comp/haagent/.
• DCA — short for Datadog Cluster Agent.
• dddev — Datadog's internal development organization. The default destination of fakeintake forwards.