Datadog
Architecture & the Agent
Understand how Datadog collects metrics, traces, and logs through a single host Agent and a SaaS backend.
Datadog is a SaaS observability platform that unifies metrics, traces, logs, and more behind one query layer and one set of dashboards. The data plane begins with the Datadog Agent — a lightweight process installed on each host, container node, or as a sidecar — that collects system metrics, runs hundreds of integration checks, tails logs, and receives application traces.
A building with a smart meter in every room reporting to one utility dashboard. You do not store the readings yourself — the utility keeps the history and lets you slice usage by room, floor, or hour.
Key Concepts
1
The Agent forwards everything over TLS to Datadog's backend, where data is indexed and made queryable within seconds. Because Datadog is fully hosted, you never run the storage or query tier yourself: you trade per-host, per-GB, and per-million-events pricing for zero operational burden. The platform's signature feature is correlation — a single tag set (service, env, version) lets you pivot from a metric spike to the traces behind it to the logs of the exact request.
2
What the interviewer is probing.
What the interviewer is probing.
3
1. "What does the Datadog agent actually do?" *Probing:* the mechanism. *Stalls:* "It sends
data." *Moves up:* collects metrics, traces and logs on the host, aggregates and tags them, then
ships to the backend over an outbound connection.
1. "What does the Datadog agent actually do?"
4
2. "Why do tags matter so much here?" *Probing:* the central idea. *Stalls:* "Organisation."
*Moves up:* everything is sliced by tag, so a missing or inconsistent tag means you cannot group by
service or environment later.
2. "Why do tags matter so much here?"
5
3. "What is the cardinality warning?" *Probing:* the cost trap. *Stalls:* "None." *Moves up:* a
tag with unbounded values — user id, request id — multiplies custom metrics, and custom metrics are
what the bill is made of.
3. "What is the cardinality warning?"
6
4. "How does the agent reach the backend from a private subnet?" *Probing:* the practical
detail. *Stalls:* "A public IP." *Moves up:* outbound only over HTTPS, optionally through a proxy or
private link — nothing inbound is needed.
4. "How does the agent reach the backend from a private subnet?"