Skip to content

[poc] disable adaptive sampling on observer pipeline sources#52054

Draft
CelianR wants to merge 2 commits into
mainfrom
celian/logssource-disable-adaptive-sampling
Draft

[poc] disable adaptive sampling on observer pipeline sources#52054
CelianR wants to merge 2 commits into
mainfrom
celian/logssource-disable-adaptive-sampling

Conversation

@CelianR

@CelianR CelianR commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

What does this PR do?

Stamps ExperimentalAdaptiveSampling.Enabled = false on every source that enters the logssource (anomaly detection) parallel pipeline, preventing the global adaptive sampling flag from silently dropping logs before the observer sees them.

When logs_config.experimental_adaptive_sampling.enabled is true globally, the decoder's resolveAdaptiveSamplerEnabled falls back to that flag for any source with ExperimentalAdaptiveSampling == nil. Sources created by logssource never set this field, so they were inheriting an AdaptiveSampler and dropping noisy log patterns before observer.ObserveLog() — causing the anomaly detection engine to miss anomalies hidden in those suppressed patterns.

The per-source Enabled pointer takes precedence over the global flag in the decoder, so logssource sources always get a NoopSampler while the main agent pipeline continues to sample normally.

Two call sites are covered:

  • source_provider.handleSet — generic workloadmeta container sources
  • adSourceManager.AddSource — all AD-scheduled sources

Motivation

Describe how you validated your changes

Unit tests added in source_provider_test.go and ad_source_manager_test.go asserting that ExperimentalAdaptiveSampling.Enabled == false on every source entering the pipeline. Full package test suite passes (go test -tags test ./comp/anomalydetection/logssource/impl/).

Additional Notes

Made with Cursor

When logs_config.experimental_adaptive_sampling.enabled is true globally,
the decoder falls back to that flag for any source with
ExperimentalAdaptiveSampling == nil. logssource sources never set this
field, so they were silently inheriting the AdaptiveSampler and dropping
logs before the anomaly detection observer could see them.

Stamp Enabled=false on every source that enters the logssource pipeline:
- source_provider.handleSet for generic workloadmeta container sources
- adSourceManager.AddSource for all AD-scheduled sources

The per-source pointer takes precedence over the global flag in
resolveAdaptiveSamplerEnabled, so the decoder always picks NoopSampler
for logssource sources regardless of the global setting. The main agent
pipeline is unaffected.

Co-authored-by: Cursor <cursoragent@cursor.com>
@CelianR CelianR added changelog/no-changelog No changelog entry needed qa/done QA done before merge and regressions are covered by tests labels Jun 10, 2026
@CelianR CelianR self-assigned this Jun 10, 2026
@github-actions

Copy link
Copy Markdown
Contributor

@codex review

@dd-octo-sts dd-octo-sts Bot added the internal Identify a non-fork PR label Jun 10, 2026
@github-actions github-actions Bot added the medium review PR review might take time label Jun 10, 2026
@CelianR CelianR changed the title [logssource] disable adaptive sampling on observer pipeline sources [poc] disable adaptive sampling on observer pipeline sources Jun 10, 2026

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cb95343309

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment on lines +98 to +103
func disableAdaptiveSampling(cfg *logsconfig.LogsConfig) {
disabled := false
if cfg.ExperimentalAdaptiveSampling == nil {
cfg.ExperimentalAdaptiveSampling = &logsconfig.SourceAdaptiveSamplingOptions{}
}
cfg.ExperimentalAdaptiveSampling.Enabled = &disabled

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Apply sampler override to kubelet source

When anomaly_detection.logs.kubelet.enabled is on, registerKubeletJournaldSource adds the kubelet journald LogSource directly to logSources without calling this helper, so with global logs_config.experimental_adaptive_sampling.enabled the kubelet.service logs are still sampled before they reach the observer. This leaves one observer logssource path with the old behavior despite the new unsampled-stream requirement; apply the same override when constructing the kubelet source too.

Useful? React with 👍 / 👎.

@datadog-prod-us1-3

datadog-prod-us1-3 Bot commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

Pipelines

Fix all issues with BitsAI

⚠️ Warnings

🚦 2 Pipeline jobs failed

DataDog/datadog-agent | bazel:run-gazelle   View in Datadog   GitLab

DataDog/datadog-agent | oracle: [21.3.0-xe]   View in Datadog   GitLab

ℹ️ Info

🎯 Code Coverage (details)
Patch Coverage: 100.00%
Overall Coverage: 50.56% (-0.06%)

Useful? React with 👍 / 👎

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: edfcfdd | Docs | Datadog PR Page | Give us feedback!

Tests that when global adaptive sampling is enabled, a source with
ExperimentalAdaptiveSampling.Enabled=false (as stamped by
disableAdaptiveSampling on all logssource sources) passes every message
through, while a source with no override is rate-limited by the
AdaptiveSampler.

Two sub-tests:
- sampling enabled: logssource decoder receives all N messages, main
  agent decoder drops all but the first burst credit
- sampling disabled: both decoders receive all N messages

Co-authored-by: Cursor <cursoragent@cursor.com>
@github-actions

Copy link
Copy Markdown
Contributor

@codex review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: edfcfddee7

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

// global logs_config.experimental_adaptive_sampling.enabled flag. The observer
// pipeline must receive an unsampled stream; dropping logs here would cause the
// anomaly detection engine to miss anomalies hidden in suppressed patterns.
func disableAdaptiveSampling(cfg *logsconfig.LogsConfig) {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Disable sampling for kubelet sources too

In kubelet+systemd builds, registerKubeletJournaldSource creates and adds the kubelet journald source directly (comp/anomalydetection/logssource/impl/kubelet_source.go:20-26) and never calls this helper or sets ExperimentalAdaptiveSampling. When logs_config.experimental_adaptive_sampling.enabled is true, the decoder falls back to that global flag for a nil source option, so the observer pipeline still samples kubelet logs even though this override is intended to make logssource streams unsampled. Please apply the same override when creating the kubelet source as well.

Useful? React with 👍 / 👎.

@dd-octo-sts

dd-octo-sts Bot commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

Files inventory check summary

File checks results against ancestor bcfd3ddc:

Results for datadog-agent_7.81.0~devel.git.581.edfcfdd.pipeline.117902459-1_amd64.deb:

No change detected

@dd-octo-sts

dd-octo-sts Bot commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

Static quality checks

✅ Please find below the results from static quality gates
Comparison made with ancestor bcfd3dd
📊 Static Quality Gates Dashboard
🔗 SQG Job

Successful checks

Info

Quality gate Change Size (prev → curr → max)
agent_deb_amd64 +5.56 KiB (0.00% increase, -0.11% of buffer) 753.307 → 753.312 → 758.200
agent_deb_amd64_fips +5.56 KiB (0.00% increase, -0.72% of buffer) 709.082 → 709.087 → 709.840
agent_heroku_amd64 +4.0 KiB (0.00% increase, -0.12% of buffer) 312.037 → 312.040 → 315.230
agent_rpm_amd64 +5.56 KiB (0.00% increase, -0.11% of buffer) 753.291 → 753.296 → 758.170
agent_rpm_amd64_fips +5.56 KiB (0.00% increase, -0.70% of buffer) 709.066 → 709.071 → 709.840
agent_suse_amd64 +5.56 KiB (0.00% increase, -0.11% of buffer) 753.291 → 753.296 → 758.170
agent_suse_amd64_fips +5.56 KiB (0.00% increase, -0.70% of buffer) 709.066 → 709.071 → 709.840
docker_agent_amd64 +9.02 KiB (0.00% increase, -0.84% of buffer) 812.740 → 812.749 → 813.790
docker_agent_jmx_amd64 +11.43 KiB (0.00% increase, -1.28% of buffer) 1003.681 → 1003.692 → 1004.550
docker_host_profiler_amd64 +6.62 KiB (0.00% increase, -0.05% of buffer) 304.503 → 304.509 → 317.640
22 successful checks with minimal change (< 2 KiB)
Quality gate Current Size
agent_rpm_arm64 728.697 MiB
agent_rpm_arm64_fips 688.212 MiB
agent_suse_arm64 728.697 MiB
agent_suse_arm64_fips 688.212 MiB
docker_agent_arm64 813.171 MiB
docker_agent_jmx_arm64 992.764 MiB
docker_cluster_agent_amd64 209.742 MiB
docker_cluster_agent_arm64 222.847 MiB
docker_cws_instrumentation_amd64 7.447 MiB
docker_cws_instrumentation_arm64 6.877 MiB
docker_dogstatsd_amd64 39.833 MiB
docker_dogstatsd_arm64 37.884 MiB
docker_host_profiler_arm64 315.633 MiB
dogstatsd_deb_amd64 30.490 MiB
dogstatsd_deb_arm64 28.487 MiB
dogstatsd_rpm_amd64 30.490 MiB
dogstatsd_suse_amd64 30.490 MiB
iot_agent_deb_amd64 45.627 MiB
iot_agent_deb_arm64 42.346 MiB
iot_agent_deb_armhf 43.141 MiB
iot_agent_rpm_amd64 45.628 MiB
iot_agent_suse_amd64 45.627 MiB

@cit-pr-commenter-54b7da

Copy link
Copy Markdown

Regression Detector

Regression Detector Results

Metrics dashboard
Target profiles
Run ID: a68a62a0-d71b-49fc-87bd-c2f80de0f039

Baseline: bcfd3dd
Comparison: edfcfdd
Diff

Optimization Goals: ✅ No significant changes detected

Fine details of change detection per experiment

perf experiment goal Δ mean % Δ mean % CI trials links
quality_gate_metrics_logs memory utilization +1.23 [+0.97, +1.48] 1 Logs bounds checks dashboard
quality_gate_idle memory utilization +0.34 [+0.29, +0.39] 1 Logs bounds checks dashboard
quality_gate_idle_all_features memory utilization -0.16 [-0.20, -0.13] 1 Logs bounds checks dashboard
quality_gate_logs % cpu utilization -0.29 [-1.33, +0.76] 1 Logs bounds checks dashboard

Bounds Checks: ✅ Passed

perf experiment bounds_check_name replicates_passed observed_value links
quality_gate_idle intake_connections 10/10 3 ≤ 4 bounds checks dashboard
quality_gate_idle memory_usage 10/10 144.93MiB ≤ 147MiB bounds checks dashboard
quality_gate_idle total_bytes_received 10/10 733.47KiB ≤ 819.20KiB bounds checks dashboard
quality_gate_idle_all_features intake_connections 10/10 3 ≤ 4 bounds checks dashboard
quality_gate_idle_all_features memory_usage 10/10 473.92MiB ≤ 495MiB bounds checks dashboard
quality_gate_idle_all_features total_bytes_received 10/10 1.12MiB ≤ 1.25MiB bounds checks dashboard
quality_gate_logs intake_connections 10/10 4 ≤ 6 bounds checks dashboard
quality_gate_logs memory_usage 10/10 180.78MiB ≤ 195MiB bounds checks dashboard
quality_gate_logs missed_bytes 10/10 0B = 0B bounds checks dashboard
quality_gate_logs total_bytes_received 10/10 264.39MiB ≤ 292MiB bounds checks dashboard
quality_gate_metrics_logs cpu_usage 10/10 345.38 ≤ 2000 bounds checks dashboard
quality_gate_metrics_logs intake_connections 10/10 3 ≤ 6 bounds checks dashboard
quality_gate_metrics_logs memory_usage 10/10 395.03MiB ≤ 430MiB bounds checks dashboard
quality_gate_metrics_logs missed_bytes 10/10 0B = 0B bounds checks dashboard
quality_gate_metrics_logs total_bytes_received 10/10 0.94GiB ≤ 1.04GiB bounds checks dashboard

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

  • ✅ = significantly better comparison variant performance
  • ❌ = significantly worse comparison variant performance
  • ➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

  1. Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.

  2. Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.

  3. Its configuration does not mark it "erratic".

Replicate Execution Details

We run multiple replicates for each experiment/variant. However, we allow replicates to be automatically retried if there are any failures, up to 8 times, at which point the replicate is marked dead and we are unable to run analysis for the entire experiment. We call each of these attempts at running replicates a replicate execution. This section lists all replicate executions that failed due to the target crashing or being oom killed.

Note: In the below tables we bucket failures by experiment, variant, and failure type. For each of these buckets we list out the replicate indexes that failed with an annotation signifying how many times said replicate failed with the given failure mode. In the below example the baseline variant of the experiment named experiment_with_failures had two replicates that failed by oom kills. Replicate 0, which failed 8 executions, and replicate 1 which failed 6 executions, all with the same failure mode.

Experiment Variant Replicates Failure Logs Debug Dashboard
experiment_with_failures baseline 0 (x8) 1 (x6) Oom killed Debug Dashboard

The debug dashboard links will take you to a debugging dashboard specifically designed to investigate replicate execution failures.

❌ Retried Profiling Replicate Execution Failures (ddprof)

Note: Profiling replicas may still be executing. See the debug dashboard for up to date status.

Experiment Variant Replicates Failure Debug Dashboard
quality_gate_idle baseline 10 Oom killed Debug Dashboard
quality_gate_idle comparison 10 Oom killed Debug Dashboard
quality_gate_idle_all_features baseline 10 Oom killed Debug Dashboard
quality_gate_idle_all_features comparison 10 Oom killed Debug Dashboard
quality_gate_logs baseline 10 Oom killed Debug Dashboard
quality_gate_logs comparison 10 Oom killed Debug Dashboard
quality_gate_metrics_logs baseline 10 Oom killed Debug Dashboard
quality_gate_metrics_logs comparison 10 Oom killed Debug Dashboard

CI Pass/Fail Decision

Passed. All Quality Gates passed.

  • quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_idle_all_features, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

changelog/no-changelog No changelog entry needed internal Identify a non-fork PR medium review PR review might take time qa/done QA done before merge and regressions are covered by tests team/agent-log-pipelines

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant