[Backport 7.82.x] feat(eudm): auto-enable logon_duration in end_user_device mode

pkg/config/setup/config.go

@@ -1481,6 +1481,7 @@ func applyInfrastructureModeOverrides(config pkgconfigmodel.Config) {
 		config.Set("process_config.process_collection.enabled", true, pkgconfigmodel.SourceInfraMode)
 		config.Set("software_inventory.enabled", true, pkgconfigmodel.SourceInfraMode)
 		config.Set("notable_events.enabled", true, pkgconfigmodel.SourceInfraMode)
+		config.Set("logon_duration.enabled", true, pkgconfigmodel.SourceInfraMode)
 	} else if infraMode == "none" {
 		// Disable integrations (no host metrics collection)
 		config.Set("integration.enabled", false, pkgconfigmodel.SourceInfraMode)

pkg/config/setup/config_test.go

@@ -884,6 +884,43 @@ network_path:
 	assert.True(t, config.GetBool("notable_events.enabled"))
 }
 
+func TestInfrastructureModeEndUserDeviceEnablesLogonDuration(t *testing.T) {
+	datadogYaml := `
+infrastructure_mode: end_user_device
+`
+	config := confFromYAML(t, datadogYaml)
+	applyInfrastructureModeOverrides(config)
+
+	assert.True(t, config.GetBool("logon_duration.enabled"),
+		"end_user_device mode should auto-enable logon_duration")
+}
+
+func TestInfrastructureModeNonEUDLeavesLogonDurationDefault(t *testing.T) {
+	datadogYaml := `
+infrastructure_mode: none
+`
+	config := confFromYAML(t, datadogYaml)
+	applyInfrastructureModeOverrides(config)
+
+	assert.False(t, config.GetBool("logon_duration.enabled"),
+		"non-EUD modes should leave logon_duration at its default (false)")
+}
+
+func TestInfrastructureModeEndUserDeviceLogonDurationUserOverride(t *testing.T) {
+	// An explicit user setting must win over the EUD default, since SourceInfraMode
+	// sits below file config in priority.
+	datadogYaml := `
+infrastructure_mode: end_user_device
+logon_duration:
+  enabled: false
+`
+	config := confFromYAML(t, datadogYaml)
+	applyInfrastructureModeOverrides(config)
+
+	assert.False(t, config.GetBool("logon_duration.enabled"),
+		"explicit user logon_duration.enabled=false should override the EUD default")
+}
+
 func TestApplyUseDogstatsdSuppression(t *testing.T) {
 	t.Run("use_dogstatsd=false forces data_plane.dogstatsd.enabled=false", func(t *testing.T) {
 		cfg := confFromYAML(t, `

pkg/system-probe/config/config.go

@@ -192,7 +192,10 @@ func load() (*types.Config, error) {
 	if cfg.GetBool(NSkey("noisy_neighbor", "enabled")) {
 		c.EnabledModules[NoisyNeighborModule] = struct{}{}
 	}
-	if runtime.GOOS == "darwin" && cfg.GetBool(logonDurationNS("enabled")) {
+	// Read from the core config (datadog.yaml), not the system-probe config, so that
+	// enabling logon_duration in the core agent (e.g. via infrastructure_mode:
+	// end_user_device) also starts the system-probe module.
+	if runtime.GOOS == "darwin" && coreCfg.GetBool(logonDurationNS("enabled")) {
 		c.EnabledModules[LogonDurationModule] = struct{}{}
 	}
 

releasenotes/notes/eudm-enable-logon-duration-df982c28223d111f.yaml

@@ -0,0 +1,14 @@
+# Each section from every release note are combined when the
+# CHANGELOG.rst is rendered. So the text needs to be worded so that
+# it does not depend on any information only available in another
+# section. This may mean repeating some details, but each section
+# must be readable independently of the other.
+#
+# Each section note must be formatted as reStructuredText.
+---
+features:
+  - |
+    When ``infrastructure_mode: end_user_device`` is set, the ``logon_duration``
+    feature is now enabled automatically, so operators no longer need to set
+    ``logon_duration.enabled: true`` separately. This setting can still be
+    overridden explicitly in the configuration file if needed.